Pennsylvania Cancer Registry Abstracting: Privacy and Compliance for Community Oncology Practices

Pennsylvania Cancer Registry Overview

Pennsylvania Cancer Registry (PCR) is the statewide, population-based central cancer registry that collects, manages, and analyzes data on all reportable malignant and select benign brain and central nervous system tumors. For community oncology practices, accurate Pennsylvania cancer registry abstracting supports surveillance, care quality, and resource planning.

PCR operates under the Pennsylvania Cancer Control Prevention and Research Act (Act 224 of 1980) and implementing regulations in Pennsylvania Code Title 28 Part III Chapter 27. It is supported by the National Program of Cancer Registries, which establishes national standards and provides funding to strengthen data quality and comparability across states.

Data are submitted in a standardized format using the NAACCR Data Exchange Layout so records can be consolidated, analyzed, and compared. The registry’s Data Confidentiality Provisions safeguard patient privacy while enabling essential public health uses.

Reporting Requirements and Deadlines

Community oncology practices, outpatient clinics, physician offices, radiation therapy centers, hospitals, and independent pathology laboratories must report all eligible cases. Reportable information includes patient demographics, tumor site and histology, date of diagnosis, stage at diagnosis, first course of treatment, and subsequent updates when additional treatment or outcomes become known.

Timeliness matters. PCR expects routine, recurring submissions (commonly monthly) and completion of abstracts within an administratively defined window (historically within six months of diagnosis or first patient contact). Always verify your facility’s current deadline and cadence against Pennsylvania Code Title 28 Part III Chapter 27 and the latest PCR guidance.

• Casefinding: Monitor pathology, cytology, radiation, chemotherapy, and problem lists to identify reportable neoplasms promptly.
• Completeness: Capture first course of treatment delivered on-site and coordinate with other providers to minimize missing data.
• Corrections: Resolve edit errors and resubmit corrected records promptly when PCR issues feedback.
• Transmission: Use the NAACCR Data Exchange Layout for batch exports or enter cases in Abstract Plus, then transmit via the secure channel designated by PCR.

Abstract Plus Reporting Tool

Abstract Plus is a free, NPCR-supported desktop application that many facilities use to create, validate, and securely transmit cancer abstracts to state registries. It aligns with NAACCR standards, applies central-registry edit checks, and streamlines quality control for community settings with limited registry staffing.

Recommended workflow for community oncology practices

1. Prepare a casefinding log from pathology feeds, EHR reports, and treatment schedules to flag potential reportable cases.
2. Create the abstract in Abstract Plus: complete patient demographics, primary site, histology, behavior, laterality, grade, and key dates.
3. Code stage and treatment: record AJCC or summary stage (per registry instructions) and first course of therapy across modalities.
4. Document text: support codes with concise text for primary site, histology, staging rationale, and treatment intent.
5. Validate: run the built-in edit set; correct errors and review warnings to meet PCR’s acceptance criteria.
6. De-duplicate: check for prior cases and assign the correct sequence number when multiple primaries exist.
7. Export: generate the NAACCR Data Exchange Layout file and submit via the secure PCR-designated method; retain the transmittal confirmation.
8. Follow up: update abstracts when additional treatment, recurrence, or vital status changes are known.

Quality and efficiency tips

• Keep Abstract Plus and edit sets current; upgrades often include new rules and data item updates.
• Standardize templates for common sites (e.g., breast, lung, colorectal) to improve consistency and speed.
• Reconcile your monthly casefinding list against transmitted cases to ensure completeness.
• Maintain a transmittal log linking file names, counts, submission dates, and PCR acknowledgments.

Data Confidentiality and Security

Protecting patient privacy is core to PCR’s mission and to your compliance obligations. The registry’s Data Confidentiality Provisions restrict disclosure and limit data use to approved public health purposes, with statutory penalties for unauthorized release.

Data Confidentiality Provisions

• Use role-based access so only staff with a “need to know” can view identifiable data used for abstracting.
• Require annual confidentiality agreements and training on secure handling of cancer data.
• Share only the data elements required by law or registry specifications for each case.

Technical safeguards

• Encrypt data in transit and at rest; use SFTP or the secure portal designated by PCR—never ordinary email or removable media.
• Enable multi-factor authentication, endpoint protection, and automatic patching on devices used for abstracting.
• Store working files on secure network drives with routine backups and restricted permissions.

Administrative safeguards

• Perform periodic risk analyses focused on registry workflows and third-party vendors.
• Adopt a clear retention and destruction schedule for temporary working files and transmittal exports.
• Maintain an incident response plan that defines escalation, notification, and remediation steps.

HIPAA Compliance for Cancer Data

Under the HIPAA Public Health Exception, covered entities may report cancer cases and related protected health information to a public health authority without patient authorization when required or permitted by law. Central cancer registries—including PCR—are public health authorities, so no Business Associate Agreement is needed for mandated reporting.

• Minimum necessary: disclose the data elements required by Pennsylvania law and the registry’s specifications; that satisfies the standard for these disclosures.
• Notice of Privacy Practices: inform patients that your practice may share data with public health authorities for disease reporting.
• Safeguards: apply reasonable administrative, technical, and physical protections to PHI used during abstracting and transmission.

Legal Framework Governing Cancer Reporting

The Pennsylvania Cancer Control Prevention and Research Act—often referenced as Act 224 of 1980—established statewide cancer reporting and confidentiality protections. Regulations in Pennsylvania Code Title 28 Part III Chapter 27 detail reportable conditions, data elements, confidentiality, and enforcement.

PCR participates in the National Program of Cancer Registries for funding and technical standards, including the NAACCR Data Exchange Layout for uniform coding, validation, and secure interstate data movement. Together, these authorities define what you must report, how to protect it, and how the data may be used.

Data Utilization and Inter-State Exchange

PCR data guide cancer prevention, screening, and treatment initiatives; support grant funding; and inform quality improvement across the Commonwealth. De-identified, aggregate statistics help you benchmark outcomes and identify disparities without exposing patient identities.

Because many patients receive care across state lines, PCR engages in inter-state exchange using the NAACCR Data Exchange Layout to consolidate records for Pennsylvania residents diagnosed or treated elsewhere. Exchanges occur under strict confidentiality rules with encrypted transfer, audit trails, and limited-access procedures.

Conclusion

For community oncology practices, compliant Pennsylvania cancer registry abstracting hinges on three pillars: submit complete, timely NAACCR-standard data; secure PHI under robust technical and administrative safeguards; and rely on the HIPAA Public Health Exception and Pennsylvania’s statutory framework to report without patient authorization. Following these practices strengthens statewide cancer surveillance while protecting your patients’ privacy.

FAQs.

What are the reporting deadlines for cancer cases in Pennsylvania?

PCR expects recurring, timely submissions—commonly monthly—with abstracts completed within an administratively defined window (historically within six months of diagnosis or first contact). Confirm your facility’s exact deadlines in Pennsylvania Code Title 28 Part III Chapter 27 and current PCR instructions.

How does the Pennsylvania Cancer Registry ensure data confidentiality?

Confidentiality is mandated by the Pennsylvania Cancer Control Prevention and Research Act (Act 224 of 1980) and implementing regulations. PCR requires secure transmission, restricts identifiable data access to authorized personnel, applies legal penalties for unauthorized disclosure, and uses strong operational controls to protect records.

Does HIPAA require patient consent for cancer data reporting?

No. Under the HIPAA Public Health Exception, covered entities may report required cancer data to PCR—a public health authority—without patient authorization. Disclose the elements required by law and safeguard PHI during preparation and transmission.

What tools are used for cancer case reporting in Pennsylvania?

Community oncology practices commonly use Abstract Plus to create, validate, and export cases in the NAACCR Data Exchange Layout for secure submission to PCR. Some sites also generate NAACCR-conformant exports directly from the EHR or receive e-path feeds to support casefinding.