Section 661.120  Confidentiality and Access to Data in Newborn Screening Registries

a)         The Department will maintain confidentiality of information that would identify individual patients. All data in the Registry or Registries obtained directly from medical, intervention or parent-reported records of individual patients shall be for the confidential use of the Department and those authorized users designated by the Department to view the individual patient records as described in Section 661.110(g). Information contained in the Registry or Registries shall be confidential and not subject to inspection by persons other than authorized users designated. (Section 23 of the EHDI Act)

b)         The Department will disclose individual patient test results or patient information to the reporting facility that originally supplied that information to the Department, and to the primary care providers and consulting medical specialists caring for the child. Test results may also be disclosed to the parent or legal guardian and to the patient when 18 years of age or older.

c)         Only the minimum information necessary for the intended purpose will be disclosed. Disclosure may take place using secure electronic means, including, but not limited to, email, text, or secure portal, compliant with HIPAA and FERPA security and privacy standards. A person or institution to whom information is furnished, or to whom access to records has been given, shall not divulge any part of the records so as to disclose the identity of the person or persons to whom the information or records relate, except as necessary for the person's diagnosis, treatment and interventions.

d)         Identifiable data may be released to the extent necessary for the diagnosis, treatment, interventions, or public health surveillance for the purpose of care coordination, follow-up services and to assess long-term outcomes. Identifiable data may be shared for conditions of public health significance, i.e., as permitted by HIPAA or FERPA regulations, the Medical Studies Act, and the Health Statistics Act and in accordance with established agreements with entities such as the CDC. As described in the Health Statistics Act, a Department-approved Institutional Review Board or its equivalent on the protection of human subjects in research shall review and approve requests from researchers for individually identifiable data.

e)         The Registry or Registries shall be accessible to authorized users who have completed a user agreement and are approved by the Department for access.  Authorized users can search, submit, and obtain information related to newborn blood spot, newborn hearing and newborn heart screening.

f)         The Registry or Registries may only be used for the provision of services under this Part as described in Section 661.120(d).  Authorized users who engage in any prohibited use of the Registry may be denied further access to the Registry, in addition to any other penalties provided by law.