WSR 15-10-065 PROPOSED RULES
DEPARTMENT OF HEALTH
[Filed May 1, 2015, 12:17 p.m.]
Original Notice.
Preproposal statement of inquiry was filed as WSR 14-16-094.
Title of Rule and Other Identifying Information: Chapter 246-455 WAC, Hospital patient discharge information, amending and creating new rules to strengthen protections of patient health care information.
Hearing Location(s): Department of Health, Town Center Two, Room 158, 111 Israel Road S.E., Tumwater, WA 98501, on June 10, 2015, at 9:30 a.m.
Date of Intended Adoption: June 17, 2015.
Submit Written Comments to: Kris Reichl, Center for Health Statistics, P.O. Box 47814, Olympia, WA 98504-7814, e-mail http://www3.doh.wa.gov/policyreview/, fax (360) 753-4135, by June 10, 2015.
Assistance for Persons with Disabilities: Contact Kris Reichl by May 27, 2015, TTY (800) 833-6388 or 711.
Purpose of the Proposal and Its Anticipated Effects, Including Any Changes in Existing Rules: The proposed rule implements ESSB 6265 regarding CHARS data by establishing types of data files (confidential, potentially identifiable and public), creating a methodology for determining when indirect patient identifiers may become direct identifiers, and allowing options for creating a public data file to include either removing data or aggregating or anonymizing data. The rule also defines government agencies and makes housekeeping changes identified as part of a regular review of the rules.
Reasons Supporting Proposal: The proposed rule implements the intent and requirements of ESSB 6265 to protect patient information collected through the CHARS system while allowing for release of important health data as permissible by the law.
Statutory Authority for Adoption: RCW 43.70.052, ESSB 6265 (2015).
Statute Being Implemented: RCW 43.70.052, ESSB 6265 (2015).
Rule is not necessitated by federal law, federal or state court decision.
Name of Proponent: Department of health, governmental.
Name of Agency Personnel Responsible for Drafting: Kris Reichl, 101 Israel Road S.E., Tumwater, WA 98501, (360) 236-4311; Implementation and Enforcement: Christie Spice, 101 Israel Road S.E., Tumwater, WA 98501, (360) 236-4307.
No small business economic impact statement has been prepared under chapter 19.85 RCW. The proposed rule would not impose more than minor costs on businesses in an industry.
A cost-benefit analysis is required under RCW 34.05.328. A preliminary cost-benefit analysis may be obtained by contacting Kris Reichl, P.O. Box 47814, Olympia, WA 98504-7814, phone (360) 236-4311, fax (360) 753-4135, e-mail kristin.reichl@doh.wa.gov.
May 1, 2015
Dennis E. Worsham
Deputy Secretary
for John Wiesman, DrPH, MPH
Secretary
AMENDATORY SECTION (Amending WSR 07-09-091, filed 4/18/07, effective 5/23/07)
WAC 246-455-010 Definitions.
((As used in)) The definitions in this section apply throughout this chapter, unless the context clearly requires otherwise((,
(1) "Department" means department of health.
(2) "Diagnosis-related groups" is a classification system that groups hospital patients according to principal and secondary diagnosis, presence or absence of a surgical procedure, age, presence or absence of significant comorbidities or complications, and other relevant criteria.
(3) "Hospital" means any health care institution which is required to qualify for a license under RCW 70.41.020(2); or as a psychiatric hospital under chapter 71.12 RCW.
(4) "CHARS" means comprehensive hospital abstract reporting system.
(5) "CHARS Procedure Manual" means the written instructions for reporting hospital discharge data to the department.
(6) "CHARS 837 Companion Guide" means the written technical guidelines for creating the ASC X12 837 Health Care Claim file for CHARS.
(7) Uniform Billing "UB-92/UB-04 data set" means the data element specifications developed by the National Uniform Billing Committee which can be found at www.NUBC.org. The UB-92 specifications will be used until they are replaced by the UB-04 of the National Uniform Billing Committee. Data elements are completely defined in the CHARS Procedure Manual which may be obtained on the department's web site or by contacting the department.
(8) "Patient discharge" means the termination of an inpatient admission or observation stay, including an admission as a result of a birth, in a Washington hospital.
(9) "Office of Management and Budget" means a body within the Executive Office of the President of the United States which is tasked with coordinating United States Federal agencies and can be found at www.whitehouse.gov/OMB.
(10) "Individually identifiable health information" means any health information that can be linked or traced to an individual or family. It includes but is not limited to: Past, present and future health care; billings or payments for health care; physical or mental health conditions; and physical or mental health diagnosis. This includes names and parts of names, Social Security numbers and parts of Social Security numbers, date of birth, admission date, exact discharge date, procedure date, nine-digit zip code and identifiers and patient control numbers assigned by a hospital for record retrieval.
(11) "Minimum necessary use" means that the use and disclosure of individually identifiable health information will be limited to the minimum amount necessary to accomplish the authorized purpose.
(12) "Data sharing agreement" means a signed agreement between government agencies, or researchers having an Institutional Review Board approval for transmitting, receiving and using records containing individually identifiable health information. Sharing such records requires each agency to have independent statutory authority to receive and disclose the information. The agreement specifies, at a minimum, what information will be exchanged, and the conditions or restrictions under which the information will be used and protected.)):
(1) "CHARS" means comprehensive hospital abstract reporting system.
(2) "CHARS Procedure Manual" means the written instructions for reporting hospital discharge data to the department.
(3) "CHARS 837 Companion Guide" means the written technical guidelines for creating the ASC X12 837 Health Care Claim file for CHARS.
(4) "Data use agreement" means a signed agreement with the department for transmitting, receiving and using records containing individually identifiable or potentially identifiable health information. The agreement specifies, at a minimum, what information will be exchanged, the conditions or restrictions under which the information will be used and protected, restrictions on redisclosure of data and restrictions on attempts to locate information associated with a specific individual.
(5) "Department" means Washington state department of health.
(6) "Diagnosis-related groups (DRG)" is a classification system that groups hospital patients according to principal and secondary diagnosis, presence or absence of a surgical procedure, age, presence or absence of significant comorbidities or complications, and other relevant criteria.
(7) "Discharge data" means a collection of patient records in which each record represents a single patient discharged from the hospital following an inpatient or observation stay.
(8) "Hospital" means any health care institution which is required to qualify for a license under chapter 70.41 RCW or as a psychiatric hospital under chapter 71.12 RCW.
(9) "Office of Management and Budget" means a body within the Executive Office of the President of the United States which is tasked with coordinating United States Federal agencies and can be found at http://www.whitehouse.gov/omb.
(10) "Patient discharge" means the termination of an inpatient admission or observation stay, including an admission as a result of a birth, in a Washington hospital.
(11) Uniform Billing "UB-04 data set" means the data element specifications developed by the National Uniform Billing Committee which can be found at www.NUBC.org. Data elements are completely defined in the CHARS Procedure Manual which may be obtained on the department's web site or by contacting the department.
AMENDATORY SECTION (Amending WSR 07-09-091, filed 4/18/07, effective 5/23/07)
WAC 246-455-020 Reporting of ((UB-92/))UB-04 data set information.
(1) ((Effective for all hospital patient discharges on or after April 1, 1994,)) Hospitals shall collect and report the following ((UB-92 or UB-04)) data set elements to the department:
(a) Patient control number
Patient's unique alpha-numeric number assigned by the hospital to facilitate retrieval of individual patient records
(b) Type of bill
(c) ((Medicare provider number (UB-92),)) National Provider Identifier (UB-04), or department assigned identifier, as applicable
(d) Patient last name (at least the first four letters)
(e) Patient first name (at least the first three letters)
(f) Patient middle initial
(g) Patient Social Security number (at least the last four digits)
(h) Patient zip code (U.S.A.)
(i) Patient country code (outside U.S.A.) International Organization for Standardization (ISO) 3166-1
(j) Patient's date of birth
(k) Sex
(l) Admission date
(m) Type of admission
(n) Source of ((admission)) point of origin
(o) Patient discharge status
(p) Statement covers period (from - through)
(q) Revenue code
(r) Units of service
(s) Total charges
(t) Payer identification (up to three): Payer identification number per the CHARS procedure manual identifying each payer group from which the hospital may expect some payment of the bill
(u) Principal diagnosis code
(v) Other diagnosis codes
(w) External cause of injury (ECI) code
(x) Principal procedure code
(y) Other procedure code
(z) Attending provider identifier (((legacy ID for UB-92);)) National Provider Identifier ((or legacy for UB-04)) according to Centers for Medicare and Medicaid Services (CMS) schedule
(aa) Operating physician identifier (((legacy ID for UB-92);)) National Provider Identifier ((or legacy for UB-04)) according to CMS schedule, as applicable
(bb) Other provider identifiers (((legacy ID for UB-92);)) National Provider Identifier ((or legacy for UB-04)) according to CMS schedule, as applicable
(cc) Admission hour
(dd) Race - Per minimum Office of Management and Budget (OMB) standards
(ee) Ethnicity - Per minimum OMB standards
(ff) Discharge hour
(gg) Procedure date
(hh) Present on admission status
(ii) Health care provider taxonomy code
(jj) Health care common procedure coding system (HCPCS)
(kk) Service date
(2) The hospital shall report all patient discharge data described in WAC 246-455-010 and 246-455-020 according to ((UB-92/))UB-04 specifications unless noted otherwise.
AMENDATORY SECTION (Amending WSR 94-12-090, filed 6/1/94, effective 7/2/94)
WAC 246-455-070 Revisions to submitted data.
(((1))) All data revisions required as a result of the edits performed pursuant to WAC 246-455-020 shall be corrected and returned to the department or its designee within fourteen working days.
(((2) The department may assess a civil penalty as provided in RCW 70.170.070 and WAC 246-455-100 for the costs associated with more than one cycle of edits as described in WAC 246-455-060.))
AMENDATORY SECTION (Amending WSR 07-09-091, filed 4/18/07, effective 5/23/07)
WAC 246-455-080 Security of the data.
(1) The department and its contractors or agents shall maintain the confidentiality of ((any individually identifiable health information)) data from CHARS as required by ((RCW 70.170.090 and federal Health Insurance Portability and Accountability Act standards)) chapter 70.170 RCW.
(2) The department shall institute security and system safeguards to prevent and detect unauthorized access, modification, or manipulation of individually identifiable health information. Accordingly, the safeguards will include:
(a) Documented formal procedures for handling the information;
(b) Physical safeguards to protect computer systems and other pertinent equipment from intrusion;
(c) Processes to protect, control and audit access to the information;
(d) Processes to protect the information from unauthorized access or disclosure when it is transmitted over communication networks;
(e) Processes to protect the information when it is physically moved from one location to another;
(f) Processes to ensure the information is encrypted when:
(i) It resides in an area that is readily accessible by individuals who are not authorized to access the information (e.g., shared network drives or outside the agency data centers);
(ii) It is stored in a format that is easily accessible by individuals who are not authorized to access the information (e.g., text files and spreadsheets);
(iii) It is stored on removable media, or portable devices (e.g., tapes, electronic disks, thumb drives, external hard drives, laptops and ((handheld)) hand-held devices).
NEW SECTION
WAC 246-455-085 Data files—Release of data files and data use agreements.
The department may create and release data files with patient discharge information as allowed under RCW 43.70.052. The type of information contained in the file, including direct and indirect patient identifiers, determines the category and permitted release of the data file.
(1) Confidential data files contain one or more direct patient identifiers.
(a) The department may distribute a confidential data file to:
(i) Government agencies after entering into a data use agreement; or
(ii) Researchers with approval from the Washington state IRB and a signed confidentiality agreement.
(b) Direct patient identifier means information that identifies a patient. Direct identifiers include:
(i) Patient first name;
(ii) Patient middle name(s);
(iii) Patient last name;
(iv) Social Security number;
(v) Patient control number or medical record number;
(vi) Patient zip code + four digits;
(vii) Dates that include day, month, and year; and
(viii) Admission and discharge dates in combination.
(c) Government agencies include: Washington state boards, commissions, committees, departments, educational institutions, or other Washington state agencies which are created by or pursuant to statute, other than courts and the legislature; Washington county or city agencies, U.S. federal agencies.
(d) In order to comply with RCW 70.02.240 protecting mental health information for youth, for patients under age eighteen, the confidential data file will not include mental health related diagnosis or procedure codes or any diagnosis related groups or major diagnosis category.
(e) In order to comply with WAC 246-490-110 protecting the identity of facilities that provide abortions, for any hospitalization that includes a diagnosis or procedure code indicating an induced termination of pregnancy, the confidential file will not include patient name, facility ID, provider identifiers, or geographic identifiers less than state.
(f) The department may provide the fewest data elements necessary for the stated purpose of the project.
(2) Potentially identifiable data files contain indirect patient identifiers.
(a) The department may distribute a potentially identifiable data file to anyone after entering into a data use agreement with the requestor or requesting organization.
(b) Indirect patient identifier means information that may identify a patient when combined with other information. Identification of a specific patient is more likely when a file contains a group of ten or fewer similar hospitalizations.
(c) Indirect patient identifiers include the following data elements, in combination or individually, when they create a group of ten or fewer similar hospitalizations in a file:
(i) Hospital or provider identifiers;
(ii) Five digit zip code;
(iii) County, state, and country of residence;
(iv) Dates that include month and year;
(v) Admission and discharge hour;
(vi) Secondary diagnosis, procedure, present on admission, external cause of injury, and payer codes;
(vii) Age in years;
(viii) Race and ethnicity.
(d) The potentially identifiable data file does not contain any direct identifiers listed in subsection (1)(b)(i) through (viii) of this section.
(3) Public data file with no patient identifiers:
(a) The department may release an unrestricted public data file that does not contain information that alone or in combination with other information identifies a patient.
(b) The department may create a public file by:
(i) Removing all data elements identified in subsection (2)(c)(i) through (viii) of this section; or
(ii) By aggregating or anonymizing data identified in subsection (2)(c)(i) through (v), (vii), and (viii) of this section so that each combination of indirect patient identifiers remaining in the public file must appear at least ten times.
(c) The public data file does not contain any direct identifiers listed in subsection (1)(b)(i) through (viii) of this section.
REPEALER
The following sections of the Washington Administrative Code are repealed:
| ||||||