HVIP Structures and Data Access

HVIPs may be hospital-based, hospital-linked, or a combination of the two. “Hospital-based” means an HVIP is fully integrated into the health system. Staff for hospital-based HVIPs are hospital employees and have full access to hospital records, including the electronic medical record and information provided directly by patients about the nature of their injury and their medical and social needs. These types of HVIPs may provide information, with patient consent, to facilitate external referrals to community-based organizations who provide a range of services, from mental health needs to social needs.

“Hospital-linked” programs have an affiliation with a hospital or health system that allows them to provide services to patients within that health system. These HVIPs have a formal agreement that outlines the parameters of their engagement with the hospital and with patients. Staff of hospital-linked HVIPs are not hospital employees and therefore do not have access to the full medical record. Their connection to the patient is typically facilitated by a member of the hospital medical team in one of three ways: (1) eligible patients are given information about the HVIP and the patient can request services directly; (2) the HVIP is contacted by medical staff with information about an eligible patient and HVIP staff can contact the patient to discuss enrollment; or (3) HVIP staff have permission to enter the hospital to provide services to violently injured patients at bedside. Hospital-based programs are likely to be subject to HIPAA as part of a covered entity but hospital-linked programs may not be.

Challenges for the Field

The more that is known about a patient’s health status and needs, the easier it is to provide effective care and case management. In discussion with HVIP staff and leadership, the most commonly cited reason for not being able to exchange information is HIPAA, though participants note that organizational policy is also a barrier.¹⁵ While many practitioners, especially in hospital-based programs, feel they have much of the information they need to do their work, they also note that care coordination, finding hard-to-reach patients, and securing funding for sustainable operations would all be better facilitated by more streamlined information-sharing procedures. Programs utilize different tools to inform their information-sharing practices, from memorandums of understanding (MOUs) to data use agreements (DUAs) to verbal and written consent, but there is currently no consistent, standard practice, even among similarly-structured HVIPs.

In addition to these administrative hurdles, HVIPs must preserve patient trust while sharing necessary information. HVIP participants have experienced significant trauma, and building trust is an important component of effective care for that population. While improving access to patient information for the purposes of care coordination benefits HVIP program implementation, limiting patient information sharing to entities not part of the care team (such as law enforcement) and promoting patient agency in the process are equally important. Policies and procedures that erode patient trust would compromise effective implementation of the HVIP model. HVIPs have to balance these competing goals in developing their policies and practices.

HIPAA Allows Broad Information Sharing for Care Coordination, Care Management, and Treatment

At the federal level, the privacy and security of health information is governed by the HIPAA Rules,¹⁶ which apply to PHI held by covered entities and their business associates.¹⁷ Information that has been de-identified,¹⁸ doesn’t meet the definition of PHI, or is not held by a covered entity or business associate, is outside the scope of HIPAA. This means that once information has been disclosed from a covered entity (like a health care provider or health plan) to a non-covered entity (like a social services agency or community based organization, or an HVIP that is not part of the health care organization), either at the direction of a patient or without authorization where permitted by law, the information is no longer protected by HIPAA.

As covered entities, health care providers are generally prohibited from disclosing protected health information except as authorized by HIPAA. The only required disclosures under HIPAA are disclosures to the Department of Health & Human Services (HHS) for compliance review and disclosures to the individual who is the subject of the information (i.e., the patient or their personal representative). Many other disclosures are permitted under HIPAA, including disclosures for treatment, payment, and health care operations, for public health activities, disclosures required by law, and for certain law enforcement activities.¹⁹

The definitions of treatment and health care operations in the HIPAA Privacy Rule include care coordination activities, making disclosures for care coordination permissible under HIPAA. A health care provider may disclose PHI about their own or any other health care provider’s treatment activities. Treatment is defined as “the provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party, consultation between health care providers regarding a patient, or the referral of a patient from one health care provider to another.”²⁰ This is a fairly broad definition, including not just the direct delivery of health care but also the coordination and management of health care and related services. A health care provider (or other covered entity) may also disclose PHI to any entity to carry out their own health care operations activities. Health care operations is broadly defined and includes “population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment.”²¹ This is also a broad definition, including population-based activities that are not medical treatment.

The Office of Civil Rights at HHS has issued guidance addressing how PHI may be disclosed without authorization for care coordination and treatment purposes in frequently asked questions (FAQs).²² This example scenario considering sharing with social services providers is most relevant to the work of HVIPs: “Does HIPAA permit health care providers to share protected health information (PHI) about an individual with mental illness with a third party that is not a health care provider for continuity of care purposes? For example, can a health care provider refer a homeless patient to a social services agency, such as a housing provider, when doing so may reveal that the basis for eligibility is related to mental health?”²³ HHS explained: “HIPAA allows health care providers to disclose protected health information (PHI), including mental health information, to other public or private-sector entities providing social services (such as housing, income support, job training) in specified circumstances” and gave two examples, a disclosure without authorization for treatment purposes, and a disclosure pursuant to a broad patient authorization to “social services providers.” In its discussion of the treatment disclosure, HHS stated: “Health care means care, services, or supplies related to the health of an individual. Thus, health care providers who believe that disclosures to certain social service entities are a necessary component of, or may help further, the individual’s health or mental health care may disclose the minimum necessary PHI to such entities without the individual’s authorization. For example, a provider may disclose PHI about a patient needing mental health care supportive housing to a service agency that arranges such services for individuals.”²⁴

Under this guidance, the scope of the disclosure seems to be limited only by the provider’s interpretation of what disclosures may help further the individual’s health care, including mental health care. It is not clear how far this interpretation reaches beyond health care to the broad range of social needs that may be addressed by HVIPs and the social services providers they partner with, but the guidance from HHS indicates that providers may disclose the minimum information necessary, in their judgment, to social service providers that may help further an individual’s health.

HIPAA Requires Disclosures to the Patient and as Directed by the Patient

Health care providers must comply with requests for PHI from the patient who is the subject of the information, with only very limited exceptions to this right of access, such as psychotherapy notes.²⁵ Therefore, a patient can direct a health care provider to give PHI to a specified third party or request a copy of their own records and give them to anyone the patient chooses. (There are additional considerations for substance use records, but patients generally can access those records as well.²⁶) Any state laws that may seem to allow a provider to deny a patient’s access to their PHI in conflict with HIPAA are preempted by the federal rules (and therefore, not enforceable).²⁷ This means that where a provider does not choose to disclose information to an HVIP, the patient can direct the provider to give their records to the HVIP, and the provider must comply.

In practice, providers create their own requirements and restrictions on discretionary sharing. One way for organizations like HVIPs to get the information they need is for the patient to be an intermediary, requesting their records from the provider and then conveying them to the HVIP and anyone else they choose to share with, such as social services providers. This patient-led model requires the least exercise of discretion by health care providers and gives the patients the most control over their information, but it is administratively burdensome for patients (especially after a violent injury) and, most importantly, does not allow for a fast response. Violence intervention programs and other programs that address urgent needs like safety, mental health, housing, and food will be limited in their ability to respond if they have to wait for a patient to act on a referral by contacting the program, then wait for the patient to submit a HIPAA-compliant patient authorization to any health care provider directing them to share the patient’s medical records with the program and any other specified third parties, and then wait for the information to be shared.

Practice

With patient autonomy and patient-directed action as the cornerstone of any organizational policy, health systems should use discretion as allowed under the Privacy Rule to disclose where appropriate to support the patient’s well-being, giving the patient an opportunity to object to the disclosure. Health systems also should ensure that providers and other staff are familiar with the community resources available to address social needs and how to connect patients to those resources, which may be through an intermediary like an HVIP. In addition, the systems should use agreements like MOUs and DUAs to clarify the terms for information sharing, such as who will have access to what information and for what purpose, so that providers, patients, and those who receive PHI have a common understanding of the circumstances around the disclosure. Health systems also should integrate HVIPs and other pathways for connection to community resources into their health care processes. Information systems should be built to allow for access and sharing of segmented data with external organizations.²⁸

Finally, health systems should use broad authorizations to minimize the burden on patients. Broad authorizations allow patients to authorize disclosure to a category of people or entities, such as social services providers,²⁹ without requiring the patient to execute a separate authorization for each disclosure. For substance use treatment information, recent revisions to the regulation governing substance use treatment records (42 C.F.R. pt. 2) also allow a patient to authorize a category of recipients and authorize future uses.³⁰

Policy

First, trusted third parties that manage PHI, such as public health departments or health information exchanges, can serve as intermediaries between health care providers and organizations helping to address social needs, such as HVIPs and social services agencies when there are challenges to direct coordination. Public health agencies already manage PHI received from providers for purposes such as disease surveillance, which can include violent injuries, and their duties often involve coordinating with organizations that address social needs. This existing infrastructure could be leveraged to support information sharing to address social needs, especially when data sharing agreements prove difficult. We note that laws governing the privacy of state and local government records vary and some information may not be appropriate for sharing with a government entity, or patients may object to such sharing. However, where the patient does not object and especially where the services to address social needs are offered by government agencies (so the disclosure is necessary to obtain the service), this existing infrastructure and the policies that govern it may be revised to create standard pathways for sharing that could reduce the burden on all stakeholders.

At the federal level, HHS should revise the HIPAA Privacy Rule to clarify how information may be shared beyond health care providers to support health, including addressing social needs. At the very end of the first Trump administration, HHS issued a Notice of Proposed Rulemaking (NPRM) that would have modified the Privacy Rule to allow health care providers to “disclose PHI to social services agencies, community-based organizations, home and community based service (HCBS) providers, and other similar third parties that provide health-related services, to facilitate coordination of care and case management for individuals.”³¹ Under the proposed regulation, a health care provider or plan could “disclose PHI without authorization to a third party that provides health-related services to individuals; however, the third party does not have to be a health care provider. Instead, the third party may be providing health-related social services or other supportive services — e.g., food or sheltered housing needed to address health risks.”³² The proposed rule was never finalized. We believe that the 2021 NPRM did not adequately address patients’ right to direct or restrict disclosures of their PHI, but the proposal and stakeholder comments in response show that the current regulatory language is not sufficient. Clarity is needed on how disclosures may be made under the “treatment” and “care coordination and case management” categories within permitted disclosures and how patients’ wishes should be respected. The HHS guidance for providers should specifically address disclosures to social services agencies and other organizations that address health-related social needs.

Research

Even if providers use their existing discretion to share information more freely to address social needs, and policies clarify how that discretion may be used, there is still inherent tension between the need to share information to address social needs and the need for patients to control how their information is shared, which is critical both for ethical reasons and to ensure the trust programs like HVIPs need in order to be effective. What is the right balance between respect for individual autonomy and greater transparency to alleviate social needs and improve health outcomes without unnecessary barriers and delays? Even with common goals and structures, HVIP approaches to information sharing vary widely, with some organizations obtaining consent for every new disclosure while others obtain a broad authorization to share as needed when the patient elects to participate in the program. What processes best balance patient autonomy and prompt access to social services?

In particular, research is needed about the patient perspective on information sharing specifically in the context of services to address social needs. How do patients, especially patients with high social needs, think about their health information in this context? Do they feel empowered to control how their information is used or do they feel powerless (or worse, exploited) because they need the services they might receive in exchange for giving up their information? Does an opt-out model sufficiently support patient autonomy or would an opt-in model better preserve trust without unnecessary administrative barriers?

Future research should also aim to create and test model agreements and standard procedures. The organizations that provide services to support social needs are often stretched thin, more now than ever. Having to negotiate agreements and create procedures for every organization they might receive information from is a barrier to sharing that might prevent services from being provided or put an additional burden on patients to manage the flow of information.