Wisconsin Blood Lead Registry Security and Confidentiality Agreement

WISCONSIN BLOOD LEAD REGISTRY

ORGANIZATION SECURITY AND CONFIDENTIALITY AGREEMENT

DEPARTMENT OF HEALTH SERVICES
Division of Public Health
F-00116 (01/2010)

STATE OF WISCONSIN
Bureau of Environmental and Occupational Health

I. Purpose

Pursuant to its public health authority under Wis. Stat. §§ 250.04 and 254.15, to prevent, suppress, and conduct surveillance of diseases and environmental hazards and to develop and implement a comprehensive statewide lead poisoning prevention and treatment program, the Department of Health Services (DHS) has created the Wisconsin Blood Lead Registry. The purpose of the Wisconsin Blood Lead Registry is to provide screening providers with the information necessary to determine whether a child should be tested for blood lead. Often this information is not otherwise available, or is not reliable.

Under Wis. Stat. § 254.13, a person who screens a child under 6 years of age is required to report the result of the screening to the Department. The Department maintains a statewide database of these test results. Test results in this database are used to populate the Registry.

If a screening provider wishes to participate in the Registry, this Organization Security and Confidentiality Agreement must be signed by a designated representative of the provider’s organization. The Organization Security and Confidentiality Agreement sets out the requirements for using the data contained in the Registry. Staff of the screening provider’s organization who will be given access to the Registry must read this agreement and sign the User Security and Confidentiality Agreement (F-00103).

Registry data are confidential patient health care records under Wis. Stat. § 146.82. Breach of any part of the confidentiality requirements will subject the user to termination from participation in the Registry and may result in civil or criminal penalties for improper disclosure of health information.

Protecting the privacy of a child and the security of information contained in the Registry is a high priority for the Department.

II. Definitions

In this agreement unless the context otherwise requires:

(1) “Blood lead records” means the recorded results of all blood lead tests for a particular child, along with relevant information, including test date, test type, test result, and screening provider.

(2) “Blood lead test” is synonymous with “screen,” and means the collection of a blood sample (either venous or capillary) for the purpose of determining the concentration of lead in the blood.

(3) “Child” means a minor child who is a current or potential patient of a screening provider.

(4) “Department” means the Wisconsin Department of Health Services and its employees and authorized agents, including contract employees, local health departments under Wis. Stat. §. 254.152, and the University of Wisconsin Department of Population Health Sciences employees and interns under contract to, or a memoranda of understanding with, the Department of Health Services.

(6) “In their care” means the relationship between a child and the child’s screening provider with respect to blood lead testing.

(7) “Organization” means an individual, corporation, agency or other entity that represents, employs or contracts with one or more individual registry user. An organization may be a single user (as in the case of a screening provider who is the sole individual in a private practice), or may include multiple individual registry users (as in the case of a health care clinic or system).

(8) “Registry” means the Wisconsin Blood Lead Registry (WBLR) maintained by the Department

(9) “Registry user” is synonymous with “user,” and means any person with authorized access to the Blood Lead Registry.

(10) “Screening provider” means a physician, physician assistant, nurse, nurse practitioner, health maintenance organization, WIC project, or health care provider as identified by Wis. Stat. §. 146.81 (1) who is involved in the health care of individual children, including the testing of children for blood lead levels. This may also include the Department agents and schools who have a legitimate interest in a child’s blood lead testing status per Wis. Stats. 254.162 and 146.82(2)(a)(12).

(11) “Site Administrator” means the designated person within the Organization who has the authority and responsibility for administering the WBLR within that Organization.

(12) “WCLPPP” means the Wisconsin Childhood Lead Poisoning Prevention Program.

III. Access to and Disclosure of Registry Information

In order to gain access to the Registry, a user must first submit a signed Registry User Security and Confidentiality Agreement (F-00103). Users are broadly categorized into one of the following types:

1. Screening providers;

2. Health Maintenance Organizations (HMO);

3. Public schools;

4. DHS employees, and authorized agents.

The following table outlines the different types of Registry access allowed for each user group type.

• - Authorization to access all Registry information associated with children in the user’s care (Users may not view information about children who are not in their care.)

View Blood Lead Records means the user has permission to view the entire blood lead history and status of a child in the user’s care in order to determine whether the child is up-to-date with recommended blood lead testing.

View Demographics means the user can view information about children in the user’s care, including a child’s name, date of birth, mother’s maiden name, address, and telephone number.

Add/Edit Information means the user can add new test results to a child’s record and edit blood lead results previously recorded in a child’s record. The user may add a new child record into the Registry database or alter the details on a child already contained in the Registry database.

IV. User Participation

Every individual who wishes to participate as a user of the Registry must read this Organization Security and Confidentiality Agreement and sign and comply with the Registry User Security and Confidentiality Agreement (F-00103). The Department administers and controls access to the Registry and the data contained therein. Any use of the Registry that violates the User Security and Confidentiality Agreement will subject the user to revocation of the user’s access privileges and may result in civil or criminal penalties for improper disclosure of health information under Wis. Stat. §. 146.84. In addition, egregious or repeated violations by an organization’s users may result in revocation of the organization’s access privileges.

The Registry Organization Security and Confidentiality Agreement must be signed by a representative of the organization prior to any training of staff on use of the Registry, or access to the Registry data. This person shall serve as the organization’s Site Administrator, and shall have responsibility for all individual users within the organization. The Site Administrator shall complete the Department administered training for Registry. Having completed the training, the Site Administrator may enroll users who have been trained in the use of the Registry at the appropriate access level and have signed the Registry User Security and Confidentiality Agreement. The Site Administrator shall maintain a file of signed Registry User Security and Confidentiality Agreements and ensure that each user within the organization renews his or her agreement every two years. Users with expired agreements, or revoked privileges shall not access the Registry. The Site Administrator shall be responsible for each user within the organization.

Only personnel whose assigned duties include functions associated with the blood lead testing of children may be given access to Registry information. All such personnel, including permanent and temporary employees, volunteers, contractors, and consultants shall be required to sign a Registry User Security and Confidentiality Agreement before gaining access to the Registry. Whenever a user terminates his or her working relationship within the organization, the user’s account shall be immediately deactivated by the Site Administrator. When a user takes an extended leave of absence, the Site Administrator shall deactivate the user’s account. Accounts that remain inactive for more than 60 consecutive days shall be deactivated by the Site Administrator.

Access to the Registry will be allowed only through Registry-approved access procedures. Each person granted access to the Registry must have a unique login ID and password to the Wisconsin Immunization Registry (WIR) portal and a unique Registry access code. Shared login IDs, passwords, and access codes are not permitted. Users are prohibited from disclosing Registry access codes or protocol to unauthorized persons. Site Administrators will ensure that users have been adequately trained to use the Registry and are not given any higher level of access than necessary to perform their assigned duties.

The information contained in the Registry may only be used to:

1. provide information useful for determining whether a child is due a blood lead test;

2. assist a user in keeping a child’s blood lead testing status up-to-date; or

3. eliminate the administration of duplicate blood lead tests.

Any other use of Registry data is prohibited. No user may attempt to copy the Registry database or software used to access the Registry without written consent from the manager of the WCLPPP. Requests for data for research or purposes other than those listed above shall be forwarded to the Department via the manager of the WCLPPP.

The Registry shall not be used to provide address or contact information for individual children. Unless the disclosure is approved by the Department Registry staff in accordance with applicable laws, or the parent, guardian, or legal custodian has consented to the disclosure, Registry data concerning an identifiable child may not be disclosed to anyone other than an authorized Registry user.

Registry data identifying children shall not be disclosed to unauthorized individuals, including law enforcement, without the approval of the manager of the WCLPPP. All such requests for data, including subpoenas, court orders, and other legal demands for Registry data shall be referred to the Department in a timely manner.

The Department shall review and audit activities on the Registry to ensure the ongoing security of the data contained therein. The undersigned has read, understands, and agrees to abide by this Registry Organization Security and Confidentiality Agreement.

Check the type of Registry access requested:

Print Name of Organization:

Print Name of Site Administrator:

Name of Main Contact (if different from Site Administrator):

Email Address: Phone Number:

Address: City: Zip: