HomeMy WebLinkAboutAgreement A-18-375 with CDPH.pdfData Use Agreement
Between CDPH and the County of Fresno
1
DATA USE AGREEMENT (DUA)
Between
THE CALIFORNIA DEPARTMENT OF PUBLIC HEALTH (CDPH)
and
THE COUNTY OF FRESNO
1. Parties
This DUA has been made and entered into by and between CDPH and the
County of Fresno, Healthy Start Grantee (HS Grantee).
2.Service Overview
The HS Grantee is a grantee of the federal Maternal Child Health Bureau, Health
Resources and Services Administration (HRSA) and has agreed to be part of a
national Healthy Start evaluation to be conducted by HRSA. This DUA will
establish protocols and restrictions for governing data information sharing to
conduct a national evaluation of the Healthy Start program for the HS Grantee.
The HS Grantee will seek the informed consent of HS Grantee participants to
allow the HS Grantee to provide certain personally identifiable data (Linkage
Variables) to CDPH. CDPH will receive from HS Grantee the Linkage Variables
on selected 2017 Healthy Start participants who have consented to participate in
the national Healthy Start evaluation. CDPH will use the Linkage Variables to link
with information provided on the birth and infant death records associated with
these Healthy Start participants. CDPH will then submit the linked data and
de-identified annual birth data for the HS Grantee’s county to HRSA to tabulate
the data. HRSA will conduct their evaluation pursuant to approval by the
California Committee for the Protection of Human Subjects and the California
Vital Statistics Advisory Committee.
3.Legal Authorities
A.The provisions of the California Health and Safety Code (HSC) sections 102230
and 102231 authorize this DUA.
B.Pursuant to HSC section 102232, violation of HSC section 102231 or 102230 is a
misdemeanor punishable by one year in jail and/or a fine of $1,000 for each
violation. Additionally, violation of the terms of this DUA or HSC section 102230
may be cause for denial of any further access to the data files maintained by
CDPH.
Agreement No. 18-375
Data Use Agreement
Between CDPH and the County of Fresno
2
4. Effect of the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
A. CDPH and HS Grantee HIPAA Status: CDPH is a “hybrid entity” for purposes
of applicability of the federal regulations entitled "Standards for Privacy of
Individually Identifiable Health Information" (Privacy Rule) (45 C.F.R. parts 160,
162, and 164) promulgated pursuant to the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) (42 U.S.C. §§ 1320d - 1320d-8) (as
amended by Subtitle D Privacy, of the Health Information Technology for
Economic and Clinical Health (HITECH) Act (Pub. L. 111–5, 123 Stat. 265–
66)). The Public Health Policy and Research Branch has not been designated
by the CDPH as, and is not, one of the HIPAA-covered “health care
components” of CDPH. (45 C.F.R. § 164.504(c)(3)(iii).) The legal basis for this
determination is as follows:
1. The Public Health Policy and Research Branch is not a component of
CDPH that would meet the definition of a covered entity or business
associate if it were a separate legal entity. (45 C.F.R. §§
160.105(a)(2)(iii)(D); 160.103 (definition of “covered entity”).) And,
2. The HIPAA Privacy Rule creates a special rule for a subset of public
health activities whereby HIPAA cannot preempt state law if, “[t]he
provision of state law, including state procedures established under
such law, as applicable, provides for the reporting of disease or injury,
child abuse, birth, or death, or for the conduct of public health
surveillance, investigation, or intervention.” (45 C.F.R. § 60.203(c)
[HITECH Act, § 13421, sub. (a)].) [NOTE: See State laws and
regulations in Legal Authorities].
B. CDPH is a “Public Health Authority”: CDPH is a “public health authority” as that
term is defined in the Privacy Rule. (45 C.F.R. §§ 164.501; 164.512(b)(1)(i).)
C. Linkage Variables Use and Disclosure Permitted by HIPAA: To the extent a
disclosure or use of Linkage Variables may also be considered a disclosure or
use of “Protected Health Information” (PHI) of an individual, as that term is
defined in part 160.103 of Title 45, Code of Federal Regulations, the following
Privacy Rule provisions apply to permit such Linkage Variables disclosure
and/or use by CDPH and HS Grantee, without the consent or authorization of
the individual who is the subject of the PHI:
1. HIPAA cannot preempt state law if, “[t]he provision of state law, including
state procedures established under such law, as applicable, provides for
the reporting of disease or injury, child abuse, birth, or death, or for the
conduct of public health surveillance, investigation, or intervention.” (45
C.F.R. § 60.203(c) [HITECH Act, § 13421, sub. (a)].) [NOTE: See state
laws and regulations listed in Legal Authorities].
Data Use Agreement
Between CDPH and the County of Fresno
3
2. A covered entity may disclose PHI to a “public health authority” carrying
out public health activities authorized by law (45 C.F.R. § 164.512(b));
3. A covered entity may use or disclose protected health information to the
extent that such use or disclosure is required by law and the use or
disclosure complies with and is limited to the relevant requirements of
such law. (Title 45 C.F.R. §§ 164.502 (a)(1)(vii), 164.512(a)(1).) And,
4. Other, non-public health-specific provisions of HIPAA may also provide
the legal basis for all or specific Linkage Variables uses and disclosures.
D. No HIPAA Business Associate Agreement or Relationship between CDPH and
HS Grantee: This Agreement and the relationship it memorializes between
CDPH and HS Grantee do not constitute a business associate agreement or
business associate relationship pursuant to Title 45, CFR, part 160.103
(definition of “business associate”). The basis for this determination is part
160.203(c) of Title 45 of the Code of Federal Regulations (see, also, [HITECH
Act, § 13421, subdivision. (a)].). Accordingly, this Agreement is not intended to
nor at any time shall result in or be interpreted or construed as to create a
business associate relationship between CDPH and HS Grantee. By the
execution of this Agreement, CDPH and HS Grantee expressly disclaim the
existence of any business associate relationship.
5. Term of DUA
The term of this DUA is effective upon the date last signed and executed by the
duly authorized representative of both parties, whichever is later, and will remain
in effect through May 31, 2019.
6. Definitions
“Linkage Variables” means personally identifiable information identified in Exhibit
A provided by the HS Grantee to CDPH in order to obtain linkage with vital
records.
Data Use Agreement
Between CDPH and the County of Fresno
4
7. Project Representatives
A. The project representatives during the term of this DUA will be:
CALIFORNIA DEPARTMENT OF PUBLIC
HEALTH, PUBLIC HEALTH POLICY AND
RESEARCH BRANCH
Ellen Badley, Chief, MHA
Public Health Policy and Research Branch
PO Box 997410, MS 5101
Sacramento, CA 95899-7410
Telephone: (916) 552-8095
E-mail: ellen.badley@cdph.ca.gov
COUNTY OF FRESNO
Ah Vang, Health Educator
Department of Public Health
P.O. Box 11867
Telephone: (559) 600-3330
E-mail: ahvang@co.fresno.ca.us
B. Direct all administrative inquiries to:
CALIFORNIA DEPARTMENT OF PUBLIC
HEALTH, PUBLIC HEALTH POLICY AND
RESEARCH BRANCH
Leo Dyragos, Unit Chief
Policy and Analysis Unit
PO Box 997410, MS 5101
Sacramento, CA 95899-7410
Telephone: (916) 621-1545
E-mail: leo.dyragos@cdph.ca.gov
COUNTY OF FRESNO
Aphivanh Xayavath, Staff Analyst
Department of Public Health
P.O. Box 11867
Telephone: (559) 600-3330
E-mail: axayavath@co.fresno.ca.us
Data Use Agreement
Between CDPH and the County of Fresno
5
C. Direct all data delivery and information technology inquiries to:
CALIFORNIA DEPARTMENT OF PUBLIC
HEALTH
John Marinko, Contractor
PO Box 997410, MS 5101
Sacramento, CA 95899-7410
Telephone: (916) 449-5174
E-mail: John.Marinko@cdph.ca.gov
COUNTY OF FRESNO
Rose Mary Rahn, Division Manager
Department of Public Health
P.O. Box 11867
Telephone: (559) 600-3330
E-mail: rrahn@co.fresno.ca.us
D. Direct all privacy and security inquiries to:
CALIFORNIA DEPARTMENT OF PUBLIC
HEALTH, INFORMATION SECURITY
OFFICE
Charles Lano, Chief Information Security
Officer
PO Box 997377, MS 6302
Sacramento, CA 95899-7413
Telephone: (855) 500-0016
E-mail: Charles.Lano@cdph.ca.gov
COUNTY OF FRESNO
Privacy:
David Pomaville, Director
Public Health
P.O. Box 11867
Fresno, CA 93775
Telephone: (559) 600-6405
E-mail: dpomaville@fresno.ca.us
Security:
Robert W. Bash, Director
Internal Services/Chief Information Officer
333 W. Pontiac Way
Clovis, CA 93612
Telephone: (559) 600-5800
E-mail: rbash@FresnoCounty.gov
8. Responsibilities of the Parties
A. CDPH agrees to:
1. Receive the Linkage Variables, use them solely for the purposes expressly
authorized in the Service Overview and not share that data with any other
agency during the duration of this DUA. No other use is granted under this
DUA, and data will not be used to approve or deny any service.
2. Protect data files and not sell, release, or otherwise transfer any portion of the
data files unless expressly permitted in this DUA.
3. Ensure appropriate protections are implemented for administrative, physical,
and technical safeguards that will protect the confidentiality, integrity, and
availability of the data files.
Data Use Agreement
Between CDPH and the County of Fresno
6
4. Ensure all precautions are in place for continuous security of all computerized
data systems containing the data files.
5. Transmit data files to HRSA, and no other entity, via a secure, industry
standard process.
6. Consistent with CDPH’s records retention requirements, destroy Linkage
Variables received from HS Grantee at the conclusion of the national Healthy
Start evaluation.
B. HS Grantee agrees to:
1. By April 10, 2018, or as soon as possible thereafter, provide Linkage
Variables to CDPH for:
a) Any pregnant woman served in calendar year 2017 with informed consent,
including any served in 2016 with a known or expected delivery date in
2017.
b) Any postpartum woman served in calendar year 2017 with informed
consent, who delivered in 2017 or beyond. This group will serve as an
important internal comparison group.
2. Capture the Linkage Variables in Excel spreadsheet format, as described in
Exhibit B, and send via secure email such that the information contained in
the email is encrypted, and is available to the project representatives.
Data Use Agreement
Between CDPH and the County of Fresno
1
EXHIBIT A
Instructions for HS Grantee to collect Individual Identifiers (Linkage Variables)
Collect as many individual identifiers as possible from the list of participants below (bold
are required):
1) Any pregnant woman served in calendar year 2017 with informed consent,
including any served in 2016 with a known or expected delivery date in 2017.
2) Any postpartum woman served in calendar year 2017 with informed consent
who delivered in 2017 or beyond. This group will serve as an important
internal comparison group.
The greater the detail that is collected, the greater the likelihood of successful linkage to
vital records.
Individual Identifiers (Linkage Variables)
• Mother’s name* in separate fields for:
o First
o Middle
o Last
o Maiden
• Mother’s date of birth
• Mother’s Unique Client ID # that can be used to anonymously identify the HS
participant and subsequently link back to any client-level information (e.g., 3Ps)
that is provided to HRSA
• Mother’s address at time of delivery
o Street number
o Street name
o City
o ZIP code
o County
• Infant’s date of birth* (or expected month, day and year of delivery if unknown)
• Infant’s name * in separate fields for:
o First
o Last
Bold = required elements
*May not be available if participant is lost to follow-up (e.g., moves, stops participating,
etc.) or has not yet delivered; linkage will be attempted regardless of the number of
available individual identifiers.
EXHIBIT B
County of Fresno Linkage Variables
Page 1 of 1 5/8/2018
Mother's
First
Name
Mother's
Middle Name
Mother's
Last
Name
Mother's
Maiden Name
Mother's
DOB
Mother's
Client ID #Street #Street Name City ZIP Code County
Infant's
DOB
Infant's
First
Name
Infant's
Last
Name
Linkage Variables 4/10/2018, or as soon as possible thereafter
Delivery Schedule