Reassess Privacy Guidelines and Data Use Agreements to Expedite SDOH Data Sharing

Reassess Privacy Guidelines and Data Use Agreements to Expedite SDOH Data Sharing

Multiple Roundtable participants noted that timely data is essential to respond rapidly and effectively during emergencies, including rapid changes in the prevalence and severity of COVID-19 infection. While much of the data collected by researchers or government agencies can be made publicly available, some data carries the risk of revealing sensitive information about individuals.  Much though not all health data falls under privacy rules including HIPAA, the set of federal regulations that governs health data privacy, and other federal, state, and local laws and regulations. Privacy guidelines are equally important for SDOH data, especially since combining SDOH data with medical data may increase the risk of personal identification. However, if privacy rules are too strict – or are interpreted too conservatively – researchers may be unable to share and analyze SDOH and COVID-19 data in ways that are essential in responding to the pandemic. 

HHS can lead the way to clarify and, where necessary, revise privacy guidelines that now make it difficult to share data that is essential to fighting the pandemic. This would align with American attitudes, which a recent survey shows support improved health data sharing. As a first step, HHS could clarify the kinds of data sharing that are already allowed under HIPAA, which may be broader than many healthcare providers realize. Standard Data Use Agreements would help federal agencies exchange data with each other, state and local governments, and the private sector. The HHS Office of Civil Rights has already issued guidance related to COVID-19 and HIPAA in a number of areas including rapidly amending regulations governing telehealth to address healthcare needs during the pandemic. Further short-term or long-term changes to HIPAA or its implementation specifically focused on SDOH data sharing could be considered. Roundtable participants suggested a follow-up Roundtable as a potential next step. This Roundtable would include both HHS and key stakeholders. It would assess needed changes and develop innovative approaches. 

Next Steps: Conduct an analysis of privacy risks and restrictions under current laws, regulations, guidelines, as well as data use agreements for sharing sensitive data, to identify possible adjustments that would make it easier to share and analyze this data while maintaining individual privacy. Engage medical practitioners, community groups, and government organizations to determine what changes would be acceptable.  

Impact: SDOH data could be combined with clinical data more effectively to address COVID-19 risk on a highly localized and individual level – including building customized risk profiles to prioritize patients at risk of contracting severe cases of COVID-19.

Who can take action: HHS, including legal and privacy experts. Nonprofit or academic research institutions. Private-sector healthcare companies, ranging from health plans and institutions to companies specializing in SDOH data.