Necessity

Public health agencies require timely, local, and frequent data on urgent problems facing their communities. Data make it possible for local and state health departments to identify problems early, react quickly, and assess interventions in a timely manner. Though public health has access to some data sources through mandatory reporting laws and voluntary data sharing initiatives, increased access to a greater variety of data sources, including data on social determinants of health, would significantly improve public health capacity.

Many sectors collect data of public health importance. Healthcare systems regularly collect relevant data at the patient level. This includes data on potentially avoidable utilization for asthma, nonfatal overdose, injuries, low birth weight, and other important outcomes data. Environmental health agencies collect data on environmental exposures, childhood lead screenings, and septic systems. Education and social service agencies collect data related to many social determinants of health. Given the plethora of data sources, there is an abundance of existing cross-sector data ready to be leveraged to promote population health.

Strengthening cross-sectoral data sharing for public health programs and activities is central to the continued improvement of population health. Unfortunately, the compelling practical and ethical justifications for the public health use of cross-sector data are not universally understood. Accordingly, there are many real and perceived barriers to sharing data for public health purposes.

Challenge

There are a variety of data sharing barriers (e.g., data consistency, interoperability), but legal barriers are among the most significant. Laws pose a significant barrier to cross-sectoral data sharing primarily because the US data protection framework consists of a patchwork of laws that protect data differently depending on the type of data (e.g., protected health information, individually identifiable non-health data), who has it, why it was initially collected, and what they intend to do with it. Moreover, legal variations exist at both the state and federal levels, frustrating efforts to understand how laws apply to proposed data sharing activities.^{Reference Schmit, Sunshine, Pepin, Ramanathan, Menon and Penn2}

Inconsistency between laws contributes significant upfront transaction costs to any cross-sectoral data sharing initiative.³ Data sharing partners must identify whether one or more federal and state laws apply to a proposed data sharing activity and how to structure the activity to comply with differing requirements.

For example, many federal and state legal protections attach to identifiable data only, so legal definitions of identifiable information are critical to understanding whether a legal restriction applies. Unfortunately, legal definitions for identifiable information vary wildly, and some laws fail to provide clear definitions at all.

An analysis of 22 federal laws, funded by the Network for Public Health Law, highlights this inconsistency.⁴ Federal laws define identifiable information differently, typically including one or more of the following definitional elements: direct identifiers (e.g., names, social security numbers), indirect identifiers (e.g., date of birth, zip codes), unspecified information about individuals, and information that can be logically or reasonably connected to an individual.

Unfortunately, most of these definitions are difficult to apply. Laws that define identifiable information using direct and indirect identifiers are the easiest to apply. However, laws rarely provide exhaustive lists of identifiers, so organizations frequently engage in hyper-conservative data stripping to ensure disclosures are compliant. Given that many indirect identifiers are also significant social determinants of health (e.g., zip codes, age, race), removing more indirect identifiers than legally necessary needlessly reduces the utility of data to understand public health issues. Legal definitions that protect unspecified information about individuals are even more difficult to apply (e.g., “Disclosure means reveal or use individual children's program eligibility information”).⁵ In the absence of more specific guidance, these vague definitions could reasonably apply to all non-aggregated, person-level data.

Definitions of identifiable information that include all information that can be reasonably connected to an individual are the most impractical to apply. In law, reasonableness standards are considered objective standards and issues of fact. In legal practice, issues of fact are decided by a fact-finder (i.e., jury or judge) after an adversarial process involving evidence, testimony and cross-examination. Of course, it is ridiculous to expect regulated entities to hold an adversarial process, complete with a jury, to decide whether or not data is “identifiable” and thus subject to legal protection. In this context, the over-reliance on the oftenderided HIPAA safe harbor de-identification standard (i.e., removal of 18 identifiers) should be no surprise, given its ease of use and application.

The absence of specific authorizations to use data for public health or research purposes is another significant legal obstacle to cross-sectoral data use. Of the 22 federal legal frameworks analyzed, only four had exceptions for public health use of data (HIPAA and 3 laws pertaining to military and veterans' data), and 13 legal frameworks permit at least limited research use. As long as laws contain different exceptions for data used for research and public health, cross-sectoral data sharing in these areas will continue to face challenges.

These varying, and sometimes conflicting, local, state, and federal laws create both real and perceived barriers to cross-sectoral data sharing and prevent efficient and effective data use for important public health challenges. A comprehensive legal framework for cross-sector data sharing could dramatically support public health's mission of improving population health and ensuring health equity.

Hope

Despite these challenges, meaningful cross-sectoral data sharing is possible. In 2016, the Peoria, Taze-well and Woodford County health departments partnered to develop a data and community-driven Health Improvement Plan in Illinois. Relying on survey data, a community taskforce identified behavioral health as a priority area, and aimed to reduce substance abuse and improve mental health. Accordingly, the taskforce formed committees to focus on three distinct sectors in which behavioral health is a priority concern: education, health, and justice. Only the role of the Justice Committee will be discussed here.

The Justice Committee benefited from the diverse perspectives of its members, including first responders, two hospital emergency departments, a judge, law enforcement agencies, a public health agency, and homeless services. The Committee used the Sequential Intercept Model as a guide to walk through both the behavioral health and criminal justice systems and identify ways to improve individual outcomes at each “intercept” point, or place at which an individual with a behavioral health need may enter or interact with the criminal justice system.^{Reference Munetz and Griffin6} The Committee determined that it needed better and more targeted information to evaluate and potentially improve the system as a whole.

One of the first Committee initiatives was to understand the scope of the behavioral health issues in the criminal justice system. Accordingly, the medical staff in the Peoria County Jail manually reviewed files and added a “flag” in the records of individuals with behavioral health needs. This flag was incredibly useful. It enabled the Justice Committee to understand the prevalence of behavioral health issues in the jail, the association between behavioral health and recidivism rates, charges associated with the arrests, and other trends.

Unfortunately, when the Justice Committee attempted to expand this analysis, and identify high utilizers of behavioral health services of the other stakeholder agencies, it faced a host of new barriers, including trust, developing a shared vision, common language/definitions, and both real and perceived legal obstacles. However, the urgency of the behavioral health crisis in our community drove the Justice Committee to overcome each barrier.

Federal laws protecting mental health and substance use data (e.g., HIPAA and 42 C.F.R. Part 2) were significant barriers to data sharing. Legal barriers were compounded by a lack of trust between the participating agencies on the Committee. To overcome these barriers, the Committee relied on the position and influence of the Peoria City/County Health Department, and an epidemiologist became the trusted data recipient. In the end, the Committee placed restrictions on the specific data elements that could be shared, and who could receive and analyze them. Data providers limited what was sent to first name, last name, age, zip code (if known), and number of contacts with their agency (i.e., jail bookings, dispatches, etc.). Additional data points such as the type of criminal charge, gender, age and zip code were auxiliary, and helped to paint the picture of the identified population.

Variable privacy protections applicable to the different agencies were another major challenge. For example, arrests are public records, while substance use treatment information is strictly protected by various laws. To address the real and perceived privacy barriers, the Peoria County Jail, the Emergency Response agency, the ambulance service, and Fire/EMS each sent their data first to the Peoria City/County Health Department. The Health Department merged the lists and identified the top utilizers based on number of contacts with two or more agencies. This more specific list of the top utilizers was then sent to the participating hospital emergency departments, who shared an aggregate count of the number of admissions of those individuals in 2017.

After two years of work, the Justice Committee produced its first “High Utilizer Matrix,” a table listing the (de-identified) individuals who had contact with two or more agencies, and the number of contacts with each. This Matrix confirmed a long-standing hypothesis: that a few high utilizers were responsible for most of the time, energy, and money spent by the participating stakeholders. More importantly, the Matrix contained actionable information. First, the Matrix allowed for targeted, individual treatment and case management. In the program's first iteration, the Justice Committee identified 17 individuals who used two or more services in 2017. With this data, the Justice Committee decided to focus its resources and develop care plans for the top five utilizers, using the agency with the most contacts as the care coordinator to obtain consent.

Second, the Matrix ignites political will by demonstrating the financial and community impact of the broken criminal justice and behavioral health systems that have not effectively addressed the needs of vulnerable individuals. Using estimated per-contact costs by each participating agency (e.g., cost per night at the jail is $80), the Justice Committee used the Matrix to calculate the cost of providing services to this population. In aggregate, the 17 high utilizers cost the Peoria community over $3 million in 2017.

The implications of this data-sharing initiative are staggering. The cross-sectoral data enable a more comprehensive and tangible measurement of the behavioral health problem, by targeting specific individuals for coordinated care. Moreover, the financial cost data provide motivation for stakeholders to invest and implement a package of evidence-based strategies to help reduce cost and to improve criminal justice and behavioral health system outcomes.