# Legal & data sharing frameworks

Summary:

* Establish legal data sharing frameworks within state jurisdictions, e.g. local/municipality to city (major metro), and direct to state.
* Consider formulating policies and orders at the local jurisdiction level that refer to specific data sharing regulations that permit reporting; i.e. healthcare providers having the ability to share data with **specific entities** related to contact tracing efforts and what data will be released for broad public consumption vs. restricted public health use.
* Designate certain collaborative entities with limited public health authority related to COVID-19 e.g. Health Information Networks, and Health Information Exchanges typically can’t easily share data bi-directionally with public health; state-based entities (e.g. New Jersey Health Information Network, Indiana HIE, SHINY) will be able to move faster on sharing clinical information with public health to scope contact tracing efforts
* Define data sharing use cases that fall under the following:
  * Public Health Practice
  * De-identified Data (per HIPAA); aggregate and line-level
  * Consumer Data (non-HIPAA; regulated by FTC
  * Anonymous Data
  * Open Data (public consumption)
* Patient and Consumer Consents
* Data destruction policies

### State & Local Jurisdiction Data Sharing

If there is a local NEDSS system in place, provide local jurisdictions with the ability to enter case reports. Establish a process to capture case investigations that relate to emerging contract tracing emergence of symptoms but confirmatory testing may not be in place yet (typically a quarantine section of the system to help prioritize confirmed case reports).

### Data Sharing Use Cases

* Symptom checker information into a NEDSS
* Symptom checker information connected with contact traced social network (identifiable, and aggregate level)
* Contact-traced individuals to healthcare records/testing (consent)
* Surveillance of negatives for a certain period of time with symptom checker & monitoring tools

**Public Health Practice**

Covers the following:

* Healthcare provider to public health
* Clinical data provider (Labs, EHRs, Payors & their vendors) to public health
* Behavioral and mental health data provider to public health
* Public health to public health; state and local jurisdictions
* Local state agencies (e.g. Departments of Human Services, Prison & Correctional Facilities) to public health
* Local public health to federal public health

Permissible data linkages:

* Identifiable data (PHI or PII) to consumer-consented data
* Limited data to identifiable data
* De-identified data to identifiable data (re-identification under public health practice)
* De-identified data to de-identified data

**De-identified Data**

Covers the following:

* Healthcare providers to public health

**Consumer Data**

**Open Data**