Electronic Reporting of Patient Abstract Data by Hospitals for Public Health Syndromic Surveillance

PURPOSE: This rule establishes procedures for secure electronic reporting of patient abstract data for inpatients and outpatients by hospitals to the Department of Health and Senior Services for the purpose of conducting epidemiologic monitoring and studies and publishing information to safeguard the health of the citizens of Missouri as authorized by sections 192.020, 192.067 and 192.667, RSMo. (1) The following definitions shall be used in the interpretation of this rule in addition to the definitions found in 19 CSR 10-33.010: (A) Batch message file means the transmission of a file containing multiple discrete standard electronic messages to the department from the hospital data system on a periodic basis less than real time. (B) Chief complaint means the textual literal or ICD-9-CM code or both pertaining to the initial complaint a patient stated during an acute care hospital encounter. (C) Data encryption means the electronic obfuscation of data within an electronic message using industry standard practices for encryption including, but not limited to: Public Key Infrastructure (PKI), digital certificates/signatures, department generated symmetric keys, or by secure message transport protocols. Minimum requirements will be tripleDES 128-bit encryption. (D) Default standard message means a standard electronic message meeting HL7 2.3.1 Admission, Discharge, and Transfer (ADT) specifications as identified in Exhibit A, included herein. (E) Acute care hospital encounter means patients seen in the emergency room, urgent care and inpatient admissions of a hospital. (F) Real time message means the transmission of discrete standard electronic messages to the department as they are generated by the hospital data system. (G) Secure message transport protocol means a method of sending electronic data to the department in a way that prevents unauthorized access to the data. Possible methods include: Virtual Private Network (VPN), Secure File Transport Protocol (SFTP), secure socket layer (HTTPS/SSL), Secure SHell (SSH), encrypted files using TCP/IP, or other secure transmission protocol agreed upon by the hospital and the department. (H) Standard electronic message means a real time message or batch message file meeting national or international standards for the electronic interchange of data. Standards include, but are not limited to, Health Level 7 (HL7), Extensible Mark-up Language (XML), Electronic Business XML (ebXML), Electronic Data Interchange (EDI), and other standards as they become available. (I) Hospital means a hospital as defined in section 197.020, RSMo. For the purposes of this rule only, hospital shall not include a hospital in a rural area as defined in section 191.500, RSMo; a hospital designated by the Health Resources Services Administration as a small rural hospital; a hospital licensed as a psychiatric or a rehabilitative hospital; or a hospital without an emergency room. Following the completion of implementation of plans submitted to and approved by the department pursuant to section (4), the department may review the need to expand this definition to include hospitals in a rural area as defined in section 191.500, RSMo or hospitals designated by the Health Resources Services Administration as a small rural hospital. (2) All hospitals shall submit to the department a minimum data set on acute care hospital encounters occurring after the date proposed by the hospital and approved by the department. This date shall be either between April 2004 and January 2007 or an earlier date agreed upon by the hospital and the department. Before April 2004, the department shall conduct a pilot study with hospitals that volunteer to participate in the pilot study. At the sole discretion of the department, the pilot study may be extended. If the pilot study is continued, the department shall inform hospitals that their planned implementation date has been postponed to a new date as determined by the department. The data shall be submitted as a default standard electronic message or other format as agreed upon by the hospital and the department, using secure message transport protocols and data encryption. (A) The minimum dataset shall be submitted a minimum of once per day as a batch message file containing the previous day’s hospital encounters and updates. (B) Real time messages will be default standard electronic messages. Other message formats must be approved and agreed upon by the department prior to submission of real time messages. (3) The minimum dataset shall include: record type, hospital identifier, unique encounter identifier, type of encounter, place of service, patient medical record number, patient name, patient Social Security number, patient birth date, patient sex, patient race, patient ethnicity, residence address, city of residence, state of residence, zip code, county code, admission date, type of admission, and chief complaint. See Exhibit A and Exhibit B, included herein, for default standard electronic message specifications. (4) Every hospital shall submit to the department by November 1, 2003 a plan that specifies how and when they will submit data to the department in compliance with section (2) of this rule. This plan may be revised by the hospital, with the approval of the department, in the event the hospital’s capacity to report electronic messages changes to support the default standard electronic message as either batch or real time messages. The hospital shall notify the department by sixty (60) days in advance of the date they plan to change the method in which they report data. This plan shall include but not be limited to: (A) Timing of messages either real time or batch; (B) Secure message transport protocols to be used when submitting data to the department; (C) Proposed format of data if the hospital is not able to conform to the default standard electronic message defined in Exhibit A or Exhibit B; (D) Proposed format code set domain values if the hospital is not able to conform to the code sets defined in Exhibit A or Exhibit B; (E) Hospital technical contact(s) and contact information for the department to utilize in the event technical assistance or support is necessary; (F) Expected date to begin sending messages; (G) If a change request, the reason for change. (5) Hospitals shall notify the department by sixty (60) days in advance if they plan to submit the required data to the department through an association or related organization with which the department has a binding agreement to obtain data. Providers selecting this option are responsible for ensuring that the data meet the data standards defined in this rule and are submitted to the association or related organization so the time schedule in section (2) of this rule is met. The association or related organization is responsible for ensuring that the data are provided to the department and conform to the specifications listed in Exhibit A of this rule, meeting the time schedule of section (2) of this rule. (6) Hospitals may submit data directly to the department or through a third party acting as their agent, other than one with which the department has a binding agreement. Providers selecting this option are responsible for ensuring that all data specifications conform to the requirements of this rule. (7) The department may release patient data on hospital encounters to a public health authority to assist the agency in fulfilling its public health mission. This data shall not be re-released in any form by the public health authority without the prior authorization of the department. Authorization for subsequent release of the data shall be considered only if the proposed release does not identify a patient, physician or provider. However, the department may authorize contact with the patient, physician or provider based upon the information supplied. The physician and provider that provided care to a patient shall be informed by the public health authority of any proposed contact with a patient. (8) Any hospital which determines it will be temporarily unable to comply with any of the provisions of this rule or with the provisions of a previously submitted plan or plan of correction can provide the department with written notification of the expected deficiencies and a written plan of correction. This notification and plan of correction shall include the section number and text of the rule in question, specific reasons why the provider cannot comply with the rule, an explanation of any extenuating factors which may be relevant, the means the provider will employ for correcting the expected deficiency, and the date by which each corrective measure will be completed. (9) Any hospital, which is not in compliance with these rules, shall be notified in writing by the department. The notification shall specify the deficiency and the action, which must be taken to be in compliance. The chief executive officer or designee shall have ten (10) working days following receipt of the written notification of noncompliance to provide the department with a written plan for correcting the deficiency. The plan of correction shall specify the means the provider will employ for correcting the cited deficiency and the date that each corrective measure will be completed. (10) Upon receipt of a required plan of correction, the department shall review the plan to determine the appropriateness of the corrective action. If the plan is acceptable, the department shall notify the chief executive officer or designee in writing and indicate that implementation of the plan should proceed. If the plan is not acceptable, the department shall notify the chief executive officer or designee in writing and indicate the reasons why the plan was not accepted. A revised, acceptable plan of correction shall be provided to the department within ten (10) working days. (11) Failure of the hospital to submit an acceptable plan of correction within the required time shall be considered continued and substantial noncompliance with this rule unless determined otherwise by the director of the department. (12) Failure of any hospital to follow its accepted plan of correction shall be considered continued and substantial noncompliance with this rule unless determined otherwise by the director of the department. (13) Any hospital in continued and substantial noncompliance with this rule shall be notified by registered mail and reported by the department to its Bureau of Hospital Licensing and Certification, Bureau of Narcotics and Dangerous Drugs, Bureau of Emergency Medical Services, Bureau of Home Health Licensing and Certification, Bureau of Radiological Health, State Public Health Laboratory, Bureau of Special Health Care Needs, the Division of Medical Services of the Department of Social Services, the Division of Vocational Rehabilitation of the Department of Elementary and Secondary Education and to other state agencies that administer a program with provider participation. The department shall notify the agencies that the provider is no longer eligible for participation in a state program. (14) Any hospital that has been declared to be ineligible for participation in a state program shall be eligible for reinstatement by correcting the deficiencies and making written application for reinstatement to the department. Any provider meeting the requirements for reinstatement shall be notified by registered mail. The department shall notify state agencies that administer a program with provider participation that the provider’s eligibility for participation in a state program has been reinstated. AUTHORITY: sections 192.020, 192.067 and 192.667, RSMo 2000.* Emergency rule filed June 25, 2003, effective July 6, 2003, expired Jan. 2, 2004. Original rule filed June 25, 2003, effective Dec. 30, 2003. *Original authority: 192.020, RSMo 1939, amended 1945, 1951; 192.067, RSMo 1988; and 192.667, RSMo 1992, amended 1993, 1995.