This notice explains how the Massachusetts Department of Public Health ("MDPH") collects, uses and shares personal and health information. It also explains your rights with regard to this information.

Why Does MDPH Collect Confidential Information?

MDPH keeps records including confidential information as part of its public health duties. Certain laws require that health care providers report specific disease information to MDPH and that MDPH conduct specific laboratory tests. MDPH also collects confidential information when licensing and inspecting health facilities such as hospitals, nursing homes, ambulance services, and substance abuse treatment centers. It collects information while conducting public health activities, such as disease tracking, research, and program evaluation. Records are also kept when people apply for certain services or benefits from programs that are operated or funded by MDPH and from its four public health hospitals.

How Does MDPH Use and Disclose (Share) Confidential Information?

MDPH has always respected the confidentiality of health information and it continues to take very seriously the privacy and security of this information. Under state law, there are strict limitations on how MDPH can collect and share the information it has. Whenever possible, information is provided in a way that does not identify you. Confidential information can only be shared in limited circumstances within MDPH or outside MDPH.

  • At MDPH, certain employees need to have access to particular confidential information to do their jobs. Unless restricted by specific laws, these employees may share your information with other MDPH employees when necessary. For example, your information may be shared within MDPH to:
    • determine if you or other family members are eligible for other benefit programs;
    • coordinate services for you or family members;
    • speed up payment for services or to identify other ways to pay for medical and related expenses;
    • evaluate how well a program is operating;
    • evaluate public health trends;
    • coordinate disease investigation or intervention;
    • coordinate or prosecute complaint investigations; or
    • conduct research with a public health purpose.
  • There are a few specific times when laws or regulations require or allow MDPH to share your information outside the MDPH without your written authorization. Examples of when your information may be disclosed outside MDPH without your written authorization include:
    • when it is required by law;
    • when authorized by law, for example for disease investigation and intervention;
    • for research that meets all state and federal requirements;
    • to comply with federal grant requirements;
    • in response to a medical emergency;
    • in response to a court order; or
    • for public health reporting

Additional Protections

Some information that is collected by or reported to MDPH is subject to even stricter confidentiality protections based on specific state or federal laws. This notice does not discuss every law that provides greater protections. However, if you are applying for or if you receive services from any of the following programs, please review the additional descriptions below.

  • Substance Abuse Services - Federal law requires that no patient records that identify an individual as receiving drug or alcohol services in connection with any federally funded drug or alcohol abuse program may be used or disclosed without written consent. The following exceptions to this rule apply to information held by MDPH:
    • internal communications (only to staff or to organizations that directly administer the program);
    • medical emergency;
    • appropriate court order;
    • approved research; or
    • audit.
  • Women Infants and Children (WIC) - Federal law requires that no information obtained from program applicants and participants may be used or disclosed without written consent, except:
    • to persons directly involved with the administration and enforcement of the program;
    • with a written agreement with other state agencies for outreach and eligibility for additional benefits;
    • when it is required by law;
    • in a statistical or summary form that does not identify individuals;
    • to state or federal agencies to evaluate nutrition programs, only in a form that does not identify individuals.
  • HIV/AIDS - Information related to a diagnosis of HIV is tracked by a unique identifier, municipality and zip code; no names are reported to MDPH. State law prohibits the disclosure of any HIV test results without the individual's written informed consent. Although names are reported to MDPH regarding AIDS diagnosis, names are never disclosed except for federal public health reporting. HIV/AIDS data are used or disclosed only in the following limited circumstances:
    • in a statistical or summary form that does not identify individuals;
    • for program monitoring, needs assessment, program evaluation, and research, with direct identifiers removed and with an agreement protecting the confidentiality of the information;
    • for public health purposes.
  • Sexually Transmitted Diseases (STD) - State law prohibits sharing reports about sexually transmitted diseases without the individual's written consent, except when there is a proper judicial order or with the written approval of the Commissioner of MDPH. Within MDPH, only staff members in the Division of STD Prevention have access to individual-level STD data. STD data may be disclosed in a statistical or summary form that does not identify individuals.

ADDITIONAL INFORMATION

Vital Records

State law determines which records held by the Registry of Vital Records and Statistics are classified as confidential, restricted or unrestricted. For further information refer to: http://www.mass.gov/dph/rvrs

HIPAA

MDPH is a hybrid agency under the federal Health Insurance Portability and Accountability Act (HIPAA). This means that some parts of MDPH are covered and must comply with HIPAA's requirements, and some parts are not covered. Only the MDPH Hospitals and the Childhood Lead Screening Laboratory are covered components under HIPAA. They have separate Notices of Privacy Practices that can be found at:

YOUR RIGHTS

You have the following rights with respect to your confidential information held by MDPH. These rights may not apply in certain situations if there is a specific law that restricts them. For example, under state and federal laws, patients are not entitled to access laboratory results from MDPH. MDPH may only release these results to the health care provider requesting the test. Generally, however, you have the right:

  • to see and to get a copy of your confidential information. Your request must be made in writing. MDPH may charge a fee for copies.
  • to request that MDPH change your confidential information if you believe it is incomplete or incorrect. Your request must be in writing and you must tell us what information you want changed and why. MDPH may not always be able to approve your request. This right does not apply in those cases where there is a law that contains a specific process for changing information held by MDPH.
  • to request that MDPH contact you at a different address, phone number or in some way other than at your home address. Your request must be in writing and it must describe what communications are covered by the request and where and how MDPH should contact you.
  • to request that MDPH restrict the use and disclosure of your confidential information. Your request must be in writing. Please note that MDPH may not always be able to approve the request.
  • to get a list of when and with whom the Department has shared your confidential information. Your request must be in writing.

Contacts and Complaints

If you believe your privacy rights have been violated, you may file a complaint in writing with the MDPH Privacy Officer:

Massachusetts Department of Public Health
Privacy Officer
Privacy, Security, and Data Access Group
250 Washington Street, 2 nd floor
Boston, MA 02108

If the complaint is against a part of the Department that is a HIPAA covered component, you may also file with the Secretary of the Department of Health and Human:

Office of Civil Rights
United States Department of Health and Human Services
Government Center
John F. Kennedy Federal Building 1875
Boston, MA 02203
(617) 565-1340 or TDD (617) 565-1348

No action may be taken against you for filing a complaint.


This information is provided by the Department of Public Health.