Legal, Ethical and Structural Aspects of Data Sharing - AISP Frameworks and Relevant Laws - Overview

Sep 12, 2026

Legal, ethical, and structural considerations for data sharing are examined through the AISP framework and applicable law. The agenda covers interim report recommendations, quality components for integrated data systems, and legal considerations for data integration, including authority, governance, technical capacity, and impact. Specific attention is given to legal agreements such as MOUs, DSAs, DULs, and consent, alongside key statutes and regulations including FERPA, HIPAA, 42 CFR Part 2, and Florida medical records, plus Florida’s Digital Bill of Rights.

LanguageEnglish

CategoryLetters

FormatPDF

Pages13

Reading Time5 min

AccessFree to download

Agenda

Interim Report Recommendations

Quality Framework for Integrated Data Systems (AISP)

Legal Considerations for Data Integration

Legal Agreements and Consent

Relevant Federal and State Laws

FERPA

HIPAA

42 CFR Part 2

Florida Medical Records

Florida Data Collaboratives

Florida Digital Bill of Rights

Legal, Ethical and Structural Aspects of Data Sharing: AISP Frameworks and Relevant Laws Paul G. Stiles, J. D., Ph. D. Department of Mental Health Law & Policy [stiles@usf.edu](stiles@usf.edu) Florida Commission on Mental Health and Substance Abuse Meeting Data Subcommittee--April 10, 2024 Agenda • Review of interim Report Recommendations • Quality Framework for Integrated Data Systems • Legal Considerations for Data Integration • Authority and Structure • Legal Agreements • MOUs, DSAs, DULs and Consent • Relevant Federal and State Laws • FERPA • HIPAA • 42 CFR Part 2 • Florida Medical Record laws • Florida Data Collaboratives • Florida Digital Bill of Rights (goes into effect July 1, 2024) • Resource Links Florida Commission on Mental Health and Substance Abuse Meeting Data Subcommittee--April 10, 2024 Interim Report “Data” Recommendations • Establish a Data Analysis Workgroup • Secure administrative authority and commitment from stakeholders and state agencies (DCF, AHCA, etc) • Determine structure of repository (centralized, federated, etc) as well as policies and protocols for data standardization, security, access and resources • Implement a pilot • Identify and evaluate areas of necessary improvement Florida Commission on Mental Health and Substance Abuse Meeting Data Subcommittee--April 10, 2024 Quality Framework for Integrated Data Systems (AISP) Five key components of quality that set successful efforts apart: 1. Governance 2. Legal 3. Technical 4. Capacity 5. Impact [https://aisp.upenn.edu/wp](https://aisp.upenn.edu/wp) content/uploads/2021/11/Final AISP QualityFramework 11.5.21.pdf Florida Commission on Mental Health and Substance Abuse Meeting Data Subcommittee--April 10, 2024 Legal Considerations for Data Integration • Authority and Structure • Technology, Policies and Staff (training/education) • Legal Agreements (documents for relationships) • MOUs • DSAs • DULs • Consent Guidance and templates: [https://aisp.upenn.edu/wp](https://aisp.upenn.edu/wp) content/uploads/2022/06/AISP Finding-A-Way Forward Final 6.16.2022.pdf Florida Commission on Mental Health and Substance Abuse Meeting Data Subcommittee--April 10, 2024 Legal Considerations for Data Integration • Relevant Federal and State Laws • FERPA • HIPAA • 42 CFR Part 2 • Florida Medical Record laws • Florida Data Collaboratives • Florida Digital Bill of Rights (in effect July 1, 2024) Florida Commission on Mental Health and Substance Abuse Meeting Data Subcommittee--April 10, 2024 FERPA • Protects the confidentiality of education data • Generally need consent to disclose, but there are 3 broad exceptions: • Perform an institutional service or function that an employee would otherwise perform • To audit or evaluate a federal or state education program • To conduct a study to develop, validate or administer tests, aid programs or improve instruction • If deidentified or just Directory Information– also can share/integrate. Note--Because researchers often had difficulty accessing records protected by FERPA, the U.S. DOE promulgated a rule intended to expand access for research making clear that “these final regulations allow FERPA-permitted entities to disclose PII from education records without consent to authorized representatives, which may include other state agencies, or to house data in a common state data system, such as a data warehouse administered by a central state authority for the purposes of conducting audits or evaluations of federal-or state-supported education programs.” Fed Register, 2011, 76(NO.232, p75637 • FERPA Flowchart: [https://aisp.upenn.edu/wp-content/uploads/2023/05/FERPA](https://aisp.upenn.edu/wp-content/uploads/2023/05/FERPA)Flowchart.pdf Florida Commission on Mental Health and Substance Abuse Meeting Data Subcommittee--April 10, 2024 HIPAA • Protects against inappropriate disclosure of private

FAQs

What are the five key quality components in the AISP framework for integrated data systems?

They are Governance, Legal, Technical, Capacity, and Impact.

How does FERPA generally handle disclosure of education data, and what exceptions allow sharing?

FERPA generally requires consent to disclose, but allows disclosures under broad exceptions such as conducting institutional functions, auditing/evaluating education programs, and studies developing or administering tests and aid programs; deidentified data and directory information may also be shared.

What does HIPAA protect and what major pathways can permit disclosure of health information?

HIPAA protects against inappropriate disclosure of private healthcare data by covered entities. Disclosure typically requires authorization, but exceptions include public health activities, health oversight, and uses for treatment, payment, and operations, as well as research with an IRB waiver and sharing of deidentified data; it also allows a limited data set and business associate relationships.

Sep 12, 2026

Upload by Stanford