CHAPTER He-W 900 OTHER PROGRAMS ADMINISTERED BY THE DEPARTMENT OF HEALTH AND HUMAN SERVICES

PART He-W 910 – RESERVED

He-W 910.01

Source. #6925, eff 1-1-99; amd by #7666, eff 4-1-02; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12

He-W 910.02

Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12

He-W 910.03 & He-W 910.04

Source. #6925, eff 1-1-99; ss by #7804, eff 1-1-03; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12

He-W 910.05

Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12

He-W 910.06

Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; ss by #8467, eff 10-29-05; ss by #9513, INTERIM, eff 7-18-09, EXPIRES: 1-14-10; ss by #9617, eff 1-14-10; rpld by #10139, eff 7-1-12

He-W 910.07

Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; ss by #8467, eff 10-29-05; ss by #9747, eff 7-1-10; rpld by #10139, eff 7-1-12

He-W 910.08

Source. #6925, eff 1-1-99; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12

He-W 910.09

Source. #7666, eff 4-1-02; ss by #8227, eff 1-1-05; rpld by #10139, eff 7-1-12

He-W 910.10

Source. #8227, eff 1-1-05; rpld by #10139, eff 7-1-12

PART He-W 950 COMPREHENSIVE HEALTH CARE INFORMATION SYSTEM PROCEDURES FOR THE RELEASE OF CLAIMS DATA SETS FOR PUBLIC AND RESEARCH PURPOSES

He-W 950.01 Purpose. This part specifies the requirements, procedures, and conditions under which persons other than department personnel may have access to health care claims data sets.

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14; ss by #14166, eff 1-7-25

He-W 950.02 Scope. This chapter shall apply only to data collected under RSA 420-G:11, II.

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14; ss by #14166, eff 1-7-25

He-W 950.03 Definitions.

(a) “Cell size” means the count of patients that share a set of characteristics contained in a statistical table.

(b) “Commissioner” means the commissioner of the New Hampshire department of health and human services or the commissioner’s designee.

(1) Have not been revealed previously to the general public; and

(2) Directly identify a patient.

(d) “Department” means the New Hampshire department of health and human services.

(e) “Direct patient identifiers” means:

(1) Names;

(2) Business names when that name would serve to identify a patient;

(3) Postal address information other than town or city, state, and 5-digit zip code;

(4) Specific latitude and longitude or other geographic information that would be used to derive postal address;

(5) Telephone and fax numbers that identify a patient;

(6) Electronic mail addresses that identify a patient;

(7) Social security numbers that identify a patient;

(8) Medical record numbers;

(9) Health plan beneficiary numbers;

(10) Certificate and license numbers that identify a patient;

(11) Internet protocol addresses and uniform resource locators that identify a business that would serve to identify a patient;

(12) Biometric identifiers, including finger and voice prints; and

(13) Personal photographic images.

(f) “Disclosure” means to communicate clinical or other health care information data collected pursuant to RSA 420-G:11, II, to a person not already in possession of that information.

(g) “Encrypted” means a method by which the true value of data has been disguised in order to prevent the identification of persons or groups and which does not provide the means for recovering the true value of the data.

(h) “Health care claims data sets” means information consisting of or derived directly from member eligibility files, or medical, pharmacy, or dental claims files submitted by health care claims processors collected under RSA 420-G:11, II, and include:

(1) Public use data sets; and

(2) Limited use data sets.

(i) “Health care practitioner” means physicians and all persons licensed or registered as a health care provider in the state of New Hampshire including, but not limited to:

(1) Nurses;

(2) Podiatrists;

(3) Optometrists;

(4) Pharmacists;

(5) Chiropractors;

(6) Physical therapists;

(7) Dentists;

(8) Psychologists;

(9) Licensed clinical social workers;

(10) Marriage and family therapists;

(11) Professional counselors; and

(12) Physicians’ assistants.

(j) “Indirect patient identifier” means:

(1) All geographic subdivisions of New Hampshire or any state or province, including census tracts, blocks, and block groups, cities, towns, zip codes, and their equivalent geocodes, except county;

(2) Race and ethnicity;

(3) All elements of dates, except year, for dates related to a patient, including birth date, admission date, discharge date, date of death, and all ages over 89 and all elements of dates, including year, indicative of such age, except that such elements may be aggregated into a single category of age 90 and older; and

(4) Group policy numbers.

(k) “Limited use data set” means a health care claims data set that contains restricted data elements, which might be disclosed to an outside party for research purposes without the patient’s authorization when:

(1) All direct patient identifiers have been encrypted in such a way as to not allow direct identification, and to prevent linkage to other data sets where the patient can be directly identified;

(2) Any data that directly identifies or would lead to the indirect identification of health care practitioners performing abortions has been removed; and

(3) All insured group or policy numbers cannot be used to directly identify a patient.

(l) “Patient” means any person in the data set that is the subject of the activities of the claim performed by the health care provider.

(m) “Principal investigator” means the person in charge of a project that makes use of limited use data sets, and acts as the custodian of the data who is responsible for the observance of all conditions of use and for establishment and maintenance of security arrangements to prevent unauthorized use.

(n) “Public use data set” means a data set that is publicly available, contains data collected under RSA 420-G:11, II, is free of confidential data, and from which all known direct or indirect patient identifiers have been removed in accordance with 45 CFR 164.514(a)-(b).

(o) “Release” means to make all or part of the claims data set available for inspection and analysis to persons other than the department and the New Hampshire insurance department (NHID).

(p) “Research” means “research” as defined in 45 CFR 46.102(l).

(q) “Statistical table” means single or multivariate counts based on the information contained in a data set and which does not include any direct identifiers.

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14; ss by #14166, eff 1-7-25

He-W 950.04 Release of Public Use Data Sets.

(a) Public use data sets collected or generated by the department or its designee shall be made available in public use files and provided to any person upon written request, except where otherwise prohibited by law.

(b) A person may request public use data sets by completing and submitting a “Request Form for NH Commercial Claims Public Use Data Set” (December 2024).

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14 (from He-W 950.05); ss by #14166, eff 1-7-25

He-W 950.05 Release of Limited Use Data Sets.

(a) In accordance with 45 CFR 164.514(e)(3)(i), limited use data sets shall only be released for purposes of research.

(b) Any researcher requesting access to limited use data sets shall submit:

(1) A completed “Application for Access to New Hampshire Limited Use Commercial Health Claims Research Data Sets” form (December 2024) and shall execute a contract which describes the permitted uses of data;

(2) A copy of existing research protocols, if applicable; and

(3) Approval from an institutional review board, if applicable.

(1) The application is complete pursuant to (b) above;

(2) The applicant demonstrates the following:

a. How inventory of data files will be maintained and updated;

b. That physical access to the data files will be restricted to only research staff;

c. That safeguards are in place for research staff, having access to the data files, including but not limited to confidentiality agreements and training on stewardship responsibilities;

d. Procedures for tracking active employment and project participation status of research staff throughout the life the project(s);

e. The technical and physical safeguards which will be performed to maintain security of the data files, including but not limited to site and office access controls, secured file cabinets, and locked offices;

f. The technical safeguards performed to protect data stored on local workstations and onsite and external servers;

g. The method of encryption used as the data sets are moved between computers; and

h. The technical safeguards performed to prevent the creation of additional copies of the data;

(3) The qualifications of the investigator and research staff demonstrate their ability to undertake the study or accomplish the intended study as documented by:

a. Training and previous research, including prior publications in the proposed or related area; and

b. An affiliation with a university, private research organization, medical center, state agency, or other institution that will provide sufficient research resources;

(4) The applicant has demonstrated that the data sets are required in order to undertake the study or accomplish the intended use;

(5) The applicant has never been found to have violated the terms of a prior data use agreement;

(6) The claims data release advisory committee has been given 45 days after receipt of the application to comment on the merits of the application to the department in accordance with He-W 950.06(d) below; and

(7) No other state or federal law, or federal regulation prohibits release of the requested information.

(d) If the department declines to release the limited use data sets, within 60 days of receipt of the application, the department shall provide a written statement identifying the specific criteria that are the basis for denial of the application.

(e) Studies taking longer than 2 years shall require annual renewal of the request.

(f) Except as provided in (i) below, the researcher shall provide the department with a copy of any proposed release at least 30 days prior to publication or release of any report or publication that contains information derived from the data set so that the department has the opportunity to review the release and verify that the agreed upon conditions have been applied.

(g) If the department determines, based on the review required in (f) above, that a report or publication containing information that might lead to direct or indirect identification of patients, employers, or other group purchasers, or is not within the scope of the agreed upon conditions, the department shall provide a written statement to the researcher stating specifically the problematic sections in the publication.

(h) When the department issues a statement in accordance with (g) above, the researcher shall modify the report or publication prior to its release by fully addressing the problematic sections.

(i) When the department determines that multiple reports will be of a similar nature, the department shall waive the requirement that any subsequent reports or publications be provided to the department prior to release by the researcher.

(j) Any draft reports or publications supplied to the department shall be treated as confidential and shall not be released by the department.

(k) The department shall:

(1) Maintain records of applications for, and releases of, limited use data sets and make them available for public inspection;

(2) Maintain a system for tracking the dates by which data sets shall be returned or destroyed; and

(3) Maintain records of the review of publications, if applicable.

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14 (from He-W 950.06); ss by #14166, eff 1-7-25

He-W 950.06 Claims Data Release Advisory Committee.

(a) The department shall establish a claims data release advisory committee to provide non-binding advice and opinion on the merit of applications for limited use data sets.

(b) The purpose of the claims data release advisory committee shall be to review applications for limited use data sets when requested to do so in accordance with (d) below, and to advise the commissioner on whether:

(1) The release is consistent with:

a. The statutory purpose of the comprehensive health care information system (CHIS), established in accordance with RSA 420-G:11-a; and

b. The requirements of Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, 45 CRF Part 160-164; and

(2) The intended use of the data will:

a. Contribute to efforts to improve health care for New Hampshire residents; and

b. Be for research that employs appropriate analytical methods.

(c) The claims data release advisory committee shall be annually appointed by the commissioner and consist of the following members:

(1) One member representing insurance carriers;

(2) One member representing health care facilities;

(3) One member representing health care practitioners;

(4) One member representing the general public;

(5) One member representing purchasers of health insurance;

(6) One member representing health care researchers; and

(7) Two members of the department.

(d) Upon request from the commissioner, the claims data release advisory committee shall review an application and provide the commissioner with any comment on the merits of the application and the research protocol described therein within 45 days.

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14; ss by #14166, eff 1-7-25

He-W 950.07 Exemption from Rule.

(a) Release of the entire claims data set to the NHID shall be made without restriction except that the NHID shall defer to the department any release of data sets and shall not release data sets to other parties, except as specified in the data collection rules, Ins 4000, and except for the public use data set in whole or part.

(b) The department and the NHID shall release data to their agents for specific projects as needed.

(c) The department and the NHID shall ensure that contracts with their agents contain signed agreements to maintain the confidentiality of the data, prevent unauthorized re-release of the data sets, and prevent the agents from using the data for their own benefit or advantage.

(d) Release of data to state or federal agencies or other government oversight entities or their contractors for health oversight purposes shall be provided consistent with HIPAA, New Hampshire state law, and federal laws.

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14 (from He-W 950.08); ss by #14166, eff 1-7-25 (formerly He-W 950.08)

He-W 950.08 General Limitation.

(a) The CHIS, established in accordance with RSA 420-G:11-a, shall not contain direct patient identifiers.

(b) Neither the department nor any employee or agent shall receive, obtain, or otherwise possess direct patient identifiers or supply them to others.

Source. #8600, eff 4-6-06; ss by #10703, eff 10-23-14 (from He-W 950.09); ss by #14166, eff 1-7-25 (formerly He-W 950.09)

APPENDIX

RULE	STATUTE
He-W 950.01	RSA 420-G:11-a
He-W 950.02	RSA 420-G:11-a
He-W 950.03	RSA 420-G:11-a
He-W 950.04	RSA 420-G:11-a
He-W 950.05	RSA 420-G:11-a
He-W 950.06	RSA 420-G:11-a
He-W 950.07	RSA 420-G:11-a
He-W 950.08	RSA 420-G:11-a