Patient data elements considered patient-identifiable – Wis. Admin. Code DHS §120-30

The Department of Health Services may not release or provide access to information that is patient identifying.  Those who are authorized to and who would like access to patient identifying information must submit a written request to the Department.  An authorized entity to access this information must show evidence of the authority, and must uphold patient confidentiality standards. 

Only the following individuals can have access to patient identifying information:

• Health care provider to ensure the accuracy of the information;
• Agent of the Department who collects and maintains the information;
• The Department for conducting epidemiological research or eliminating duplicative information;
• Other entities with a signed, notarized agreement with the Department that conduct epidemiological research or eliminate duplicative information;

The regulation considers the following information submitted by hospitals and ambulatory surgical centers to be patient identifiable and therefore confidential:

• Patient medical record or chart number;
• Patient control or account number;
• Patient date of birth;
• Patient’s employment status;
• Patient’s school;
• Patient’s race or ethnicity;
• Patient’s city of residence;
• Date of patient’s illness;
• Dates of services provided;
• Hospitalization dates;
• Dates patient is unable to work;
• Dates of admission and discharge;
• Date of patient’s main procedure;
• Care identifier;
• Insured’s policy number and identification number;
• Insured’s date of birth;
• Insured’s gender;
• Medical assistance code or authorization number;
• Patient’s employer name.

The following information submitted by providers that are not hospitals or ambulatory surgical centers is considered patient identifying and must remain confidential:

• Data elements cited above;
• Whether the patient’s condition is related to employment;
• Date of first symptom of illness;
• Dates of similar illnesses;
• Dates patient has been unable to work;
• Date of medical services;
• Patient’s city or town.

The regulation also outlines other steps to be taken to ensure the confidentiality of aggregate data.