CHAPTER
He-W 900 OTHER PROGRAMS ADMINISTERED BY
THE DEPARTMENT OF HEALTH AND HUMAN SERVICES
PART He-W 910 – RESERVED
He-W 910.01
Source. #6925, eff 1-1-99; amd
by #7666, eff 4-1-02; ss by #8227, eff 1-1-05; rpld
by #10139, eff 7-1-12
He-W 910.02
Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12
He-W
910.03 & He-W 910.04
Source. #6925, eff 1-1-99; ss by #7804, eff 1-1-03;
ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12
He-W
910.05
Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12
He-W 910.06
Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05;
ss by #8467, eff 10-29-05; ss by #9513, INTERIM, eff 7-18-09, EXPIRES: 1-14-10;
ss by #9617, eff 1-14-10; rpld by #10139, eff 7-1-12
He-W
910.07
Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05;
ss by #8467, eff 10-29-05; ss by #9747, eff 7-1-10; rpld
by #10139, eff 7-1-12
He-W
910.08
Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12
He-W
910.09
Source. #7666, eff 4-1-02; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12
He-W
910.10
Source. #8227, eff 1-1-05; rpld
by #10139, eff 7-1-12
PART
He-W 950 COMPREHENSIVE HEALTH CARE
INFORMATION SYSTEM PROCEDURES FOR THE RELEASE OF CLAIMS DATA SETS FOR PUBLIC
AND RESEARCH PURPOSES
He-W 950.01 Purpose. This part specifies the requirements, procedures
and conditions under which persons other than department personnel may have
access to health care claims data sets.
Source. #8600, eff 4-6-06;
ss by #10703, eff 10-23-14
He-W 950.02 Scope. This chapter shall apply only to data
collected under RSA 420-G:11, II.
Source. #8600, eff
4-6-06; ss by #10703, eff 10-23-14
He-W 950.03 Definitions.
(a) “Cell size” means the count of patients that
share a set of characteristics contained in a statistical table.
(b) “Commissioner” means the commissioner of the
(c) “Confidential data” means individual or
collective data elements contained in the claims data set that:
(1)
Have not been revealed previously to the general public; and
(2)
Directly identify a patient.
(d) “Department” means the
(e) “Direct patient identifiers” means:
(1)
Names;
(2)
Business names when that name would serve to identify a patient;
(3)
Postal address information other than town or city, state, and 5-digit
zip code;
(4)
Specific latitude and longitude or other geographic information that
would be used to derive postal address;
(5)
Telephone and fax numbers that identify a patient;
(6) Electronic
mail addresses that identify a patient;
(7)
Social security numbers that identify a patient;
(8)
Medical record numbers;
(9)
Health plan beneficiary numbers;
(10) Certificate
and license numbers that identify a patient;
(11)
Internet protocol (IP) addresses and uniform resource locators (URL)
that identify a business that would serve to identify a patient;
(12)
Biometric identifiers, including finger and voice prints; and
(13)
Personal photographic images.
(f) “Disclosure” means to communicate clinical or
other health care information data collected pursuant to RSA 420-G:11, II, to a
person not already in possession of that information.
(g) “Encrypted” means a method by which the true
value of data has been disguised in order to prevent the identification of
persons or groups, and which does not provide the means for recovering the true
value of the data.
(h) “Health care claims data sets” means
information consisting of or derived directly from member eligibility files, or
medical, pharmacy, or dental claims files submitted by health care claims
processors collected under RSA 420-G:11, II, and include:
(1)
Public use data sets; and
(2) Limited
use data sets.
(i) “Health care practitioner” means physicians
and all persons licensed or registered as a health care provider in the state
of
(1) Nurses;
(2) Podiatrists;
(3) Optometrists;
(4) Pharmacists;
(5) Chiropractors;
(6) Physical therapists;
(7) Dentists;
(8) Psychologists;
(9) Licensed clinical social workers;
(10) Marriage and family therapists;
(11) Professional counselors; and
(12) Physicians’ assistants.
(j) “Indirect patient
identifier” means:
(1)
All geographic subdivisions of New Hampshire or any state or province,
including census tracts, blocks, and block groups, cities, towns, zip codes,
and their equivalent geocodes, except county;
(2)
Race;
(3)
All elements of dates, except year, for dates related to a patient,
including birth date, admission date, discharge date, date of death, and all
ages over 89 and all elements of dates, including year, indicative of such age,
except that such elements may be aggregated into a single category of age 90
and older; and
(4)
Group policy numbers.
(k)
“Limited use data set” means a health care claims data set that contains
restricted data elements, which might be disclosed to an outside party for
research purposes without the patient’s authorization when:
(1)
All direct patient identifiers have been encrypted in such a way as to
not allow direct identification, and to prevent linkage to other data sets
where the patient can be directly identified;
(2)
Any data that directly identifies or would lead to the indirect
identification of health care practitioners performing abortions has been
removed; and
(3) All
insured group or policy numbers cannot be used to directly identify a patient.
(l) “Patient” means any person in the data set
that is the subject of the activities of the claim performed by the health care
provider.
(m) “Principal investigator” means the person in
charge of a project that makes use of limited use data sets. The principal investigator is the custodian
of the data and is responsible for the observance of all conditions of use and
for establishment and maintenance of security arrangements to prevent
unauthorized use.
(n) “Public use data set” means a data set that
is publically available, contains data collected
under RSA 420-G:11, II, is free of confidential data, and from which all known
direct or indirect patient identifiers have been removed in accordance with 45
CFR 164.514(a)-(b).
(o) “Release” means to make all or part of the claims
data set available for inspection and analysis to persons other than the
department and the
(p) “Research” means “research” as defined in 45
CFR 46.102(d).
(q) “Statistical table” means single or multivariate
counts based on the information contained in a data set and which does not
include any direct identifiers.
Source. #8600, eff
4-6-06; ss by #10703, eff 10-23-14
He-W 950.04 Release
of Public Use Data Sets.
(a) Public use data sets collected or generated
by the department or its designee shall be made available in public use files
and provided to any person upon written request, except where otherwise
prohibited by law.
(b) Public use data sets shall be obtained by
submitting a completed “Request Form for NH Commercial Claims Public Use Data
Set” (October 2014) containing:
(1)
The requestor’s name and contact information, such as address, phone
number, or e-mail address;
(2) The
requestor’s organization name, if applicable; and
(3)
The type and years of data requested.
Source. #8600, eff 4-6-06;
ss by #10703, eff 10-23-14 (from He-W 950.05)
He-W 950.05 Release
of Limited Use Data Sets.
(a) In
accordance with 45 CFR 164.514(e)(3)(i), limited use
data sets shall only be released for purposes of research.
(b) Any researcher requesting access to limited
use data sets shall submit a completed “Application for Access to New Hampshire
Limited Use Commercial Health Claims Research Data Set” form (October 2014),
and shall execute a contract which describes the permitted uses of data.
(c) Except
as otherwise provided by law, the department shall release the requested
limited data sets when:
(1) The application is complete pursuant to (b)
above;
(2) The applicant demonstrates the following:
a. How
inventory of data files will be maintained and updated;
b.
That physical access to the data files will be restricted to only
research staff;
c.
That safeguards are in place for research staff, having access to the
data files, including but not limited to confidentiality agreements and
training on stewardship responsibilities;
d.
Procedures for tracking active employment and project participation
status of research staff throughout the life the project(s);
e.
The technical and physical safeguards which will be performed to
maintain security of the data files,
including but not limited to site and office access controls, secured file
cabinets and locked offices;
f. The
technical safeguards performed to protect data stored on local workstations and
onsite and external servers;
g.
The method of encryption used as the data sets are moved between
computers; and
h.
The technical safeguards performed to prevent the creation of additional
copies of the data;
(3) The qualifications of the investigator and
research staff demonstrate their ability to undertake the study or accomplish
the intended study as documented by:
a.
Training and previous research, including prior publications in the
proposed or related area; and
b. An
affiliation with a university, private research organization, medical center,
state agency, or other institution that will provide sufficient research
resources;
(4) The applicant has demonstrated that the data
sets are required in order to undertake the study or accomplish the intended
use;
(5) The applicant has never been found to have
violated the terms of a prior data use agreement;
(6) The claims data release advisory committee
has been given 45 days after receipt of the application to comment on the
merits of the application to the department in accordance with He-W 950.06(d)
below; and
(7) No other state or federal law, or federal
regulation prohibits release of the requested information.
(d)
If the department declines to release the limited use data sets, within
60 days of receipt of the application, the department shall provide a written
statement identifying the specific criteria that are the basis for denial of
the application.
(e)
Studies taking longer than 2 years shall require annual renewal of the
request.
(f) Except as provided in (i) below, the researcher shall provide the department with
a copy of any proposed release at least 15 days prior to publication or release
of any report or publication that contains information derived from the data
set so that the department has the opportunity to review the release and verify
that the agreed upon conditions have been applied.
(g)
If the department determines, based on the review required in (f) above,
that a report or publication contains information that might lead to direct or
indirect identification of patients, employers or other group purchasers, the
department shall provide a written statement to the researcher stating
specifically the problematic sections in the publication.
(h)
When the department issues a statement in accordance with (g) above, the
researcher shall modify the report or publication prior to its release by fully
addressing the problematic sections.
(i) When the department determines that multiple
reports will be of a similar nature, the department shall waive the requirement
that any subsequent reports or publications be provided to the department prior
to release by the researcher.
(j)
Any draft reports or publications supplied to the department shall be
treated as confidential and shall not be released by the department.
(k)
The department shall:
(1) Maintain records of applications for, and
releases of, limited use data sets and make them available for public
inspection;
(2) Maintain a system for tracking the dates by
which data sets shall be returned or destroyed; and
(3) Maintain records of the review of
publications, if applicable.
Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14
(from He-W 950.06)
He-W 950.06 Claims
Data Release Advisory Committee.
(a) The department shall establish a claims data
release advisory committee to provide non-binding advice and opinion on the
merit of applications for limited use data sets.
(b) The purpose of the claims data release
advisory committee shall be to review applications for limited use data sets
when requested to do so in accordance with (d) below, and to advise the
commissioner on whether:
(1) The release is consistent with:
a.
The statutory purpose of the Comprehensive Health Care Information
System (CHIS), established in accordance with RSA 420-G:11-a; and
b.
The requirements of Health Insurance Portability and Accountability Act
of 1996 (HIPAA) and its implementing regulations, 45 CRF Part 160-164; and
(2) The intended use of the data will:
a.
Contribute to efforts to improve health care for
b. Be
for research that employs appropriate analytical methods.
(c) The claims data release advisory committee
shall be annually appointed by the commissioner and consist of the following
members:
(1) One member representing insurance carriers;
(2) One member representing health care
facilities;
(3) One member representing health care
practitioners;
(4) One member representing the general public;
(5) One member representing purchasers of health
insurance;
(6) One member representing health care
researchers; and
(7) Two members of the department.
(d) Upon request from the commissioner, the
claims data release advisory committee shall review an application and provide
the commissioner with any comment on the merits of the application and the
research protocol described therein within 45 days.
Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14
He-W 950.07 Fees.
(a) Nothing in this section shall exempt any requestor
from paying fees otherwise established by law for obtaining copies of the data
sets.
(b) Such fees shall be based on the costs of
providing the copy in the format requested.
(c) The department, or the contracted agent,
shall provide the requestor with a written description of the basis for the
fee.
Source. #8600, eff
4-6-06; ss by #10703, eff 10-23-14 (from He-W 950.08)
He-W 950.08 Exemption from Rule.
(a)
Release of the entire claims data set to the NHID shall be made without
restriction except that the NHID shall defer to the department any release of
data sets and shall not release data sets to other parties, except as specified
in the data collection rules, Ins 4000, and except for the public use data set in whole or part.
(b) The department and the NHID shall release data to their
agents for specific projects as needed.
(c) The department and the NHID shall ensure that contracts
with their agents contain signed agreements to maintain the confidentiality of
the data, prevent unauthorized re-release of the data sets, and prevent the
agents from using the data for their own benefit or advantage.
Source. #8600, eff
4-6-06; ss by #10703, eff 10-23-14 (from He-W 950.09)
He-W 950.09 General
Limitation.
(a) The Comprehensive Health Information System, established
in accordance with RSA 420-G:11-a, shall not contain direct patient
identifiers.
(b) Neither the department nor any employee or agent shall
receive, obtain, or otherwise possess direct patient identifiers or supply them
to others.
Source. #8600, eff
4-6-06; ss by #10703, eff 10-23-14 (formerly He-W 950.10)
APPENDIX
RULE |
STATUTE |
He-W 950.01 |
RSA 420-G:11-a |
He-W 950.02 |
RSA 420-G:11-a |
He-W 950.03 |
RSA 420-G:11-a |
He-W 950.04 |
RSA 420-G:11-a |
He-W 950.05 |
RSA 420-G:11-a |
He-W 950.06 |
RSA 420-G:11-a |
He-W 950.07 |
RSA 126-A:5,X |
He-W 950.08 |
RSA 420-G:11-a |
He-W 950.09 |
RSA 420-G:11-a |