DHS 120.31(2)(b)
(b) Calculated variables added to the public use physician office databases do not require approval by the IRB before the department releases them.
DHS 120.31(2)(c)
(c) The independent review board shall establish acceptable custom requests for physician office data or analyses that will not require repeated re-authorizations by the IRB.
DHS 120.31(2)(d)
(d) The independent review board shall meet as often as necessary to review policies and requests for custom data or custom analyses of the physician office data.
DHS 120.31(2)(e)
(e) Notwithstanding s.
15.01 (1r), Stats., the independent review board may promulgate only those rules that are first reviewed and approved by the board on health care information.
DHS 120.31(3)(a)(a) The department may release health care provider-specific data to health care providers to whom the information relates. The department may not release any health care information prior to its review, verification and comment upon by those submitting the data in accordance with procedures described under subch.
III.
DHS 120.31(3)(b)
(b) The department shall provide to other entities the data necessary to fulfill their statutory mandates for epidemiological purposes or to minimize the duplicate collection of similar data elements.
DHS 120.31(3)(c)
(c) The department may release health care provider-specific data found in hospital and freestanding ambulatory surgery center databases to requesters when data review, verification and comment procedures have been followed under
s. DHS 120.11 (4).
DHS 120.31(3)(d)
(d) Before rereleasing any raw patient data element to subsequent users under this section, initial data purchasers shall receive written department approval for the initial purchaser's rerelease of data. Each initial purchaser request shall be submitted to the department in writing and shall contain all of the following information:
DHS 120.31(3)(d)2.
2. The person and, if applicable, the entity the person is associated with to whom the data is proposed to be released.
DHS 120.31(3)(d)3.
3. A statement from the initial purchaser that evidences all of the following:
DHS 120.31(3)(d)3.a.
a. The initial purchaser's understanding that the individual data elements cannot be rereleased until the initial purchaser receives written authorization to do so from the department.
DHS 120.31(3)(d)3.b.
b. The initial purchaser's agreement to distribute the department's confidentiality and data use agreement to subsequent users of the data.
DHS 120.31(3)(e)1.1. Upon receipt of an initial purchaser's request to rerelease any raw data element to subsequent users containing all of the information in
par. (d), the department shall review the request and determine whether to permit the rerelease. Prior to departmental approval of the rerelease, the department must have also received a signed and notarized data use agreement form from the subsequent user. If the department approves the rerelease, the department shall send a letter authorizing rerelease to the requesting initial purchaser. The department shall also send a copy of the letter to the proposed subsequent user.
DHS 120.31(3)(e)2.
2. The department shall include a copy of the pertinent sections of
ch. 153, Stats., and this chapter that prohibit the rerelease of any raw data element without department permission and that indicate the penalty for noncompliance with
ch. 153, Stats., and this chapter.
DHS 120.31(3)(f)
(f) Under no circumstances other than those specified in this paragraph may an individual obtain, use or release raw patient data. An initial data purchaser may do any of the following:
DHS 120.31(3)(f)1.
1. Release the raw patient data to a staff person under his or her direct supervision without requiring the recipient to file a separate data use agreement.
DHS 120.31(3)(f)2.
2. Release the raw patient data to another individual who works in the same organization, provided that the recipient also completes and returns to the department a data use agreement.
DHS 120.31(3)(f)3.
3. Rerelease the data to a subsequent user only after following the procedures specified in
par. (d).
DHS 120.31(3)(g)
(g) If the department denies a request for rerelease of any raw data element, the department shall provide written notification of the denial and the department's reason for the denial to the person making the request.
DHS 120.31(3)(h)2.
2. Rerelease of confidential data elements unless the initial and subsequent data users meet applicable statutory guidelines for release of confidential elements.
DHS 120.31(3)(i)
(i) The department shall maintain a list of all authorized initial and subsequent users of data.
DHS 120.31(3)(j)1.1. Persons who acquire data without the department's permission shall forfeit all future access to department data under this chapter.
DHS 120.31(3)(j)2.
2. Persons inappropriately using data covered by this chapter shall be subject to penalties under
ch. 153, Stats., and this chapter.
DHS 120.31(3)(k)
(k) The department may not sell or distribute databases of information from health care providers who are not hospitals or ambulatory surgery centers that are able to be linked with public use data files unless first approved by the independent review board.
DHS 120.31(4)(a)(a)
Custom-designed reports. The department may review and approve specific requests for custom-designed reports and do any of the following:
DHS 120.31(4)(a)1.
1. Release custom-designed reports, including those that identify individual health care providers, from the hospital and free-standing ambulatory surgery databases. If the department receives a request for release of data from a provider other than a hospital or freestanding ambulatory surgery center in the development of a custom-designed report, the department shall seek approval for the release of the data from the independent review board unless similar requests have been previously authorized by the IRB under
sub. (2) (c) or unless the data are contained in the public use data file.
DHS 120.31(4)(a)2.
2. Release health care provider-specific risk-adjusted and unadjusted data from the hospital and freestanding ambulatory surgery center patient databases used to prepare custom reports as long as individual patients are not identifiable and when data review, verification and comment procedures have been followed under
ss. DHS 120.12 (5) (d) and
(6) (e) and
120.13 (4).
DHS 120.31(4)(b)
(b)
Requesting custom datasets containing only public-use data elements. DHS 120.31(4)(b)1.1. Persons requesting custom datasets containing only public-use data from the department shall define the elements needed in the dataset.
DHS 120.31(4)(b)2.b.
b. If the department approves the request, the requester shall either complete, sign and notarize a department data use agreement form or have a current signed and notarized department data use form filed with the department.
DHS 120.31(4)(b)2.c.
c. If the department denies the request, the department shall notify the requester in writing of the reason for the denial.
DHS 120.31(4)(c)1.1. Persons requesting custom datasets containing zip code information shall work with the department to define the desired elements for the dataset.
DHS 120.31(4)(c)2.
2. Custom data requests may include zip code data from the physician office data collection only if the department has approval from the IRB to include zip code data and does any of the following:
DHS 120.31(4)(c)2.b.
b. Determines that the dataset's population density is sufficient to mask the identities of individual persons.
DHS 120.31(4)(c)2.c.
c. Groups other potentially identifying data elements to provide sufficient population density to protect the identities of individual persons.
DHS 120.31(4)(c)2.d.
d. Adds multiple years of data to protect the identities of individual persons.
DHS 120.31(4)(c)3.a.a. If the department determines the request is reasonable, the department shall present the request to the IRB along with proposed remedies to assure confidentiality. If the IRB approves the request, the department may approve the request. The department may not release complete zip code data in the physician office data collection without IRB authorization.
DHS 120.31(4)(c)3.b.
b. If the department approves the request, the requester shall either complete, sign and notarize a department data use agreement form or have a current signed and notarized department data use form filed with the department.
DHS 120.31(4)(c)3.c.
c. If the department denies the request, the department shall notify the person making the request in writing of the reasons for the denial.
DHS 120.31(4)(d)
(d)
Requesting datasets containing patient-identifiable elements. DHS 120.31(4)(d)1.1. Persons requesting datasets containing patient-identifiable elements shall do all of the following:
DHS 120.31(4)(d)1.b.
b. Provide the department written statutory evidence that the requester is entitled to have access to the data.
DHS 120.31(4)(d)1.c.
c. Identify any statutes requiring the requester to uphold the patient confidentiality provisions specified in this subchapter or stricter patient confidentiality provisions than those specified in this subchapter. If these statutory requirements do not exist, the department shall require the requester to agree in writing to uphold the patient confidentiality provisions in this subchapter.
DHS 120.31(4)(d)2.b.
b. If the department approves the request, the requester shall either complete, sign and notarize a department data use agreement form or have a current signed and notarized department data use form filed with the department.
DHS 120.31(4)(d)2.c.
c. If the department denies the request, the department shall notify the requester in writing of the reason for the denial.
DHS 120.31(4)(e)1.1. The requester and the department shall determine the level of specificity of data elements to be provided in the department's analysis.
DHS 120.31 Note
Note: A major concern of the Department is to preserve patient data confidentiality. As the geographic unit of requested information becomes smaller, i.e., specific zip codes, it becomes harder to preserve patient privacy. Therefore, in those instances where persons request information disaggregated to the level of zip code and the population of patients in the zip code is small enough to identify individual persons, the Department will use the procedures in sub. (4) (c) 2. to preserve patient privacy.
DHS 120.31(4)(e)2.b.
b. If the department approves the request, the requester shall either complete, sign and notarize a department data use agreement form or have a current signed and notarized department data use form filed with the department.
DHS 120.31(4)(e)2.c.
c. If the department denies the request, the department shall notify the requester in writing of the reason for the denial.
DHS 120.31(5)
(5) Department charges for custom-designed reports and custom analyses of data. DHS 120.31(5)(a)(a) If, upon request, the department initiates preparation of custom-designed reports or custom analyses that are based on information collected by the department, the department shall charge fees, payable by the requester.
DHS 120.31(5)(b)
(b) The fees charged by the department under
par. (a) shall be commensurate with the actual necessary and direct costs associated with the data collection, analyses, compilation and dissemination of the report or analyses. In calculating its costs, the department shall take into account all of the following:
DHS 120.31(5)(c)
(c) Custom data requests that require IRB approval shall be paid in advance of the department's processing of the request.
DHS 120.31(6)(a)(a) In addition to the reports under
ss. DHS 120.20 and
120.29, the department shall respond to requests by individuals, agencies of government and organizations in the private sector for public use data files, data to fulfill statutory mandates for epidemiological purposes or to minimize the duplicate collection of similar data elements, and information that identifies a physician. The board shall designate the manner in which the data for these requests shall be made available. The department shall charge persons requesting the data fees that are commensurate with the actual and necessary direct costs of producing the requested data.
DHS 120.31(6)(b)
(b) Excepting directories resulting from information reported under
ss. DHS 120.13 (2) and
(3) and
120.14, the department shall not identify specific patients, employers or health care providers who are individuals in any public use data file released by the department. Prior to the release of a public use data file, the department shall protect the identification of specific patients, employers and health care providers who are individuals by all necessary means, including the deletion of patient identifiers and the use of calculated variables and aggregate variables.
DHS 120.31 History
History: Cr.
Register, December, 2000, No. 540, eff. 1-1-01;
corrections in (4) (a) 2. made under s. 13.93 (2m) (b) 7., Stats.,
Register, June, 2001, No. 546;
CR 01-051: am. (3) (c),
Register September 2001 No. 549 eff. 10-1-01.
