LAC 48:V.8611. Use, Disclosure, and Confidentiality of Registry Data

A. Access to identifiable or case-specific registry data shall be limited to authorized department personnel with a legitimate need to know, as determined by the department. Each employee, consultant, agent, or contractor of the department authorized to access registry data shall sign an annual agreement to maintain the confidentiality of registry data. The Department of Health shall keep these agreements on file. B. The Department of Health shall implement strict measures to ensure that all identifiable or case-specific information collected, maintained, and/or analyzed as part of registry activities are treated as confidential and privileged. The information shall be collected, maintained, and analyzed in compliance with applicable federal and state laws and regulations protecting the privacy of health information. This includes but is not limited to the following, as applicable: 1. R.S. 40:1125.14; 2. R.S. 40:3.1; 3. R.S. 46:56; 4. the HIPAA Privacy Rule, 45 CFR Parts 160 and 164; and 5. the Common Rule, 45 CFR Part 46 (requirements for review and approval of human subjects research by Institutional Review Board). C. The Department of Health may collaborate with external sickle cell disease partners, such as clinical or genetic patient registries, state and federal sickle cell disease registries, academic institutions or community partners, in activities furthering the purposes of the registry. This includes but is not limited to: 1. aiding in understanding the needs of persons with sickle cell disease related to timely access to preventive and emergency care and continuity of care across their lifespan; 2. aiding in understanding the prevalence and health outcomes related to sickle cell trait; and 3. supporting the delivery of high-quality, accessible services, including clinical care and care coordination. D. Such activities may include the performance of health research aiding people with sickle cell disease, including special studies and human subjects research. Requests for registry data from external parties for use in such activities must be approved by the department. In addition, these request may require review and approval by one or more Institutional Review Boards. Whenever feasible, any disclosure of registry data to external parties should be governed by a data-sharing agreement that outlines the terms, conditions, and limitations of use. E. The registry functions as a public health surveillance system. The primary data to be published or released publicly by public health surveillance systems are expected to be statistical compilations of aggregate data relating to sickle cell disease. The data shall not identify individual cases or individual physicians, hospitals, clinics, or other healthcare providers.