DHS 120.29(3)(b)2.2. The use of calculated variables and aggregated variables.
DHS 120.29(3)(b)3.3. Not releasing information concerning a patient’s race or ethnicity, or dates of admission, discharge, procedures or visits.
DHS 120.29(3)(c)(c) The department shall suppress or mask zip code information in the public use data file when the number of persons having a given zip code is insufficient to mask their identity.
DHS 120.29 HistoryHistory: Cr. Register, December, 2000, No. 540, eff. 1-1-01.
DHS 120.30DHS 120.30Patient data elements considered patient-identifiable.
DHS 120.30(1)(1)Nonrelease of patient-identifiable data. The department may not release or provide access to patient-identifiable data, except as provided in s. 153.50 (4), Stats. The department shall protect the identity of a patient by all necessary means, including the use of calculated, masked or aggregated variables.
DHS 120.30(2)(2)Procedures governing release of patient-identifiable data.
DHS 120.30(2)(a)(a) Persons authorized and desiring to access patient-identifiable data under s. 153.50 (4), Stats., shall submit to the department a request for the release of the data in writing and shall include all of the following:
DHS 120.30(2)(a)1.1. The requester’s name and address.
DHS 120.30(2)(a)2.2. The reason for the request.
DHS 120.30(2)(a)3.3. For a person who is authorized under s. 153.50 (4), Stats., to receive or have access to patient-identifiable data, evidence, in writing, that indicates the authorization.
DHS 120.30(2)(a)4.4. For an entity that is authorized under s. 153.50 (4), Stats., to receive or have access to patient-identifiable data, evidence, in writing, of all of the following:
DHS 120.30(2)(a)4.a.a. The federal or state statutory requirement to obtain the patient-identifiable data.
DHS 120.30(2)(a)4.b.b. Any federal or state statutory requirement to uphold the patient confidentiality provisions of this chapter or patient confidentiality provisions that are more restrictive than those of this chapter; or, if the latter evidence is inapplicable, an agreement, in writing, to uphold the patient confidentiality provisions of this chapter.
DHS 120.30(2)(a)4.c.c. An entity specified under s. 153.50 (4), Stats., having access to data elements considered patient-identifiable may not rerelease these data elements.
DHS 120.30 NoteNote: Requests should be sent to the following address: Bureau of Health Information and Policy, P. O. Box 26599, Madison, Wisconsin 53701-2659, or deliver the communications to Room 372, 1 W. Wilson Street, Madison, Wisconsin.
DHS 120.30(2)(b)(b) Upon receiving a request for patient-identifiable data under par. (a), the department shall, as soon as practicable, either comply with the request or notify the requester, in writing, of all of the following:
DHS 120.30(2)(b)1.1. That the department is denying the request in whole or in part.
DHS 120.30(2)(b)2.2. The reason for the denial.
DHS 120.30(2)(b)3.3. For a person who believes that he or she is authorized under s. 153.50 (4), Stats., the procedures for appealing the denial under s. 19.37 (1), Stats.
DHS 120.30(3)(3)Access to patient-identifiable data. In accordance with s. 153.50, Stats., only the following persons or entities may have access to patient-identifiable data maintained by the department:
DHS 120.30(3)(a)(a) A health care provider or the agent of a health care provider to ensure the accuracy of the information in the department database.
DHS 120.30(3)(b)(b) An agent of the department responsible for collecting and maintaining data under this chapter and who is responsible for the patient-identifiable data in the department in order to safely store the data and ensure the accuracy of the information in the department’s database.
DHS 120.30(3)(c)(c) The department for any of the following purposes:
DHS 120.30(3)(c)1.1. Epidemiological investigation purposes specified in writing.
DHS 120.30(3)(c)2.2. Eliminating the need to maintain duplicative databases where the requesting department agent has statutory authority to collect patient-identifiable data as defined in s. 153.50 (1) (b), Stats.
DHS 120.30(3)(d)(d) Other entities that have a signed, notarized written agreement with the department, in accordance with the following conditions:
DHS 120.30(3)(d)1.1. The entity has a statutory requirement for obtaining patient-identifiable data for any of the following:
DHS 120.30(3)(d)1.a.a. Epidemiological investigation purposes.