AGO_2019-03

AARON D. FORD Attorney General KYLE E.N. GEORGE First Assistant Attorney General CHRISTINE JONES BRADY Second Assistant Attorney General STATE OF NEVADA OFFICE OF THE ATTORNEY GENERAL 100 North Carson Street Carson City, Nevada 89701 June 25, 2019 JESSICA L ADAIR Chief of Staff RACHEL J. ANDERSON General Counsel HEIDI PARRY STERN Solicitor General OPINION NO. 2019-03 # HEALTH; HIPPA; REPORTING OF OVERDOSE ACTIVITY DATA: Exceptions to the Health Insurance Portability and Accountability Act (HIPAA) permit Nevada's first responders to report overdose surveillance data through the Overdose Detection Mapping Application Program (ODMAP). Richard Whitley, Director Department of Health and Human Services 4126 Technology Way, Suite #1600 Carson City, NV 89706 Dear Director Whitley: Pursuant to NRS 228.150, you have requested an opinion from the Office of the Attorney General regarding your agency's participation in the program known as ODMAP, an overdose tracking system administered by the Nevada High Intensity Drug Trafficking Area (HIDTA).¹ In general terms, your question is whether Nevada's first responders may, in support of ODMAP, report overdose surveillance data to HIDTA without violating the Health Insurance Portability and Accountability Act (HIPAA).² Although this office cannot interpret HIPAA for any of the federal officials or employees who administer and enforce its provisions, we do have the authority under federal law to bring civil actions on behalf of state residents for violations of the HIPAA privacy and security rules.³ Therefore, in light of our limited HIPAA ¹ http://www.hidta.org/odmap ² Pub. L. 104-191, 110 Stat. 1936. ³ Section 13410(e) of the Health Information Technology for Clinical Telephone 775-684-1100 • Fax 775-684-1108 • Web ag nv gov • E-mail aginfo@ag.nv.gov Twitter @NevadaAG • Facebook /NVAttorneyGeneral • YouTube /NevadaAG Richard Whitley, Director Department of Health and Human Services Page 2 June 25, 2019 enforcement function, we offer the following guidance, but with the proviso that federal agencies, officials and employees have no obligation to defer to the opinions expressed herein. ## BACKGROUND HIDTA is a federally financed program overseen by the White House Office of National Drug Control Policy. HIDTA works with federal, state, and local law enforcement officials to bolster enforcement, intelligence, training and prevention efforts in areas with increased drug trafficking or crime.⁴ For the health and safety of the public, several federal agencies worked collaboratively to develop the ODMAP system that is the subject of this inquiry. The ODMAP system relies heavily upon participation by first responders because first responders typically have the most current and accurate information about drug overdoses. When first responders encounter a person experiencing an overdose, they may use the ODMAP smartphone system to upload the location of the overdose, the amount of naloxone administered, and any resulting fatality. Although first responders do not report the identity of any individual who suffers an overdose, they report enough information about the incident to assist health and public safety officials to identify the areas where available resources, including naloxone, will be most effectively deployed. The Department of Health and Human Services (DHHS) has the authority to ascertain and document the number, trends, patterns and risk factors related to fatalities cause by drug overdoses.⁵ Further, DHHS publishes an annual report that details interventions and provides information “that may be effective in reducing fatal and nonfatal opioid-related drug overdoses and other drug overdoses.”⁶ Given these responsibilities, DHHS uses ODMAP for public health surveillance to prevent or lessen the serious threat of overdoses. Through its participation in ODMAP, DHHS assists government agencies and other stakeholders to direct their services to the areas that are most significantly impacted by opioid abuse. Additionally, DHHS may use the information acquired through the ODMAP and Economic Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009, Pub.L. 111-5.. ⁴ https://www.whitehouse.gov/ondcp/hidta ⁵ NRS 453C.130(1) ⁶ NRS 453C.130(2) Richard Whitley, Director Department of Health and Human Services Page 3 June 25, 2019 system to award targeted grants to the agencies and organizations that are best positioned to provide services in a specific geographic region.7 ## QUESTION ONE Does the reporting of information through ODMAP implicate the HIPAA privacy rule as it applies to covered entities? ## SUMMARY CONCLUSION TO QUESTION ONE The HIPAA privacy rule protects health care information when it is held or transmitted by a covered entity. Any first responder who is a health care provider and transmits health information in an electronic format is a covered entity for purposes of HIPAA. While most of the information reported to ODMAP does not implicate the HIPAA privacy rule, the address of the location of the overdose could be considered “protected health information” (PHI) as that term is used and defined in federal regulations. Consequently, when a first responder reports information through ODMAP, the first responder’s transmission of that report may implicate the HIPAA privacy rule even though the report provides no specific details about the identity of the individual who has suffered an overdose. ## ANALYSIS The HIPAA privacy rule governs the use and disclosure of an individual’s PHI when held or transmitted by any of the following covered entities: 1) a health plan; 2) a health care clearinghouse; or 3) a health care provider who transmits any health information in electronic form for a connected transaction such as for billing.8 Although the HIPAA privacy rule does not apply to law enforcement officials, it does apply to providers of emergency medical services (EMS) and to other first responders who are covered health care providers. PHI is defined to include any health-related information that “identifies the individual” or forms “a reasonable basis to believe that [the] information can be used to identify the individual.”9 Although the information uploaded to ODMAP does not include the name of the person who has suffered an overdose, information concerning the location of the overdose could, through investigative 7 NRS 453C.140 8 45 CFR § 164 Subpart E, Privacy of Individually Identifiable Health Information. 9 45 CFR § 164.501 and 45 CFR § 160.103 Richard Whitley, Director Department of Health and Human Services Page 4 June 25, 2019 efforts, lead to a subsequent identification of the person. Although HIPAA does not restrict the use or disclosure of “de-identified” health information, the law considers the use or disclosure of location information to be subject to the HIPAA privacy rule when it refers to a geographic unit that is any smaller than a state.¹⁰ ## QUESTION TWO Does any public health or law enforcement exception to HIPAA permit disclosure to ODMAP by covered entities? ## SUMMARY CONCLUSION TO QUESTION TWO Two relevant exceptions to the HIPAA privacy rule allow covered entities to disclose PHI without written authorization from the individual to whom the PHI pertains. These are: 1) the exception in 45 CFR § 164.512(j)(1)(i) for certain disclosures to a public health authority; and 2) the exception in 45 CFR § 164.512(b)(1)(i) for disclosures made in good faith to prevent or lessen a public health threat. These exceptions to the HIPAA privacy rule permit covered entities to disclose PHI through ODMAP to DHHS and law enforcement. ## ANALYSIS The exception in 45 CFR § 164.512(j)(1)(i) permits a covered entity to use or disclose PHI if the covered entity believes in good faith that the use or disclosure is necessary to prevent or lessen a serious threat to the health and safety of a person or the public. The public health emergency declared by the President in October 2017, as well as the Nevada Governor’s formation of a taskforce to address the subject of prescription drug abuse, confirm the nationwide consensus that drug overdoses are a serious threat to public health and safety. Congress’ recurring appropriations for HIDTA and ODMAP further attest to the severity of the opioid epidemic and the federal government’s commitment to combatting it on a nationwide scale. Given this level of governmental commitment, participation by first responders in ODMAP is reasonably characterized as necessary to prevent or lessen a serious threat to the health and safety of the public. Furthermore, the process for disclosing information through ODMAP to law enforcement and DHHS is narrowly tailored to protect sensitive information, thus striking an appropriate balance between protecting personal privacy and promoting public health and safety. ¹⁰ 45 CFR §164.514(b)(2)(i)(b) Richard Whitley, Director Department of Health and Human Services Page 5 June 25, 2019 The exception in 45 CFR § 164.512(b)(1)(i) permits a covered entity to use or disclose PHI to a public health authority authorized by law to collect or receive such information to avert a serious threat to public health. Disclosure through ODMAP to DHHS qualifies for this exception because the disclosure serves the purpose of public health surveillance, investigation and intervention. Under NRS 453C.130, DHHS is authorized by law to collect and receive this information in furtherance of its obligation to protect the health and welfare of the general public. ## CONCLUSION Nevada's first responders may report overdose surveillance data through ODMAP under exceptions to the Health Insurance Portability and Accountability Act (HIPAA). The reporting through ODMAP will promote both accuracy and an expedited response so that DHHS and law enforcement can address the urgent and critical needs of our community to prevent or lessen the serious threat of overdoses. Sincerely, AARON D. FORD Attorney General By: Linda C. Anderson Linda C. Anderson Chief Deputy Attorney General LCA/klr