Can we use ODMAP to identify individuals who experienced a nonfatal overdose so that peer support specialists can be deployed to those individuals?

Yes, using ODMAP in this fashion does not implicate federal health information privacy laws. However, ODMAP does not collect the names of overdose victims; therefore, it is not a comprehensive source for identifying overdose survivors by itself.

If the user has access to ODMAP’s National Map, that user can: (1) identify the person/participating agency that submitted the suspected overdose incident; and (2) request information about the victim from that person or agency. Participating agencies that report overdose incidents are likely to have additional information in their own record systems regarding the identity of the victim (such as a law enforcement incident report or emergency medical services provider run sheet). Entities seeking to conduct outreach that do not have access to the ODMAP National Map are encouraged to collaborate with one or more participating agencies to develop procedures and permissions for sharing this information.

Additional information, discussion, and references are available here.

Can an EMS provider or other HIPAA-covered entity report overdose information to ODMAP without violating HIPAA?

Yes. Numerous entities covered by HIPAA (the Health Insurance Portability and Accountability Act), including emergency medical service (EMS) providers, county ambulance authorities, and combined fire/EMS departments, currently report overdose incident information to ODMAP. Each such entity’s decision to participate depends on both the applicable state law and the legal conclusion by the entity, or the jurisdiction it serves, regarding the information being reported and the extent to which HIPAA’s privacy protections apply.

The decision that a HIPAA-covered entity may report overdose information to ODMAP without violating HIPAA will be based on one of the following four conclusions by the entity or jurisdiction it serves:

• The overdose information reported to ODMAP does not contain protected health information (PHI); therefore, a HIPAA-covered entity may freely report it.
• The overdose information reported to ODMAP includes PHI, but at least one of three “exceptions” to HIPAA’s patient authorization requirement applies.
• State law requires an entity to report overdose information to ODMAP, which is another “exception” to HIPAA’s patient authorization requirement.
• The entity employs an ODMAP reporting method that does not invoke HIPAA; therefore, whether overdose information reported to ODMAP contains PHI or not is irrelevant.

Additional information, discussion, and references are available here.

Is a participating agency required to comply with a Freedom of Information Act request for ODMAP data?

Maybe. For an ODMAP participating agency to answer this question, it must determine three things:

• What law applies to the request for information?
• Does the applicable state or local law require disclosure of the agency’s data?
• What constitutes the agency’s ODMAP data?

Additional information, discussion, and references are available here.

In rural or tribal areas or areas with low population density, how likely is geolocation data to reveal someone’s identity?

There is a remote chance that an ODMAP user with National Map access could use the location of an overdose incident occurring in a sparsely populated area to determine the identity of an actual or suspected overdose victim. Actual identification, however, would ALSO require information from other sources (discussed in the linked document below). Several aspects of ODMAP’s operation serve to greatly limit these concerns:

• The general public cannot access ODMAP.
• Only a subset of ODMAP users have access to the National Map feature.
• There is restricted ability to zoom in on the National Map.
• The overdose victim may have no ties to the incident location.
• ODMAP’s participation agreement clearly states how participating agencies must limit access to, and use of, ODMAP.
• Washington/Baltimore HIDTA (W/B HIDTA) or the participating agency can remove a user’s access for violating policies, procedures, or applicable laws.

Additional information, discussion, and references are available here.

There is a concern that ODMAP will be used as a policing tool. Are there ways to limit or define how data submitted to ODMAP is used?

Yes. ODMAP’s policies and procedures require participating agencies to use ODMAP “only for its intended purposes,” which are “to support public safety and public health efforts to mobilize an immediate response to a sudden increase or spike in overdose events.” To the extent that a participating agency believes this limitation on ODMAP use is insufficient, the agency has several options:

• Enter into data use agreements or memoranda of understanding (MOUs) with local law enforcement agencies.
• Enactment of a state or local statute/ordinance that prohibits certain actions by law enforcement based solely on access to ODMAP.

Additional information, discussion, and references are available here.

May community-based treatment programs or naloxone distribution programs voluntarily report overdose information to ODMAP?

There is no federal law that prevents a naloxone distribution or community-based treatment program from reporting overdose incident information to ODMAP. However, pursuant to ODMAP’s Policies and Procedures, only a nonprofit community-based program that is, or is partnered with, a governmental agency is eligible to report to ODMAP. These ODMAP procedures also recommend that any partnership be limited to nonprofit community-based programs that receive funding for treatment, recovery, or harm-reduction services.

Additional information, discussion, and references are available here.