Hepatitis B Perinatal Reporting and HIPAA

This memo addresses the Minnesota Department of Health's analysis on the interaction between HIPAA and the Perinatal Hepatitis B Prevention Program.

*MDH wrote another memo addressing the interaction of HIPAA and the Minnesota Communicable Disease Reporting Rule in general. For copies of this memo, contact, the Perinatal Hepatitis B Prevention Program at 651-201-5511.

How HIPAA Interacts with the Perinatal Hepatitis B Prevention Program

Disclaimer of Legal Advice: The following is the Minnesota Department of Health's (MDH) analysis of how the Minnesota Communicable Disease Reporting Rule, Parts 4605.7000 to 4605.7900, and Minnesota Statutes, §144.05, subd. 1(a) interact with the Health Insurance Portability and Accountability Act (HIPAA, privacy rules, 45 CFR 160 and 164) in regards to the Perinatal Hepatitis B Prevention Program. This is not legal advice, and you should not rely on it as legal advice. Consult with a lawyer for legal advice.

Issue

The following question has been raised by some providers, their medical records departments, and their staff: Does HIPAA permit disclosure of specific patient medical information related to hepatitis B infections and perinatal reporting to MDH or other local public health authorities without patient authorization?

Finding

MDH has concluded that HIPAA permits a provider and/or the provider's medical records department or staff to release medical information pertaining to a person's hepatitis B status, their contacts, their pregnancy, and their baby without the patient's authorization in accordance with the Minnesota Communicable Disease Reporting Rules and M.S.§144.05, subd. 1(a). This finding was based upon a review of HIPAA privacy rule and guidance from the U.S. Centers for Disease Control and Prevention (CDC) and U.S. Department of Health and Human Services (HHS).¹

The patient's medical information must be related to the communicable disease report. This information includes, but is not limited to, personally identifiable information on the patient and their contacts and the tests conducted, the results of those tests, treatments related to the disease, and other pertinent information conducted.

Analysis

General HIPAA Information
HIPAA governs the use and disclosure of protected health information (PHI). It applies to health plans, health care clearinghouses, and health care providers who transmit certain health claims information electronically. These entities are covered entities under the rule.

A covered entity must obtain a written authorization from the individual for the use and disclosure of PHI unless the disclosure is to the individual, for treatment, payment, or health care operations, or the disclosure falls under one of the specified exceptions.

HIPAA privacy rules, specifically 45 CFR² §164.512, addresses the uses and disclosures of PHI for which an authorization or an opportunity to agree or object is not required. Specifically:

• Section 164.512(a) permits disclosures that are required by law, which includes statutes and rules;³ and
• Section 164.512(b) permits a covered entity to disclose PHI to:

  "(i) A public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions; . .."

Under HIPAA, 45 CFR 164.501, Public health authority is defined as "an agency or authority of …, a State, . . ., or a political subdivision of a State . . . , that is responsible for public health matters as part of its official mandate."

Therefore, to the extent a public health authority is authorized by law to collect or receive information for the public health purposes, covered entities may disclose PHI to such public health authority without patient authorization.

Minnesota laws authorizing the collection of hepatitis B cases
Minn. Stat. §144.05, subd. 1(a)⁴ and Minnesota Rules, Part 4605.704 and 4605.7090 requires providers to report cases of perinatal hepatitis B and outlines the information to be provided. Minnesota Rules, Part 4605.7500 directs the commissioner "to investigate the occurrence of cases, suspected cases, or carriers of reportable diseases ... identifying unreported cases, locating contacts of cases, identifying those at risk of disease, determining the necessary control measures…"

Nine out of ten (90%) babies birthed by hepatitis B-positive persons will become chronic carriers if left untreated and may pass it on to others with whom they come in close contact. In addition, a chronic carrier can develop chronic liver disease, cirrhosis of the liver, or primary liver cancer. Therefore, to protect the public's health, the state must know a pregnant person's hepatitis B status, be able to conduct a case contact investigation, and collect information on her baby.

Therefore, under current Minnesota rules and statutes, providers are allowed under HIPAA to report the information regarding this program to MDH or other local public health authorities.

Summary

In summary, M.S. §144.05, subd. 1(a) and the Minnesota Communicable Disease Reporting Rules, Parts 4506.7040 to 4605.7900, allow MDH and local public health authorities to conduct studies and investigations on communicable diseases to protect the public's health. Therefore, providers, their medical records departments, and their staff can share medical information pertaining to a communicable disease investigation, e.g., hepatitis B, without patient authorization.

Minnesota Department of Health,
March 14, 2023

¹April 11, 2003 Vol 52/Early Release MMWR: HIPAA Privacy Rule and Public Health; Guidance from CDC and the U.S. Department of Health and Human Services
²CFR is the Code of Federal Regulations
³45 CFR 164.502, Definitions.
⁴M.S.§144.05, subd. 1(a) gives the commission of health authority to conduct studies and investigations, collect and analyze health and vital data, and identify and describe health problems.