VBP Patient Confidentiality Recommendation Report

  • Report also available in Portable Document Format (PDF)


1) Technical and Data Sharing Issues

Policy Question: What amendments or reinterpretations, with respect to patient confidentiality considerations, can be implemented to allow for data sharing for the purposes of VBP?

Implementation Mechanisms that Require Change:

State Legislation           Model Contract           DOH Policy           Other

Notes: The mechanism for implementing the changes will be discussed as the recommendations are finalized.


New York State´s shift toward a Value Based Payment (VBP) delivery system is anticipated to enhance the value of services provided to the Medicaid population. However, this move also raises additional data privacy challenges, especially in the context of NYS law. In this changing environment, providers may need additional data in order to be more proactive and successful in VBP while continuing to protect members´ individual privacy needs. Policy clarification or regulatory updates may be needed to support these efforts. Further context is available through the associated meeting summaries.


The recommendations below reflect the outcome of discussions during the four Patient Confidentiality Workgroup meetings, including some recommendations not approved by a majority of the Workgroup but supported by some members. The recommendations are divided into three categories – those which were unanimously supported by the group, those supported by consensus of the group but not unanimous, and those for which there was limited support but no consensus for approval.

Unanimous Recommendations:

Recommendation #1: All of the disclosures contemplated under this recommendation would be subject to any constraints imposed by Federal Law (such as 42 CFR Part II which controls the confidentiality of Substance Use Disorder (SUD) specific information and/or HIPAA applicability for non–SUD specific information) as well as applicable state law. The relevant state agencies, should work within the rubrics of state and federal law to identify statutory and regulatory amendments, to allow for the sharing of PHI without the consent of the patient to support alerts and analytics, provided patients have the right to "opt–out". For operational purposes, a contract such as a HIPAA business associate agreement would need to be entered into for the sharing of PHI, including analytics, consistent with HIPAA.

Recommendation #2: To the extent that affirmative consent continues to be necessary for different categories of information, the state should make efforts towards the creation of a uniform consent form that is inclusive of plans and allows for multi–directional information sharing. Further, the group agreed that the consents should be inclusive of health care plans.

Recommendation #3: New York State should prioritize and incentivize the development of the technical capabilities required to facilitate recommendation five (5) or any other recommendation where technical capacities are in issue.

Recommendation #4: New York State should ensure that mature minors1 who do not currently have the legal right to consent to their own care (including care coordination and the sharing of medical information) have such rights and should identify and explore remedies for those mature minors whom are experiencing barriers to care because of such inability. New York State should take the immediate action of studying existing laws related to when mature minors can consent to their own medical care (including care coordination and the sharing of medical information), identify gaps to achieving Recommendation #4, and explore options to fulfill Recommendation #4, including seeking legislative or regulatory change.

Consensus Recommendations:

The Department of Health and the VBP Workgroup have mutually decided that more discussion is needed related to Recommendation #5 before any action can be taken to carry out the recommendation.

Recommendation #5: DOH, working with OMH and other relevant agencies, should issue a new interpretation of State law, or support the amendment of State law, to allow for the sharing of PHI for treatment (including care management), payment and healthcare operations purposes without the consent of the patient provided patients have the ability to opt out of consent. New York State should implement the following process to ensure education and consent rights for all patients including all Medicaid members are protected while permitting appropriate data sharing to enhance care coordination.2 The patient consent educational process described below needs to be put into place before an opt–out process is implemented.

  1. An ongoing, robust educational curriculum is required (jointly developed with state and public stakeholders including consumers through a new committee formed by the State). All education shall include:
    1. Patient rights,
    2. Meaning of consent,
  2. All materials shall address special populations of concern (e.g., mental health, HIV, and substance use disorder). This information shall be provided at a variety of appropriate settings, including one–on–one interactions at the time of consent/enrollment on an ongoing basis. Create consistency between state/federal law so that NYS law is no more restrictive than federal law (without the need for affirmative consent)
  1. Subject to technological capacity, a centralized opt–out registry should be created to track opt–out status (this may require financial assistance from NYS). The creation of this registry shall be done with input from stakeholders including providers.
  2. Subject to technological capacity, create an opt–in process for SUD population in accordance with 42 CFR Part 2 and any other required opt–in populations; as well as create an opt–out process for those whom so elect.

Recommendation #6: New York State and New York City Offices of Vital Statistics should grant access to a limited set of individuals and/or organizations to review vital statistics for:

  • To facilitate VBP bundles, including the maternity bundle
  • Ascertain the death of enrollees

Unapproved Non–Consensus Recommendations

No further action will be carried out related to Unapproved Non–Consensus Recommendations.

Recommendation #7: The State should support the creation of technical mechanisms to allow for the ability of patients to exercise their right to suppress sharing of sensitive health information (e.g., mental health, HIV) between providers via an opt–out approach.3

Recommendation #8: All payers should be required to send explanations of benefits only to the patient for whom the claim is made, at the address and in the manner the patient directs.


1. A mature minor is "a minor who is emotionally and intellectually mature enough to give informed consent and who lives under the supervision of a parent or guardian". (New York Civil Liberties Union). 1
2. Recommendation 5 was accepted by the larger group, with a small number voting against such approach. NYAPRS´s opposed Recommendation 5. Further information regarding NYAPRS´ considerations is available through the associated meeting summaries. 2
3. Recommendation 7 was supported and opposed by an equal number of workgroup members. 3