Navigating Legal Parameters for Cross-Sector Data Collaboration

Written by Cortney Bruno, MSW; Abigail Fallen, RHIA; Teagan Kuruna, MPH; and Jacqueline Rodriguez, JD, of Camden Coalition of Healthcare Providers; and Anne Marie Jensen, BS, EMT-P, of San Diego Fire-Rescue Department, City of San Diego

Individuals with complex health and social needs interact frequently with multiple healthcare providers and social service agencies.^1,2 Despite repeated contact with these systems, these individuals can continue to experience significant barriers to their health and well-being.^3,4 Given their multisystem involvement, improving outcomes for this subset of the population requires care coordination and service integration, along with tailored programming aimed at addressing social barriers to wellness.^2,4

To address the needs of these individuals, providers first need to know who they are. Integrating data from multiple sectors, such as social services, education, criminal justice, and healthcare, can help providers identify individuals who are facing multisector barriers to wellness. The fuller picture provided by cross-sector data can illuminate a person’s health and nonhealth needs, help improve communication among providers within and across sectors, and make a case for tailoring and integrating services.

While there are benefits to cross-sector data collaboration, establishing data-sharing partnerships requires navigating legal and regulatory guidelines that have not kept up with current technology or were not designed with cross-sector collaboration in mind. Cross-sector collaboration, by nature, involves industries bound by different regulations. Potential partners may shy away from sharing data because they are unclear about the legal and ethical implications of data sharing, or because they are wary of what partners may do with the data. Organizations may be concerned with client privacy or feel obligated to protect clients’ information, especially because many cross-sector partnerships aim to address problems confronting vulnerable populations. Organizations may also view legal and regulatory frameworks as prohibitive to data sharing when, in fact, the regulations may allow for sharing data in certain circumstances.

Following are 2 case studies describing how the San Diego Fire-Rescue Department and the Camden Coalition of Healthcare Providers addressed legal and regulatory concerns while building cross-sector data-sharing relationships. San Diego Fire-Rescue’s Resource Access Program (RAP) developed a tool to help staff members understand with whom they can share information and under which circumstances data can be shared. The Camden Coalition of Healthcare Providers, as a partner in the Camden Promise Neighborhood initiative, built a cross-sector data-sharing agreement that was appropriate for the program goals while complying with legal and regulatory requirements for each sector involved. Lessons from these organizations can help programs and initiatives navigate the legal issues at play while establishing data-sharing partnerships.

San Diego Fire-Rescue’s Resource Access Program

Developing a tool to navigate legal and ethical implications of data sharing

One significant challenge that arises during data-sharing collaborations is determining which data can be legally and ethically shared with which partners. For San Diego Fire-Rescue, this lack of clarity impeded communication among the various professionals in that same department. Emergency medical services are inherently multidisciplinary, responding to emergencies that involve the overlapping systems of public safety, healthcare, and public health. Cross-sector professionals who work as coworkers in the department were unsure what could be shared among themselves. For example, an emergency medical services provider treating a burn victim may not know what information can be shared with a police officer conducting an arson investigation for the same incident.

In response, RAP developed a matrix to guide staff through the legal and ethical implications of sharing various data with different stakeholders. Following is a description of the process RAP used to create, implement, and use the disclosure matrix. (See Appendix A for a copy of the matrix.)

1. Identify the need

Complying with the Health Insurance Portability and Accountability Act (HIPAA) is often one of the foremost concerns for data-sharing partners. The most clear-cut way to ensure HIPAA compliance is to have individuals sign a data-sharing consent or authorization form. However, because RAP often works with patients who are experiencing crises, requiring a signed form is not always a reasonable expectation. RAP was specifically interested in developing a procedure that clarified how data can be shared when patients are unable to consent, such as during a medical emergency or when an individual is intoxicated.

2. Perform a gap analysis

Drawing on strong organizational motivation, the program and legal staff at RAP conducted a gap analysis. It clarified its existing data-sharing policies, gaining understanding about which information was already being shared; which information it wanted to share; and with whom it wanted to, but did not currently, share information. For example, RAP had policies in place regarding how to share medical information with families and how to disclose mental health information to healthcare entities. Through this gap analysis, staff noticed that the existing and potential policies had 2 components: what information would be shared and with whom the information would be shared.

3. Create a disclosure matrix

Knowing each policy encompassed these 2 components, RAP created a matrix to organize the requirements of each policy in a user-friendly way so that providers could make decisions about data sharing when patients couldn’t sign consent or authorization forms. The matrix consolidated the policies into a single tool that can be used as a guide for determining how to share information legally and ethically. RAP examined each policy to understand the type of recipient and type of information that the policy covered. To fill in the matrix, RAP’s attorney provided the response for each information and recipient combination.

Because the information being shared is often about vulnerable individuals, considering not only the legal but the ethical implications of sharing information alongside the benefits is crucial. Simply asking “can I share this information?” only allows for a yes/no response. Instead, RAP uses the matrix to answer the question “under which ethical and legal circumstances can this information be provided to this recipient?” This question allows for a wider range of answers, listed in the Disclosure Decision Matrix’s “Matrix Legend,” which is used by an attorney to complete the spaces correlating to type of information and type of recipient.

4. Support staff during implementation and use

While the matrix is a useful tool, RAP also recognized that staff need support to effectively navigate the relationships involved in sharing data across sectors. Establishing appropriate expectations about data sharing can help create relationships in which desire for information sharing is balanced with respect for patient privacy. It is, therefore, important to prepare healthcare staff for interacting with professionals who are not bound by HIPAA, such as police or homeless outreach workers, and for conversations when they are unable to share requested information with cross-sector colleagues alongside whom they work regularly. RAP empowers staff to handle these scenarios by providing scripts with suggested language for responding to difficult requests, such as:

• When information cannot be shared: “Unfortunately, I can’t share that information with you. I know it may not seem like a big deal, but we have to follow the laws about health information privacy very carefully or we could face some pretty serious penalties.”
• When the provider needs time to consult the matrix: “Let me review the patient’s file and get back to you.”
• When discussing patient information via text message but need to switch to a phone call: “I’m not allowed to text you that information but let me call you later with details.”

Camden Coalition’s Promise Neighborhood Data-Sharing Agreement

Creating a usable, flexible agreement for cross-sector data sharing

In support of the mission of the Center for Family Services’ Camden Promise Neighborhood initiative, the Camden Coalition is building the data governance and infrastructure necessary for sharing and analyzing data. Building on its long-standing relationships with organizations throughout Camden, New Jersey, the Camden Coalition created data-sharing agreements with an array of education and social service partners serving children and families to facilitate cross-sector collaboration. This case study outlines the process by which the Camden Promise Neighborhood data-sharing agreement was drafted, signed, and implemented.

1. Determining which data sets are necessary and why

With the goals of the Camden Promise Neighborhood in mind, the Camden Coalition began by understanding the Promise Neighborhood’s core partners and exploring which data sets they could provide. The Camden Coalition’s legal and data security teams researched the federal and state laws and regulations that govern multiple data sets, including personally identifiable information from student education records, protected health information from healthcare data, and program data collected by social service agencies. The Camden Coalition considered the laws and regulations governing each type of data, knowing that the data-sharing agreement would adhere to the strictest standard.

2. Demonstrating reliability and ensuring privacy and security

Both the Center for Family Services and the Camden Coalition have been working with individuals and organizations in Camden for many years, and they were able to build on these long-standing relationships to create buy-in for the agreement. The Center for Family Services leadership drew on its track record of providing high-quality services across the region to champion the data-sharing agreements and articulate the Camden Promise Neighborhood vision: rallying partners toward the common goal of getting families the services they need. The Camden Coalition has been showing the value of data sharing and demonstrating trustworthiness for years through its community-based initiatives. The Camden Coalition brought not only the legal and technological expertise necessary to execute data sharing to link and analyze data sets, but also the credibility necessary to address partners’ potential concerns. Robust language in the data-sharing agreement assured partners that data security was being taken seriously and that the agreement created shared responsibility for keeping information safe.

3. Creating an adaptable yet secure data-sharing agreement

Guided by its understanding of the Camden Promise Neighborhood’s needs, the laws and regulations, and data security requirements, the Camden Coalition created the data sharing agreement (See Appendix B). The agreement was designed to be broad, while maintaining necessary privacy standards, so that partners could feel comfortable signing it with only minor changes. When signed, the agreement gives the participating entities the ability to use data for 2 purposes: (1) case management (written consent required) and (2) research or evaluation purposes (written consent not required) (See Figure). This allows for flexibility as needs and priorities change while protecting sensitive or identifiable information such as personal information (eg, name, address, date of birth, student ID number), Family Educational Rights and Privacy Act—protected information (student education records), HIPAA-protected information (individually identifiable health information), and confidential business information.

Purpose of data sharing

Written consent required?

Language used in the agreement

Case management

Yes

For inclusion in the Camden Promise Neighborhood case management system, which is a component of Camden ARISE and is used by Camden Promise Neighborhood Solutions (“Solutions”) to coordinate, manage, track, and report on the services provided by all or some of the other Camden Promise Neighborhood Solutions to individuals and families. [NAME] agrees to allow the disclosure of personally identifiable information to the entities shown in Exhibit A to this Agreement provided that (i) appropriate consent or authorization, if required for use, has been obtained from the individual or the individual's parent or guardian; and (ii) a role-based access control is assigned as specified in Exhibit A.

Research

No

For research and evaluation purposes to study and report on the impact of services provided by Solutions and other organizations contributing data for inclusion in Camden ARISE (“Data Contributor(s)”) to citizens of Camden City and Southern New Jersey on individuals and families in the area and to study and report on factors related to service provision, assessment of need, and topics relevant to innovating new approaches to benefit the citizens of Camden City and Southern New Jersey.

Figure: Example language used in data-sharing agreement

4. Negotiating with partners

Conversations around data sharing had been underway for more than a year before the data-sharing agreement was shared for approval and signature. As the partner organizations went through their review process, the Camden Coalition program managers handled questions that partners had about minor changes, such as contact information or the date the agreement would go into effect. The Camden Coalition’s legal counsel conducted deeper legal research to address more substantive questions and changes. For example, indemnification—the assignment of risk for potential legal issues—was a point of contention for 1 partner organization. This partner wanted the indemnification language changed because of state-level restrictions on its sector’s ability to take on risk for certain types of data. After fully understanding the legal implications, the Camden Coalition changed the specific agreement for this partner removing the indemnity language so that the contract is “silent,” and indemnity will only be addressed if a problem arises.

5. Current uses/issues with the agreement

All the major data-sharing partners have signed the data-sharing agreement. Recently, a question arose with 1 of the partner organizations. The agreement is written to allow 2 kinds of sharing: (1) Promise Neighborhood’s case management process, which the agreement states requires written consent, and (2) research purposes, which the agreement does not state requires written consent. The Camden Coalition had a relationship with the partner’s general counsel, and when that individual left the organization and a new person took the role, there were questions about whether data could, in fact, be shared for research and evaluation purposes without signed consent. Using its previous research on the laws and regulations governing this data set, the Camden Coalition wrote a memo giving more context about the rules, clarifying how the data-sharing agreement met those requirements.

As the organization responsible for the data-sharing agreement, the Camden Coalition has responded to questions like this by recognizing where the apprehension comes from and helping to address the concerns through research. Partners often expect legal and regulatory frameworks to impede data sharing—but sometimes, regulation can help facilitate the data-sharing process.

About the Brief

This brief, made possible by the Aetna Foundation, is one of a series of briefs and webinars outlining considerations for cross-sector data sharing to improve health and well-being. Each brief builds upon content presented in a webinar of the same topic. Find recordings of the webinars and the series of briefs at https://www.nationalcomplex.care/blog/data-sharing/.

The authors thank Bob Goerge of Chapin Hall for presenting in the webinar upon which this brief is based. The authors also thank Candice Dias of the Center for Family Services and Hannah Mogul-Adlin, Felicia Santiago, Aaron Truchil, Dawn Wiest, and Katie Wood of the Camden Coalition of Healthcare Providers for their valuable input.

About the Innovators

San Diego Fire-Rescue’s Resource Access Program

The Resource Access Program (RAP) is the strategic social arm of San Diego Fire and EMS departments. RAP is a paramedic-based surveillance and case management system that intercepts high emergency medical service (EMS) users. The purpose of the program is to reduce dependence on EMS and acute care services by linking the individual with appropriate resources for their underlying medical, mental health, and social needs through integrated data and information sharing among partners. Prior to developing the matrix, colleagues in the Fire and EMS departments were often unsure of about the legal and ethical considerations of data sharing.

The Camden Promise Neighborhood

Recognizing the strong link between low educational attainment and unmet social needs, the Camden Promise Neighborhood is “creating a comprehensive pipeline of services and a cradle through college to career path” for children in its catchment area. Led by the Center for Family Services, the Camden Promise Neighborhood brings together schools, nonprofits, and other organizations to ensure that families are getting the social services they need. Data sharing is key to this endeavor, allowing partners to build connections between schools and social services.

References

1. Vickery KD, Bodurtha P, Winkelman TN, et al. Cross-sector service use among high health care utilizers in Minnesota after Medicaid expansion. Health Aff (Millwood). 2018;37(1):62-9. doi:10.1377/hlthaff.2017.0991.

2. The Commonwealth Fund and the London School of Economics and Political Science. designing a high-performing health care system for patients with complex needs: ten recommendations for policymakers, expanded and revised Edition. Commonwealth Fund. http://www.commonwealthfund.org/publications/fund-reports/2017/aug/ten-recommendations. Published September 8, 2017. Accessed April 5, 2018.

3. Hayes SL, Salzberg CA, McCarthy D, et al. High-need, high-cost patients: who are they and how do they use health care? A population-based comparison of demographics, health care use, and expenditures. The Commonwealth Fund. http://www.commonwealthfund.org/publications/issue-briefs/2016/aug/high-need-high-cost-patients-meps1. Published August 29, 2016. Accessed April 5, 2018.

4. Blumenthal D, Anderson G, Burke S, Fulmer T, Jha AK, Long P. Tailoring complex-care management , coordination , and integration for high-need , high-cost patients: a vital direction for health and health care. National Academy of Medicine. https://nam.edu/tailoring-complex-care-management-coordination-and-integration-for-high-need-high-cost-patients-a-vital-direction-for-health-and-health-care/. Published September 19, 2016. Accessed April 5, 2018.