Part of the confusion surrounding confidentiality and privacy regulations concerns how they apply to the NCAA's Injury Surveillance System (ISS).

The ISS, established in 1982, has long been a valuable tool in the Association's efforts to develop and evaluate appropriate safety rules and policies. The ISS annually collects injury data from a representative sample of member institutions that is then reviewed by the NCAA Committee on Competitive Safeguards and Medical Aspects of Sports and NCAA sports and rules committees. The data are used as a foundation upon which to strengthen health and safety guidelines.

The ISS is being converted to a Web-based data collection format that should significantly enhance the system by the fall of 2004. Because that data will be linkable for the first time to an individual student-athlete in order to conduct longitudinal studies, an important aspect of that conversion is the potential application of federal privacy laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the Family Educational Rights and Privacy Act (FERPA) to the data gathering process.

HIPAA privacy requirements will not apply to member institutions whose medical and athletic trainer services are staffed by institutional employees, or by contracted health care professionals or paraprofessionals who do not electronically bill the institutions for their services. However, almost every NCAA institution receives federal funds and therefore must comply with the requirements of FERPA. Under FERPA, a student-athlete must sign a consent for the disclosure of personally identifiable personal medical records. The NCAA currently requires student-athletes to sign such a FERPA consent as a part of the Student-Athlete Statement compliance package each fall regarding information that determines a student-athlete's athletics eligibility. A similar authorization, with additional requirements, must occur if the medical or injury records are not protected by FERPA and are maintained by a covered entity as defined in HIPAA (see accompanying article about what is a covered entity).

Up to now, individual injury and exposure information, absent any specific identifiers, have been mailed to the national office and entered into the ISS database. Since the data has been forwarded with nothing that identifies a student-athlete, there has been no need for privacy waivers. The new Web-based application will give each institution its own electronic medical record-keeping system. The data entry will be performed at the institutional level; the resulting data will not only be the individual school's record but also be simultaneously contributed to the national ISS database. The system brings time and cost efficiencies compared to the current method in which paper injury and exposure forms are duplicated from the institution's records and mailed to the national office for data entry.

It is important to understand that the NCAA will continue to compile and use ISS information on an aggregate basis with no personal or institutional identifiers. However, because the Web-based program will originate from NCAA servers, roster information (necessary for individual school use) will be stored there as well. This enhanced data collection provides a more efficient way for both individual schools and the ISS to collect injury information. However, because of the association of personal identifiers, the system requires compliance with FERPA and possibly HIPAA as well. In response, the NCAA is developing a consent/
authorization form valid under both. The required compliance with privacy regulations is because of the possible relationship of personal identifiers with injury data and not because the information will be transmitted electronically.

Some NCAA institutions have been confused about whether they can participate in the ISS because of HIPAA. But Elsa Cole, NCAA general counsel, said participation in the NCAA Web-based ISS, which does involve transmission of electronic data, does not in itself make an institution a HIPAA covered entity.

"The HIPAA status of an institution is based on its billing practices and other factors, but not on the electronic sharing of medical information with the NCAA Injury Surveillance System," Cole said. "However, because of the enhanced version of the ISS, the Association must acquire student-athlete consent and authorization before their injury and exposure data can become part of the aggregate database."

Because of the value of the ISS to the Association, the competitive-safeguards committee and NCAA legal counsel have developed a student-athlete consent/authorization form, that meets both HIPAA and FERPA guidelines, to allow for disclosure of protected health information (injury and exposures) to the NCAA. The single form will obtain the consent/authorization from student-athletes for ISS data while eliminating the necessity of each member institution to determine which of the federal laws may apply.

Each division's Student-Athlete Advisory Committee and Management Council have approved a draft version of the form. A final version is anticipated to be part of the compliance form packages that will be completed before this fall.

"For the cost of a consent form, the ISS enhancements will supply the NCAA rules-making committees more and better data upon which to base health and safety policy and a national data base that can benefit the entire sports-medicine community," said Randall Dick, NCAA senior assistant director of research. "At the same time, the enhanced ISS will provide each participating school with an electronic medical record of its specific injury history, which is a valuable tool for not only medical professionals, but athletics administrators and risk managers as well."

ISS Web-based conversion

Goals of the enhancements scheduled to be completed by fall 2004 include:

Creating an efficient communication and data-transfer system between member institutions and the NCAA national office that provides current and reliable data on injury trends in intercollegiate athletics.

Creating a system that can serve as the primary medical/legal record for the athletic training room.

Expanding collection capabilities to monitor injuries in all sports within the NCAA and year-round within each sport.

Creating a more accessible data resource for the NCAA and its committees, conferences, individual institutions, sports-medicine researchers, media and the general public.