Appendix D: Legal considerations

Introduction

Prior to asking for data for public health surveillance purposes, health departments might want to consider the key components of the legal framework for collecting data related to CAMH that are maintained by preschools and elementary and secondary schools. Much of this information is discussed in greater detail in the Summary of Laws Related to Child and Adolescent Mental Health produced by PHII in 2020.  Key points from the summary include the following:

1. A complex legal landscape governs data collection and sharing, especially regarding sensitive health information related to adolescents and children. Data sharing is governed by federal, tribal, state, and local laws. The first step in collecting or sharing data is to identify applicable laws, which depend on the data type and source and how it will be used. Multiple laws may apply to each type or source of data, and these laws differ in permissible and prohibited disclosures and data sharing conditions and limitations.
2. Law is a real and perceived barrier to collecting and sharing data but not a complete barrier, especially to collecting and sharing meaningful disaggregated data. Law is often cited as a substantial barrier to data collection and use because of the effort it takes to analyze various laws that apply to data. Those who withhold data sometimes indicate that they can’t share because of the Health Insurance Portability and Accountability Act (HIPAA); however, this is often incorrect. While it is true that law, including HIPAA, places limits on data sharing, these limits are not complete barriers.
3. It is possible to navigate law to facilitate data sharing. To navigate legal issues that govern data collection, use, and disclosure, an individual or agency that wants to obtain or share data could start by providing or collecting factual information, as discussed below in A Process for Gaining Access to CAMH Data.

4. When law is not clear on data collection and/or sharing, it is important to define, weigh, and communicate the potential risks and benefits. While there are risks in sharing data, there are also risks in not sharing data, including failure to promote the health of children and adolescents because of lack of data to inform policies and programs, measure their effectiveness, and advocate for funding. Agencies and organizations from many sectors, and their attorneys, need to appreciate the crucial role that data play in promoting the health of children and adolescents so that they are willing to invest the time and effort to find a legal pathway to share data.

Federal laws are not a barrier to receiving aggregated data

All laws that were reviewed for this project (HIPAA, Privacy Act, E-Government Act, OPEN Government Data Act, Family Educational Rights and Privacy Act, Individuals with Disabilities Education Act, and Every Student Succeeds Act) allow de-identified data to be disclosed. De-identified, aggregated data might work well to identify trends and inform the development of policies, practices, and strategies.

A process for gaining access to CAMH data

Prior to contacting an attorney or legal counsel within the health department, it can be useful to think through the objectives for data sharing. The Legal Considerations resource provides an outline of the kind of information that will be useful to public health professionals and their attorney at the beginning of a project.

For additional information, please refer to Legal Considerations on Federal and State Privacy Laws, a compendium developed as a partnership between the Network for Public Health Law and PHII.