MAINE MEDICAL ASSOCIATION Brian Pierce, MD President • Charles Pattavina, MD President-Elect • Jabbar Fazeli, MD Chair, Board of Directors Gordon H. Smith, Esq. Executive Vice President • Andrew B. MacLean, Esq. Deputy Executive Vice President July 25, 2016 Via Email to: bridget.bagley@maine.gov RE: Proposed Rule Number 2016-P083 10-144 CMR, Chapter 175, Data Release Rule Ms. Bridget Bagley Department of Health and Human Services Maine Center for Disease Control and Prevention 11 State House Station Augusta, ME 04333-0011 Dear Ms. Bagley: The Maine Medical Association (MMA) appreciates this opportunity to address the Maine Department of Health and Human Services (DHHS) and the Maine Centers for Disease Control and Prevention (CDC) concerning Proposed Rule 2016-P083, 10-144 CMR, Chapter 175, relating to the release of data by the CDC about public health issues. The Maine Medical Association comprises over 3900 Maine physicians and medical students. Its mission is to support Maine physicians, to advance the quality of medicine in Maine, and to promote the health of all Maine citizens. We are keenly interested in matters relating to the health of all Maine residents. The MMA is also particularly interested in protecting the privacy of all patients and others with health concerns; our legal staff frequently presents to medical practices around the State on HIPAA and other confidentiality laws and the importance of safeguarding protected health information. Many of our individual members, as well as the MMA as an organization, have a long history of collaboration with the CDC to achieve the common goal of protecting the public health, particularly at times when outbreaks of communicable disease threaten Maine people. The proposed rule at issue, 10-144 CMR Chapter 175, seeks in part to limit the release of information to the public that might possibly indirectly identify certain persons who have communicable diseases, or who have had certain immunizations, or who have been exposed to health risks in their environment. It is unclear from the text of the proposed rule whether it is a blanket rule, to be used indiscriminately under all circumstances, or whether there is any mechanism for balancing the interests of personal privacy with those of public health needs. Certainly the rule does not contain any explicit description of such a mechanism. As a result, it Page 2 has the potential to restrict significantly the dissemination of data that may be necessary in times of significant public health risk to prevent the further spread of life-threatening illnesses. Its terms appear to reach beyond the requirements of safeguarding individuals’ protected health information. Our specific concerns are as follows: Section 2: Internal users and external users. The definition of external users is simply all users who are not internal users. The definition of internal users is limited to CDC employees and contractors under direct CDC supervision. It does not include school nurses. Due to the nature of children’s interactions with each other and their concentration in small spaces, schools are significant and high-risk locations for the spread of communicable diseases. The definition also does not include physicians and other health care providers specializing and working in the area of infectious diseases. Thus these definitions exclude from the class of allowable recipients of information the very experts who are at the front lines of communicable disease management and control. The rule also does not differentiate between public health and infectious disease experts and the general public. While in many circumstances there should be no difference in what is released to those two groups, it is easy to envision times when information should be released first to those in a position to act upon it and only later to the general public. The MMA requests that the CDC reconsider these definitions in light of the significant risks to public health that would result from withholding important information from persons in a position to affect significantly the health of persons in their charge or the general public health. Section 2.2: Indirect identification. In its current form the definition of indirect identification is, in our opinion, overly broad and goes well beyond the level of secrecy necessary to safeguard protected health information of individuals. In addition, it does not differentiate among classes of information in relation to risks presented. It removes from the analysis any form of professional medical judgment about the danger of certain health risks, many of which cannot be predicted in advance. Instead it substitutes for that judgment a simple and undiscriminating mathematical formula. There are some situations of risk that make their appearance among small numbers of people. That does not necessarily mean the individuals involved are at risk of protected health information disclosure. Furthermore, the definition includes among situations requiring secrecy those involving small numerators with large denominators. Thus an occurrence of 5 cases in a population of 1999 would have to be kept secret. It must be kept in mind that these are situations where there is no directly identifying information as set forth in the definition of that term. The description of geographic areas or organizations within the State also does not appear to limit nondisclosure to the enumerated situations. Rather, it states that in those situations nondisclosure is “deemed,” while apparently leaving open the possibility of broader secrecy if the CDC finds it advisable. Frank O. Stred Building • 30 Association Drive • P.O. Box 190 • Manchester, Maine 04351 Phone (207) 622-3374 • Fax (207) 622-3332 • www.mainemed.com 163rd Annual Session • September 9-11, 2016 • Bar Harbor, Maine Page 3 Section 3.B.2: External users. The MMA notes that the rule provides for decision on the release of the information in question “at the sole discretion of the Department,” without any check or balance on this exercise of secrecy. Such power is inappropriately great in the functioning of a public body, particularly a public body which is charged with safeguarding the public health. The rule does not establish any standards relating to how this power will be exercised. It assumes that the Department will always be aware of all arguments on all sides of the question of disclosure, and by doing so it silences important voices which may raise issues not considered by the CDC in making its determinations. Such a limitation on external points of view and information poses a serious risk to the health and safety of Maine residents and others. Finally, the rule also does not appear to allow for any challenge to or appeal of such a determination by the Department. This lack of an appeal mechanism also places the public health at risk and requires a greater degree of reliance on unspecified Department personnel than the law allows in other situations, even those where the public health and safety are not at risk. In summary, the Maine Medical Association asks the DHHS and the CDC to reconsider this proposed rule in light of the serious nature of the risks involved and the extreme degree of unquestioned power it places in the hands of a poorly defined group of individuals within the State government. In reconsideration, adequate allowance should be made for the release of information to individuals and organizations who are in a position to have a positive effect on protecting the public health. Respectfully submitted, The Maine Medical Association By: __/s/ Gordon E. Smith _______________ Gordon E. Smith, Esq., Executive Vice President Frank O. Stred Building • 30 Association Drive • P.O. Box 190 • Manchester, Maine 04351 Phone (207) 622-3374 • Fax (207) 622-3332 • www.mainemed.com 163rd Annual Session • September 9-11, 2016 • Bar Harbor, Maine July 25, 2016 VIA ELECTRONIC SUBMISSION AT: bridget.bagley@maine.gov RE: Proposed Rule Number 10-144 CMR, Chapter 175, Data Release Rule Ms. Bridget Bagley Department of Health and Human Services Maine Center for Disease Control and Prevention 11 State House Station Augusta, ME 04333-0011 Dear Ms. Bagley, MaineHealth appreciates the opportunity to offer comments on the recently proposed rule concerning the ME CDC data release policy. MaineHealth is a family of charitable non-profit healthcare organizations that include 10 hospitals, primary and specialty care practices, home healthcare services, behavioral health services, NorDx laboratories, Synernet healthcare technologies, and the MaineHealth Accountable Care Organization. The MaineHealth service area encompasses eleven Maine counties and adjacent Carroll County in New Hampshire. In addition to caring for patients who access our facilities and services, MaineHealth is committed to improving population health. As such, MaineHealth programs are an integral part of the public health system in Maine. MaineHealth participates in and strongly supports partnerships with ME CDC and other organizations working to improve the health and wellbeing of all Mainers. By statute, MaineHealth facilities and providers are required to report identifiable data, such as those regarding certain diseases and outbreaks, to ME CDC and other DHHS offices. They do so with the expectation that these data will be used to inform public health actions such as the control of epidemics and environmental hazards, and communication to patients about associated health risks. If the data or information collected by, or in possession of, ME CDC indicate an imminent or possible public health threat, these organizations and providers need to know this information to prevent increases in and to reduce further morbidity or mortality. The information allows our hospitals and health care providers to arrange or administer the proper tests, treatments, prophylactic medications, and immunizations for patients, to provide proper guidance for immunocompromised patients, and to facilitate isolation or quarantine of patients appropriately within our medical facilities. These uses of the information are consistent with the stated purpose of the proposed rule: "use of health related information for legitimate public health purposes is critically important to preserving, monitoring and improving populationbased heath as well as personal health of individuals." However, without clarification or appropriate changes, the proposed rule would hinder our efforts to take critical public health action in the face of an imminent or possible public health threat. Lack of ready access to data regarding disease outbreaks, contaminated food or water, school or community immunization rates, or other significant events would prevent MaineHealth facilities and providers from delivering the level of care necessary to protect the health of our patients and communities, which include vulnerable populations like children and adults with serious chronic conditions. We agree with the proposed rule's protection of HIPAA identifiers in the manner reflected in the proposal. The public health data that MaineHealth facilities and providers require to provide appropriate care to their patients do not include the names, address, dates of birth, social security numbers, and other identifiers protected by HIPAA. Our providers can perform their function with aggregated de-identified data about disease outbreaks, immunization rates, and other important public health information. However, the proposed rule goes beyond what is required by HIPAA, and in a manner that threatens the ability of health care providers to furnish the guidance and care that may be needed for their vulnerable patients. To minimize this negative consequence, the proposed rule should be clarified and modified in the following respects: o Indirect Identification, Section 2. The proposed numerator and denominator requirements in Section A under "Indirect Identification" could be read to preclude ME CDC from releasing information about important public health matters (i.e. immunization rates in certain schools, the name of a restaurant where 3 food service workers are diagnosed with hepatitis A, 10 cases of measles cases in a daycare of 49 children, or 5 cases of active tuberculosis in a senior living facility with 30 residents and 10 employees). These are all situations that could lead to significant morbidity and mortality and for which the lack of data release could result in further harm. The risk of "indirect identification" in these circumstances is remote, but the potential adverse health consequences to others in the community if caregivers are not told about these developments can be very serious, and for vulnerable persons, life-threatening. The proposed rule should be modified to authorize the release of such aggregate numerical and location information, absent clear evidence that the actual risk of indirect identification substantially outweighs the potential public health harm. o Data Release, Section B, 2. External Users. In accordance with the comment above, we request clarification on the specific conditions under which de-identified data of the type described above would be released. The proposed rules would provide that the release of such information would occur "as necessary to carry out the public health functions of the Maine CDC." We request that the proposed rule provide standards to govern this determination, and specifically that the determination be made to release information to health care providers and, whenever possible, to the public if: ? ? Releasing such information is reasonably necessary to avoid a risk of imminent or substantial harm to individuals or the public; and Releasing such information will enable providers and/or the public to can take reasonable actions to prevent or reduce the threatened harm. Such may actions include, seeking medical evaluation, testing, treatment, prophylactic medication, immunizations, communication and guidance about risk, and avoiding a contaminated product, water source, location, or environmental hazard. o Prompt Appeal. Finally, because of the emergent circumstances that typically give rise to a request for information, we request a clause be added that confirming that the failure to provide such information with 3 days of a request under Maine's Freedom of Access law shall be regarded as final agency action triggering rights of appeal under the Maine Freedom of Access law (1 M.R.S.A. ? 409) and the Maine Rules Civ.P. Rule 80C. Thank you for this opportunity to comment on the proposed data release rule, Number 10-144 CMR, Chapter 175. If you have any questions or need additional information, please contact me at AALBEJ@mmc.org or by telephone at (207) 482-7061. Sincerely, Jeffery Aalberg, MD, MS Chief Medical Officer, MaineHealth Accountable Care Organization Senior Medical Director, Clinical Integration MaineHealth The Cianchette Building 43 Whiting Hill Road Brewer, Maine 04412 . 207.973.7050 Access to Quality Healthcag? fax 20197371 39 EM HS MEMBERS Acadia Hospital Beacon Health Blue Hill Memorial Hospital July 253 2016 Charles A. Dean Memorial Hospital Eastern Maine Medical Center EMHS Foundation Inland Hospital Maine Coast Memorial Hospital Ms. Bridget Bagley gercy Hospital . Department of Health and Human Servrces Sebasticook Vauey Health Mame Center for Drsease Control and Prevention TAMC . VNA Home Health Hos ice 11 State House Station Augusta, Maine 04333?0011 Subject: proposed Rule Number 10?144 CMR, Chapter 175, Data Release Rule Dear Ms. Bagley, EMHS appreciates the opportunity to comment on the proposed rule impacting Maine CDC release of data. EMHS delivers quality prevention, treatment, emergency transport and population health services throughout the state. EMHS and our member organizations work in partnership with and local communities to prevent epidemics and the spread of disease; to protect populations from injury and environmental hazards; to promote healthy behaviors; to respond to public health emergencies and assist our communities in recovery; and to ensure the quality and accessibility of essential health services, especially for high risk and underserved populations. As the second largest healthcare system in Maine, EMHS plays a vital role supporting Maine ability to assure the delivery of the Essential Public Health Services throughout the state. As an organization guided by evidence based practice and science we utilize CDC data as a foundational source of information supporting our healthcare, population health and public health initiatives. We understand and Operationalize the necessary balance of protecting identi?able personal health information. We respect the responsibility to protect data and release health related information for legitimate public health purposes. We believe it is in the public?s best interest when public health of?cials release as much information as possible, within the limits of the law, and withholding information only when there is a clearly justi?ed reason to keep it con?dential. We support this national best practice standard, as de?ned by the National Association of County and City Health Of?cials (NACCHO) and the Association of State and Territorial Health Of?cials (ASTHO). In 2008 during the H1N1 ?u epidemic, Maine CDC data and information on de-identi?ed cases was essential in supporting health care and community organizations to advance a public health response to prevent the spread of the disease and encourage immunization. The response resulted in a very high level of immunization among pre?school and school aged children which had a dramatic impact on limiting the spread of the virus across the general population. Recognizing our shared goals we offer the following comment. Section 2.2 Indirect Information It is not clear if the restricted limited cell population data size prohibits the release of indirect identifiable data under circumstances where the data release serves to protect the public. We ask that the rule clarify public health situations that support the release of indirect information. Section 3.B.2 External Users The proposed rule states that restricted dam will not be released except as necessary to carry out the public healthfimctions of'the Maine CDC. We ask that the rule clarify public health functions that support the release if information to external users includes conditions when there is evidence that doing so is necessary to prevent or reduce harm or to protect the health and safety of the public. We also recommend that an additional section be added to the rule providing for an appeals process for external users in instances where CDC denies release of data. Sincerely, ?5ng MMLO Douglas Michael, MPH EMHS Chief Community Health Grants Of?cer Kn .. Lisa Harvey?McPherson RN, MBA, MPPM EMHS Vice President Government Relations