A Guide to Privacy Laws for Freestanding Cancer Hospitals in Delaware

What privacy laws apply to freestanding cancer hospitals in Delaware?

A freestanding cancer hospital may need to comply with several overlapping privacy and reporting rules. If it is a HIPAA covered entity, the federal HIPAA Privacy, Security, and Breach Notification Rules govern protected health information (PHI). Delaware’s Cancer Control Act separately requires reporting to the Delaware Cancer Registry, while Delaware’s personal-information security and breach-notification law may apply to certain computerized personal information. The Delaware Cancer Control Act and Delaware computer security breach law set out key state requirements.

Healthcare-associated infection reporting may also apply, depending on the facility’s legal classification and the infections covered by the rules. Delaware defines a “hospital” for that law as an acute-care facility licensed under Chapter 10, so a freestanding cancer facility should confirm whether it falls within that definition rather than assume that every cancer center has the same reporting duties. HIPAA generally permits legally required public-health disclosures, and state public-health reporting laws are among the types of state laws HIPAA does not preempt. See Delaware’s Healthcare Associated Infections Disclosure Act and HHS guidance on HIPAA and state laws.

What information must hospitals report to Delaware’s cancer registry?

Delaware law requires the designated representative of a hospital or similar institution that diagnoses or treats cancer or reportable benign tumors to report cases to the Department of Health and Social Services. Reports are due within 180 days of initial diagnosis or treatment. The registry’s required information must include applicable National Cancer Data Base reporting requirements and, at a minimum, information about the patient’s length of residence in Delaware, primary Delaware residential address, and the location and nature of the patient’s primary past employment. The statute also requires follow-up information the Department deems necessary at least annually. See 16 Del. C. §§ 3203–3204.

For a hospital, the Delaware Cancer Registry’s reporting manual provides operational instructions and required data fields. These may include identifying, demographic, diagnostic, staging, and treatment information needed to document and match cases. The reportable diagnoses are those covered by the statutory definitions and applicable reporting rules; the hospital should follow the current registry instructions for its submission method and data set. See the Delaware Cancer Registry Hospital Reporting Procedure Manual.

How is cancer registry information kept confidential?

Registry reporting is not anonymous: the information submitted may identify a patient so the state can document cases, follow up, and consolidate records. Delaware law nevertheless prohibits divulging or making a cancer or benign-tumor report public in a way that might disclose the patient’s identity. Patient-identifying information may be exchanged among cancer control agencies only when authorized by the Department and when the Department has satisfactory assurances that confidentiality will be preserved. See 16 Del. C. § 3205.

HIPAA continues to govern the hospital’s PHI and the registry’s handling of information where applicable. Delaware’s Division of Public Health describes patient-identifiable registry information as confidential and says registry workforce members are bound by laws and procedures governing access, use, disclosure, and security. Hospitals should use the registry’s designated submission process and restrict access to staff who need the information for their assigned work. See the Delaware Cancer Registry patient-confidentiality guidance.

When may hospitals disclose protected health information without patient consent?

HIPAA allows a covered hospital to disclose PHI without an individual’s authorization when the disclosure is required by law or is permitted for a public-health activity. Delaware’s mandatory cancer-registry reporting is one example: a hospital can report the information required by state law without first obtaining patient consent. HIPAA also permits disclosures to a public-health authority authorized by law to collect or receive information for public-health purposes. See HHS guidance on the HIPAA Privacy Rule and HHS guidance on public-health disclosures.

Other HIPAA permissions can cover specific situations, such as certain disclosures for health oversight, judicial or administrative proceedings, law enforcement, or to avert a serious threat, subject to each rule’s conditions. A permission is not always a requirement to disclose. The hospital should verify the recipient, purpose, and legal basis before releasing PHI, and should not treat a general request as authority to disclose a full medical record.

How do HIPAA treatment, payment, and healthcare operations rules apply?

HIPAA generally allows a covered entity to use or disclose PHI without patient authorization for treatment, payment, and healthcare operations. Treatment includes providing or coordinating care, consulting with another provider, and making referrals. Payment includes activities such as submitting claims and obtaining payment for care. Healthcare operations can include quality assessment, care coordination, and certain administrative activities. These HIPAA treatment payment healthcare operations permissions do not eliminate the need to follow applicable safeguards or other legal restrictions. See HHS guidance on treatment, payment, and healthcare operations.

For payment and healthcare-operations uses and disclosures, a hospital must make reasonable efforts to limit PHI to the minimum necessary for the purpose. The minimum-necessary rule does not apply to disclosures to, or requests by, a healthcare provider for treatment. Separate rules apply to especially sensitive information, including psychotherapy notes, and some disclosures may require a specific authorization. See HHS guidance on the minimum-necessary standard.

What safeguards and breach notices are required for personal information?

HIPAA’s Security Rule requires appropriate administrative, physical, and technical safeguards to protect electronic PHI’s confidentiality, integrity, and availability. The required approach is risk-based; hospitals must assess risks and implement measures appropriate to their circumstances rather than rely on a single checklist. Delaware law also requires businesses that own, license, or maintain personal information to implement and maintain reasonable procedures and practices to prevent unauthorized acquisition, use, modification, disclosure, or destruction. See HHS’s HIPAA Security Rule overview and 6 Del. C. § 12B-100.

Under HIPAA, a breach of unsecured PHI generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. A covered entity must also report breaches to the HHS Secretary; breaches involving 500 or more people have a 60-day reporting deadline, while smaller breaches are reported annually. Media notice is required in certain cases affecting more than 500 residents of a state or jurisdiction. See HHS’s Breach Notification Rule guidance.

Delaware breach notification requirements apply to covered computerized personal information, which can include medical history, treatment, or diagnosis when combined with a resident’s first name or initial and last name. Notice is generally due without unreasonable delay and no later than 60 days after the determination of a breach, unless an investigation reasonably finds that the breach is unlikely to result in harm. If more than 500 Delaware residents must be notified, the Attorney General must also be notified by the time resident notice is provided. Delaware law provides that a regulated entity maintaining breach procedures under its primary regulator’s rules is deemed to comply with the state notice timing requirement when it notifies residents under those procedures. See 6 Del. C. §§ 12B-101–12B-103.

What are the limits on sharing patient identifiers?

Delaware’s cancer-registry law requires information sufficient to report and follow cases, but it tightly limits public release: a report must not be divulged or made public in a way that could identify the patient. Identifiers may be exchanged among cancer control agencies only under the statute’s authorization and confidentiality-assurance conditions. These limits mean that a mandatory report to the registry does not give the hospital general permission to share the patient’s identity with other parties.

Healthcare-associated infection reporting has its own privacy restriction. For facilities within the law’s scope, Delaware requires certain infection data to be reported, but no healthcare-facility report or Department disclosure may identify a patient, employee, or licensed healthcare professional in connection with a specific infection incident; the statute also bars releasing patient Social Security numbers or other information that could identify an individual patient. Confirm whether the facility meets the law’s definition of a hospital and which infections are reportable. See 16 Del. C. §§ 1002A–1009A and Delaware’s communicable-disease and infection-reporting regulation.

For other disclosures, apply HIPAA’s purpose-specific rules and limit access according to job duties. The minimum-necessary standard generally applies to payment, healthcare operations, and many public-health disclosures, but not to provider-to-provider treatment disclosures or disclosures required by law. In practice, the hospital should report what the law requires, protect identifiers in the registry and infection-reporting processes, and verify the legal basis before making any separate disclosure.

FAQs

Must Delaware cancer hospitals report cancer cases to the state registry?

Yes. Delaware law requires a hospital’s designated representative to report occurrences of reportable cancer and benign tumors diagnosed or treated by the institution. Reports are generally due within 180 days of initial diagnosis or treatment. See 16 Del. C. § 3204.

Can cancer registry reports identify individual patients?

They can contain identifying information for registry purposes. Delaware law prohibits releasing or making a report public in a way that might identify the patient, subject to the limited exchange of identifying information among authorized cancer control agencies that preserve confidentiality. See 16 Del. C. § 3205.

When can a Delaware hospital disclose protected health information without consent?

A hospital may disclose PHI without authorization when HIPAA permits or requires the disclosure, including for treatment, payment, and healthcare operations, for disclosures required by law, and for qualifying public-health activities. Each permission has conditions, so the hospital should confirm that the recipient and purpose fit the applicable rule. See HHS’s HIPAA TPO guidance and public-health guidance.

When must a hospital notify Delaware residents of a data breach?

For a breach covered by Delaware’s personal-information law, notice is generally required without unreasonable delay and no later than 60 days after determining that a breach occurred, unless an appropriate investigation reasonably concludes that harm is unlikely. HIPAA may also require notice for a breach of unsecured PHI, generally without unreasonable delay and within 60 days of discovery. A hospital should assess both laws and follow the applicable notification procedures. See Delaware’s breach-notification law and HHS’s HIPAA breach guidance.