105 CMR 305.00 — Confidential birth information

105 CMR: DEPARTMENT OF PUBLIC HEALTH

105 CMR 305.000: CONFIDENTIAL BIRTH INFORMATION

Section 305.001: Purpose 305.002: Scope 305.003: Citation 305.004: Definitions 305.010: Information Acquired for Administrative, Statistical or Research Purposes 305.015: Notice to Parent or Legal Guardian 305.020: Reporting Confidential Birth Information 305.030: Confidentiality of Birth Information 305.040: Permitted Disclosure of Identifiable Confidential Birth Information 305.050: Permitted Disclosure of Confidential Birth Information Contained in Limited Data Sets 305.060: Permitted Disclosure of De-identified Birth Information 305.065: Permitted Disclosure of Aggregate Birth Information 305.070: Application for Access to Confidential Birth Information for Research Purposes 305.080: Restrictions on Use and Disclosure of Confidential Birth Information for Research Purposes 305.090: Sanctions for Violations of Conditions for Approval

105 CMR 305.00 Confidential birth information

305.001 Purpose

305.001: Purpose The purposes of 105 CMR 305.000 are to set forth the reporting requirements for birth information, to ensure the confidentiality of birth information consistent with M.G.L. c. 111, § 24B, to specify the acceptable uses of confidential birth information for administrative, statistical, or research purposes, to enumerate minimum criteria for use of confidential birth information by researchers, and to establish restrictions on use and disclosure of confidential birth information.

305.002 Scope

305.002: Scope 105 CMR 305.000 applies to all data elements related to the birth of a child in the Commonwealth collected pursuant to M.G.L. c. 111, § 24B, with the exception of those that are recorded pursuant to M.G.L. c. 46, §1.

305.003 Citation

305.003: Citation 105 CMR 305.000 shall be known and may be cited as 105 CMR 305.000: Confidential Birth Information.

305.004 Definitions

305.004: Definitions As used in 105 CMR 305.000, the following words have the following meanings: Administrative Purposes means data collected to administer or evaluate a program and for data quality control. Administrative purposes include vital registration and recordkeeping purposes as set forth in M.G.L. c. 46 and M.G.L. c. 209C and child support enforcement purposes as set forth in M.G.L. c. 119A. Administrative purposes specifically exclude any other uses of confidential birth data to make any determination about identifiable individuals, such as determining whether a person is eligible for a license, privilege, right, grant or benefit or whether such should be revoked. Aggregate Data means data collected from individual-level records that have been combined for statistical, research or administrative purposes. Cell Size Suppression means a statistical method used to report aggregate data in tables that restricts or suppresses disclosure of subsets of aggregate data to protect the identity and privacy of data subjects and to avoid the risk of identification of individuals in small population groups. Commissioner means the Commissioner of the Massachusetts Department of Public Health.

105 CMR: DEPARTMENT OF PUBLIC HEALTH

305.004 continued

305.004: continued Confidential Birth Information means all data elements, other than the facts required to be recorded pursuant to M.G.L. c. 46, § 1, that the Department or its agents acquire, collect and maintain pursuant to M.G.L. c. 111, § 24B, related to the birth of a child in the Commonwealth. Contact means to communicate or attempt to communicate with a data subject or the data subject’s parent, guardian, or health care provider by any means, including, but not limited to, in-person, telephone, facsimile, letter, or electronic mail. Data Subject means the individual about whom the data or information relates. De-identified Data means birth information that does not contain any data that could be used to identify a particular individual. The specific variables that are permitted in a de-identified data set are listed in the Department’s Confidentiality Policy and Procedures. De-identified data may be released as a public record. Department means the Massachusetts Department of Public Health. Disclose means to transfer, disseminate, or otherwise communicate or divulge any confidential birth information to any person or entity. Identifiable Data means any data or information that: (1) Reveals the identity of the data subject or is readily identified with the data subject, including, but not limited to, name, address, telephone number, social security number, health identification number, or date of birth; or (2) Provides a reasonable basis to believe that the information could be used, either alone or in combination with other information, to identify a data subject. Institutional Review Board means any board, committee, or other group formally designated by an institution, and approved by the federal Department of Health and Human Services pursuant to 45 CFR Part 46 to review, approve, and periodically evaluate research projects to protect the rights of human research subjects. Limited Data Set means confidential birth information derived from vital records that excludes direct identifiers of individuals but is not completely de-identified and is not suitable for public disclosure. The following are considered direct identifiers: Name, street address and equivalent geocode, phone number(s), social security number, license number(s), e-mail address(es), or any other unique identifying number(s), characteristic(s), or code(s) that is (are) readily associated with an individual. Linkage means the combination of individual-level confidential birth information with any other information system in whatever form. Non-marital Birth means any birth of a child whose parents are not married to each other at the time of birth or within 300 days of the birth of the child. Person means an individual, corporation, estate, trust, partnership, limited liability company, association, government or governmental body, or any other legal entity. Pledge of Confidentiality means a written statement, dated and signed by an individual who is granted access to confidential birth information, that certifies the individual’s agreement to abide by the confidentiality restrictions stated in the written statement. Public Health Authority means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.

105 CMR: DEPARTMENT OF PUBLIC HEALTH

305.004 continued

305.004: continued Public Health Purpose means a population-based activity or individual effort primarily aimed at: the reduction of morbidity or mortality; the prevention of injury, illness, disease, disability or premature mortality; the improvement of health outcomes; or the promotion of health in the community, including assessing the health needs and status of the community through public health reporting and surveillance, developing public health policy, and responding to public health needs and emergencies. Registrar means the Registrar of the Registry of Vital Records and Statistics established by the Massachusetts Department of Public Health pursuant to M.G.L. c. 17, § 4. Research means a systematic investigation designed primarily to develop or contribute to general knowledge, including public health, medical, social, demographic and historical research. Statistical Purposes means data collected for generating aggregate descriptions, estimations or analyses of groups of persons or institutions, without regard to the identities of specific individuals. Statistical purposes include child support enforcement purposes as set forth in M.G.L. c. 119A. Statistical purposes specifically exclude any other uses of confidential birth data to make any determination about identifiable individuals, such as determining whether a person is eligible for a license, privilege, right, grant or benefit or whether such should be revoked. Vital Records Jurisdiction means the 50 states within the United States, New York City, Washington D.C., Puerto Rico, Guam, Samoa, the Virgin Islands, and the Northern Mariana Islands.

305.010 Information Acquired for Administrative, Statistical or Research Purposes

305.010: Information Acquired for Administrative, Statistical or Research Purposes Confidential birth information that the Department acquires for administrative, statistical or research purposes may be used only for administrative, statistical or research purposes and shall not be used or disclosed in identifiable form for any other purposes.

305.015 Notice to Parent or Legal Guardian

305.015: Notice to Parent or Legal Guardian The Commissioner shall prescribe and provide a worksheet for birth certificates to be provided to the parent or legal guardian of the newborn by the physician, certified nurse midwife, administrator or other person in charge of a hospital or birthing facility, or any other person responsible for recording and/or reporting a birth pursuant to M.G.L. c. 46. This worksheet shall specify the confidential birth information requested from the parent or legal guardian and shall contain a notice to the parent or legal guardian who provides confidential birth information that the data collected and reported to the Department on the confidential section of the birth reporting form may be used only for those administrative, statistical or research purposes deemed by the Commissioner as necessary for public health purposes and may not be used or disclosed in identifiable form for any other purpose.

305.020 Reporting Confidential Birth Information

305.020: Reporting Confidential Birth Information The physician, certified nurse midwife, administrator or other person in charge of a hospital or birthing facility, or any other person responsible for recording and/or reporting a birth pursuant to M.G.L. c. 46, shall report to the Registrar within ten days of the birth of the child all confidential birth information that the Commissioner deems necessary for administrative, statistical or research purposes pursuant to M.G.L. c. 111, § 24B. The Commissioner shall prescribe and provide paper forms or an electronic format for reporting confidential birth information that shall bear the caption “Confidential Birth Information” and that specifies the confidential birth information deemed necessary for administrative, statistical or research purposes.

105 CMR: DEPARTMENT OF PUBLIC HEALTH

305.030 Confidentiality of Birth Information

305.030: Confidentiality of Birth Information (A) Birth information collected pursuant to M.G.L. c. 111, § 24B, and 105 CMR 305.000 shall be considered confidential and is exempt from disclosure under the public records law, M.G.L. c. 66, pursuant to M.G.L. c. 4, § 7, cl. 26(a) and (c). (B) The Department shall restrict the use and disclosure of identifiable, individual-level confidential birth information to only legitimate public health purposes, as determined by the Commissioner, or as otherwise required by law, and shall not use or disclose any more confidential birth information than is necessary to achieve the public health purpose. (C) Nothing contained in 105 CMR 305.000 shall be interpreted as restricting or limiting the Department or its agents from using or disclosing any confidential birth information as deemed necessary to conduct official Department duties. (D) Nothing contained in 105 CMR 305.000 shall prohibit the disclosure of information or data that would not identify any person named in a vital record or report.

305.040 Permitted Disclosure of Identifiable Confidential Birth Information

305.040: Permitted Disclosure of Identifiable Confidential Birth Information The Department may disclose identifiable confidential birth information that is not otherwise restricted by law or court order only to: (A) Authorized employees or authorized agents of the Department for administrative, statistical or research purposes; (B) Authorized employees of the IV-D agency for child support enforcement purposes, only as set forth in M.G.L. c. 119A and M.G.L. c. 46, § 3D. (C) Authorized employees of the IV-D agency in another vital records jurisdiction for child support enforcement purposes, only as authorized in federal or state law. (D) Authorized researchers conducting research that has been approved by the Commissioner pursuant to M.G.L. c. 111, §§ 24A and 24B, in accordance with 105 CMR 305.070; (E) A vital records custodian from another vital records jurisdiction pursuant to data exchange agreement regarding residents of that vital records jurisdiction whose births occur in the Commonwealth. The agreement shall prohibit the re-disclosure of the confidential birth information unless approved in writing by the Registrar; (F) A government official from another vital records jurisdiction for data relating to residents of that vital records jurisdiction whose births occur in the Commonwealth provided that the disclosure of confidential birth information is: (1) For a public health purpose; (2) The minimum necessary for the required purpose; and (3) Governed by a data exchange agreement, approved in writing by the Registrar, which explicitly restricts the use of the data to only the stated public health purpose and prohibits the re-disclosure of the data unless approved in writing by the Registrar. (G) Any other person when use or disclosure is required by law and the use or disclosure is limited to the relevant requirements of such law. (H) The National Center for Health Statistics (NCHS), at the Centers for Disease Control and Prevention, for: (1) Internal NCHS statistical use; (2) Preparing public use data files provided that such use and disclosure is consistent with the Department’s Confidentiality Policy and Procedures standard for de-identification or another standard approved by the Commissioner that protects the privacy of data subjects; (3) Re-disclosure to researchers in accordance with data release standards approved by the Commissioner; or (4) Re-disclosure to federal agencies as authorized by federal law.

105 CMR: DEPARTMENT OF PUBLIC HEALTH

305.040 continued

305.040: continued (I) The data subject, upon written request.

305.050 Permitted Disclosure of Confidential Birth Information Contained in Limited Data Sets

305.050: Permitted Disclosure of Confidential Birth Information Contained in Limited Data Sets The Department may disclose confidential birth information contained in limited data sets that is not otherwise restricted by law or court order for administrative, statistical, or research purposes only to: (A) Authorized employees or authorized agents of the Department; and (B) A government agency or non-governmental organization that requests access to confidential birth information by completing a Limited Data Set Application and Agreement, available from the Department, provided that the disclosure of confidential birth information is: (1) For authorized administrative, statistical, or research purposes only; (2) The minimum necessary for the required purpose; and (3) Governed by a written agreement between the Department and such other entity and such agreement explicitly restricts use of the data to only the stated purpose and prohibits the re-disclosure of the data, unless approved in writing by the Registrar.

305.060 Permitted Disclosure of De-identified Birth Information

305.060: Permitted Disclosure of De-identified Birth Information The Department may release de-identified birth information to: (A) Authorized employees or authorized agents of the Department or the Executive Office of Health and Human Services for administrative, statistical or research purposes; and (B) Any person upon request, subject to any applicable fees for requests for public records, and provided that the information is in a statistical format established by the Department and that the Department has already publicly released such data, except that a public health authority may receive such data prior to public release provided that the public health authority does not publish or otherwise release the data before the Department has publicly released the data.

305.065 Permitted Disclosure of Aggregate Birth Information

305.065: Permitted Disclosure of Aggregate Birth Information The Department may disclose aggregate birth information for administrative, statistical, or research purposes only as follows: (A) Aggregate datasets that have not undergone cell size suppression in accordance with the data release standards contained in the Department’s Confidentiality Policy and Procedures and that do not contain birth information that is otherwise restricted by law or court order may only be disclosed in accordance with the requirements for limited data sets, as specified in 105 CMR 305.050. (B) Aggregate datasets that have undergone cell size suppression in accordance with the data release standards contained in the Department’s Confidentiality Policy and Procedures may be released in accordance with the requirements for de-identification, as specified in 105 CMR 305.060.

305.070 Application for Access to Confidential Birth Information for Research Purposes

305.070: Application for Access to Confidential Birth Information for Research Purposes (A) Any person may submit a request to the Department for temporary use of confidential birth information for research purposes. Information that may be available for approved research studies includes birth related medical and demographic data collected pursuant to M.G.L. c. 111, § 24B, and 105 CMR 305.000, and certain information related to non-marital births restricted by c. 46, § 2A, but available for research purposes pursuant to M.G.L. c. 111, § 24B, and 105 CMR 305.000. Access to confidential birth information is limited to researchers who have been approved by the Commissioner pursuant to M.G.L. c. 111, §§ 24A and 24B and 105 CMR 305.000. The Commissioner may restrict use or disclosure to certain confidential birth information or may restrict use or disclosure to certain data elements.

105 CMR: DEPARTMENT OF PUBLIC HEALTH

305.070 continued

305.070: continued (B) The principal investigator who is requesting temporary use of confidential birth information for research purposes shall complete an application for temporary use of confidential birth information on a form prescribed by the Commissioner. The applicant shall provide a detailed study protocol describing, at a minimum: (1) The purpose of the study; (2) The public health benefits of the study; (3) The applicability of the results of the study to the reduction of morbidity or mortality in the Commonwealth; (4) The study design, including the methods of data collection, plans for analysis, and expected time frame; (5) The specific birth information variables required for the study with justification for each variable; (6) Whether the study involves contact with the data subjects; (7) Whether informed consent will be obtained from the data subjects for use of confidential birth information or other information; (8) Information on any review and decision by an Institutional Review Board; (9) The measures that will be taken to ensure the confidentiality and security of confidential birth information; and (10) The names and titles of all individuals who will have access to confidential birth information for purposes of conducting the study. (C) The applicant shall include all related documentation required by the Commissioner including, but not limited to: (1) A copy of any consent forms; (2) A copy of any questionnaires, telephone interview scripts, and research subject contact materials; (3) A copy of any application to an Institutional Review Board along with any decision of the Institutional Review Board with regard to the study; and (4) Copies of resumes or curriculum vitae of the principal investigator and all co-applicants. (D) The Commissioner shall designate a Department review committee consisting of the Registrar and senior Department staff with experience in epidemiology, public health surveillance, public health policy, law, or privacy protection for research subjects. The Department review committee shall meet on a regular basis to review applications requesting temporary use of confidential birth information. The Department review committee shall review each application submitted to the Department for temporary use of confidential birth information and make a recommendation to the Commissioner regarding the application based on the review criteria specified in 105 CMR 305.070(E). The Commissioner may approve or deny the application, or request revisions to the application. (E) The Department review committee shall consider the following criteria in deciding whether to recommend approval of an application for temporary use of confidential birth information: (1) The application demonstrates that: (a) The proposed study addresses a topic of substantial public health and/or medical importance; (b) The Department holds a present programmatic interest or possible future programmatic interest in the results of the proposed study; and (c) The purpose of the proposed study relates to the reduction of morbidity and mortality in the Commonwealth; (2) The application demonstrates that the proposed study has sufficient scientific and methodological rigor to yield results which can be used to reduce morbidity and mortality in the Commonwealth; (3) The study is not feasible unless the researcher is able to have access to the requested confidential birth information; (4) The researcher has limited the request to only those data elements that are absolutely necessary to complete the proposed research study; (5) The study has been reviewed and approved by an Institutional Review Board at the applicant’s institution and/or by the Department’s Institutional Review Board, or the applicant has provided documentation indicating the study is exempt from such review;

105 CMR: DEPARTMENT OF PUBLIC HEALTH

305.070 continued

305.070: continued (6) There are adequate written assurances that confidential birth information will be used only for the approved research study and that confidential birth information will be protected from improper use or disclosure in accordance with 105 CMR 305.080; (7) The preparation of the birth information for the study is administratively feasible within the Department; (8) Informed consent of the data subject for the use or disclosure of personal or medical information is obtained whenever required by law or whenever feasible; (9) The researcher has provided the Commissioner with assurances and the researcher’s application demonstrates that no individual-level data which could affect employment or eligibility for health or insurance benefits will be provided to employers or insurers, without the informed consent of the data subject; (10) If the study involves contact with a data subject: (a) Appropriate contact protocols are in place; and (b) Contact protocols have been reviewed and approved by an Institutional Review Board that meets the requirements of 45 CFR Part 46; and (11) The study protocol and any conditions the Commissioner imposes on the applicant provide adequate and appropriate safeguards to ensure the confidentiality of the birth information requested for the study.

305.080 Restrictions on Use and Disclosure of Confidential Birth Information for Research Purposes

305.080: Restrictions on Use and Disclosure of Confidential Birth Information for Research Purposes Any person who is granted temporary use of confidential birth information for research purposes pursuant to M.G.L. c. 111, §§ 24A and 24B, and 105 CMR 305.000 shall comply with the following restrictions on the use and disclosure of such information and any other restrictions or conditions imposed by the Commissioner in any particular case: (A) Birth information shall be considered confidential. No person who is granted temporary use of confidential birth information for research purposes shall re-disclose, in any manner, any confidential birth information, except to: (1) Other individuals named in the application to the Department and only for the purposes of furthering the research study as described in the application for temporary use of confidential birth information; or (2) Individuals conducting authorized oversight of the research project, provided that the principal investigator obtains prior approval from the Commissioner. (B) Confidential birth information shall be used only for the purposes described in the application for temporary use of confidential birth information or any amendment to that application that is approved by the Commissioner. (C) The principal investigator is responsible for limiting access to the confidential birth information to only those persons listed on the original or amended application as authorized persons to maintain or use confidential birth information or any other person authorized access to confidential birth information by the Commissioner. All individuals who will receive or use confidential birth information shall sign a pledge of confidentiality, on a form prescribed by the Commissioner, which the principal investigator shall submit to the Department as a condition for approval. (D) No database linkages utilizing any confidential birth information shall be permitted unless authorized by the Commissioner. (E) If the Commissioner approves temporary use of only de-identified confidential birth information, no person participating in the research study shall in any way attempt to identify or contact any of the data subjects or allow anyone else to identify or contact any of the data subjects.

105 CMR: DEPARTMENT OF PUBLIC HEALTH

305.080 continued

305.080: continued (F) The Commissioner at all times retains an exclusive property interest in the ownership and control of confidential birth information that it may from time to time provide to researchers on a temporary basis for the purposes of conducting a time-limited study or research as approved by the Commissioner. Upon the completion of the research project, or at an earlier time specified by the Commissioner, the principal investigator shall ensure that all confidential birth information and any linked files derived from confidential birth information are destroyed and no copies are made or retained, unless otherwise authorized by the Commissioner. (G) All publications or reports of analyses shall involve only aggregate data. No personally identifying information or other information which could foreseeably lead to the identification of any data subject shall ever be published or disclosed. No report of confidential birth information containing statistical cells with fewer than five subjects shall be disclosed, except with prior written approval from the Commissioner. No maps which could foreseeably lead to the identification of a data subject shall be published or disclosed. (H) Initial approvals issued by the Commissioner to researchers for temporary use of confidential birth information shall expire one year from the date of initial approval. The principal investigator may submit a request for renewal of authorization to extend temporary use of confidential birth information for an additional year. Any renewal request shall contain the following information and any other information required by the Commissioner: (1) A brief summary of current project status; (2) An explanation of any proposed changes to the protocol or a statement affirming that the protocol has not changed; (3) A current copy of any Institutional Review Board approval; and (4) A current listing of staff who have access to study data. (I) The Commissioner, at his/her sole discretion, may require a principal investigator to submit a new application for access to confidential birth information every five years throughout the duration of the study. (J) As a condition for the disclosure of confidential birth information by the Commissioner, the principal investigator shall sign an agreement containing, at a minimum, the conditions listed in 105 CMR 305.080 and any other conditions considered appropriate by the Commissioner in order to ensure the confidentiality of birth information.

305.090 Sanctions for Violations of Conditions for Approval

305.090: Sanctions for Violations of Conditions for Approval In addition to any other sanction available by law, any person who violates any provision in 105 CMR 305.080 or any other condition specified by the Commissioner in authorizing temporary use of confidential birth information may be denied future access to confidential birth information for research purposes. REGULATORY AUTHORITY 105 CMR 305.000: M.G.L. c. 17, § 4, and M.G.L. c. 111, §§ 3 and 24B.