LPHA Use

The department may authorize the disclosure of information contained in vital records and patient abstract files to public health authorities for local public health program evaluation and planning. Data provided are limited data sets and may not be released or shared without written Department approval. Use of data is restricted to public health activities for protecting and improving the health of their communities through disease prevention, safety standards, and health education.

LPHA Processes

LPHA Initial Use Information

Statutes, Rules and Regulations Pertaining to Vital Records Data

Missouri state statutes (193.045, 193.245 & 193.255) and the Code of State Regulations (19 CSR 10-10.090 Access to Vital Records) allow for the release of record-level vital records data by the Missouri Department of Health and Senior Services. The statutes listed above only apply to events occurring within Missouri’s borders. The records of vital events that occur to Missouri residents in other states are the property of the state where the events take place.

Under section 610.035, RSMo, the department is prohibited from disclosing any Social Security number of a living person unless such disclosure is permitted by federal law, federal regulation or state law. Section 208.120, RSMo prohibits the department from disclosing any information obtained by them in the discharge of their official duties relative to the identity of applicants for or recipients of benefits or the contents of any records (e.g., Medicaid, Food Stamps). Public assistance information can be provided on de-identified records only.

45 C.F.R. Part 160 and Part 164. Vital Records requestors for public health practice purposes will only be provided access to the minimum information necessary to achieve their specific requests. Requestors and/or contractors are prohibited from disclosing any information that would identify a person and are also prohibited from the re-release of the data provided.

Statutes, Rules and Regulations Pertaining to Patient Abstract System Data

Missouri state statutes (192.067, 192.665, & 192.667) and the Code of State Regulations (19 CSR 10.33.10)

Reporting Patient Abstract Data by Hospitals and Ambulatory Surgical Centers) allow for the release of Patient Abstract System (PAS) data by the Missouri Department of Health and Senior Services. The Department and other public health authorities are authorized to utilize PAS information for surveillance. The statutes listed above apply to Missouri residents only.

Application Procedures

To request record-level data for public health practice, a LPHA must submit a completed Protocol Application. The application requires detailed information about the purpose(s) of the request and measures to ensure the confidentiality and security of the data. All information must be clear, consistent and specific. General descriptions do not allow accurate assessment of the value of the request. Release of data from vital records and/or the Patient Abstract System by the Missouri Department of Health and Senior Services is granted to a Local Public Health Agency for the sole purpose(s) described in the initial application. The applicant will be required to complete and submit an Agreement for Oversight. The Agreement for Oversight requires both the requestor’s signature and the LPHA Administrator’s signature (must be two different LPHA staff). All people that will have access to the data must be listed in the application and will be required to sign Confidentiality Pledge prior to being granted access to the DHSS- provided data. LPHAs may retain up to 10 rolling years of data at a time.

An application will be immediately rejected if it is determined that

it does not clearly describe how the data will be used and for what purpose(s),
the data will be used for commercial or marketing purposes, or private gain,
providing the data would overburden the department, or 4) there is reason to believe that confidentiality of the data would be jeopardized by its release.

LPHAs interested in obtaining DHSS data should first familiarize themselves with the data sets prior to requesting data. Vital Records and Patient Abstract Data custodian contact information may be found under Contact Us.

Please Note:

The data provided are to be used solely for the public health practice purpose described in the application. Use of these data for research studies is prohibited and will require a separate application for research protocols. For additional information on research use requirements see the Research Data Release Policies, Procedures, and Guidelines.

We suggest submitting a completed application at least two to three months prior to when data will be needed.

Applications are reviewed on an ‘as time permits’ basis among other priority projects. The number of priority projects may impact the response time. Please plan accordingly.

Regardless of the duration of the request, approval is only for one year at a time. Annual review is required for each application request for as long as DHSS-provided data are held.

Review Process

A primary reviewer is assigned to each application to conduct a preliminary review and to correspond with the applicant if the information provided is unclear or incomplete. If insufficient documentation is presented to determine approval, additional information will be requested to clarify the application. The primary reviewer will be reviewing issues such as the purpose of the request, the appropriateness of requested data, ensuring provisions for maintaining confidentiality and security protections are adequate, and the availability of department resources to fill the request.

Once the primary reviewer completes the review, a recommendation is provided to either the State Registrar and/or PAS Authority or their designee, as needed, to approve or deny the application. You will be notified in writing of the final decision. If your application is approved, the records/files will be provided on the basis of your application in accordance with Missouri statutes, rules and regulations. If your request is denied, you will be notified of the reasons within 60 days of the denial.

Approval Criteria

Requests must meet the following specific standards and criteria:

contribute to public health practice;
- not use Department resources unreasonably and unnecessarily;
  - be conducted ethically and with integrity;
  - be in compliance with state and federal statutes and regulations, including confidentiality provisions; and
  - be consistent with Department policy.

Application Submissions

All applicants must complete, sign and date the application, Agreement for Oversight, and a Confidentiality Pledge. Completed packets are to be mailed to the Project Coordinator at the address listed below. Electronic submission of applications with a scanned signature is preferred.

Missouri Department of Health and Senior Services

Division of Community and Public Health

Attn: Project Coordinator

Physical: 930 Wildwood Drive

Jefferson City, MO 65109

Mailing: PO Box 570

Jefferson City, MO (65102-0570)

Email: Dawn.Parker@health.mo.gov

LPHA Annual Review

Approved applications/continuations for use of Missouri vital records and/or patient abstract system data are only valid for one year at a time, regardless of the duration of the project. A completed Request for Review and an Agreement for Oversight must be submitted to the Project Coordinator at least 20 calendar days prior to the current approval expiration date. The Agreement for Oversight requires both the requestor’s signature and the LPHA Administrator’s signature (must be two different LPHA staff). A reminder notice should be e-mailed to the LPHA Requestor prior to the current approval expiration date; however, it is the responsibility of the LPHA Requestor to ensure that annual review materials are submitted on time whether or not a reminder is received.

All approved projects will be reviewed annually as long as the request is ongoing and DHSS-provided data are retained. An annual review includes the following:

Summary: Provide an overview/summary of all project activities since the last approval was granted. If you have not used the data provided, plans should be developed and reported addressing how you will overcome the barriers hindering progress.
Supporting Documents (when applicable): Copies of any presentations, reports, and/or articles not previously submitted for DHSS review.
Modification (when applicable): An explanation of any proposed changes to the protocol or changes to the projected end date. (LPHAs may retain up to 10 rolling years of data at a time.)
Personnel (when applicable): Report any new staff assigned to the project since the last approval was granted, who have access to DHSS-provided data. All new staff members sign a Confidentiality Pledge prior to being granted access to the data. It is the responsibility of the LPHA Requestor to ensure that all staff, including contractors, are aware of and adhere to the confidentiality and security procedures.

Amendments

Any changes to a project or personnel require the submission of an amendment request to the Project Coordinator. Proposed project changes must be reviewed and approved by the Department before being implemented. In the rare event that changes to the project must be made without the prior approval, in order to protect subject safety and welfare, the Project Coordinator must be notified as soon as possible after the changes have been made. Please use the Request for Review form to submit any amendments.

Project Completion/Disposition of Data

When requests are completed and DHSS-provided data is no longer needed, the LPHA Requestor must submit the following documents:

1.    A completed/signed, final Request for Review closing out the project.
2.    Copies of any reports, citations and/or articles developed from the data not previously submitted.
3.    An original signed/notarized Affidavit of Data Disposal.
4.    If a contractor has been provided DHSS data, the contractor must also complete an Affidavit of Data Disposal at the conclusion of the contract work.

Termination/Failure to Comply

If the DHSS receives a credible report or evidence that unauthorized release of data or other breach of confidentiality has occurred, the Department will investigate whether such has occurred and whether the project should be suspended. LPHAs are responsible for notifying any consumer whose confidential information the LPHA or contractor staff breaches. The LPHA must also notify the DHSS if the LPHA or contractor staff have a breach of confidentiality involving DHSS data.

The Department will require that all DHSS data be destroyed if the Department determines one or more of the following have occurred:
•    data have been released to unauthorized persons;
•    the identity of a person, patient, physician, or provider has been revealed to a person not listed on the approved application;
•    data are being used in an unapproved manner.

Per 192.067(5), RSMo, “any department of health and senior services employee, public health authority or coinvestigator of a study who knowingly releases information which violates the provisions of this section shall be guilty of a class A misdemeanor and, upon conviction, shall be punished as provided by law.”

The attorney general shall have exclusive authority to bring an action to obtain actual damages for a willful and knowing violation of 407.1500(1), RSMo and may seek a civil penalty not to exceed one hundred fifty thousand dollars per breach of the security of the system or series of breaches of a similar nature that are discovered in a single investigation.

Failure to comply with the annual review or close out process could result in the immediate withdrawal of DHSS approval. In the event of DHSS withdraws approval, the Department will require that all DHSS data be destroyed.

The Department reserves the right to deny the release of future DHSS data files to the LPHA for any breach of the terms of the application, agreement for oversight, confidentiality pledge, and/or the failure to comply with the annual review or close out process.