Yes, CARES requires the use of a patient’s name and date of birth in order to link the EMS and hospital record. Hospitals are not required to give CARES the patient identifiers as this information is already included in the EMS record. Once a record is determined to be complete by CARES staff, the record is de-identified, or ’scrubbed’, of patient name and DOB.

CARES was approved and considered exempt from further review by the Emory University IRB. CARES is considered to be a quality improvement/assurance program conducted by a covered entity and is thus considered "healthcare operations." Therefore, CARES is not subject to Privacy Rule requirements for research activities or patient authorization. In general, the Privacy Rule permits the use or disclosure of patient information for a registry if the registries are supporting public health activities and/or registries developed for health care operations of health care providers, such as QA/QI. For more information, please see the letter from the CDC and the Memorandum of Understanding between Emory/CARES and the CDC on the CARES website.

Each participating hospital has access to their data and only their data. Therefore, hospitals do not have the ability to view data from other area hospitals. The CARES software has a detailed automated hospital report and the ability to export data for all CARES patients that have been transported to your facility into Excel. Other than the hospital contact(s) at your facility, the only other people who can access the data are system administrators at the participating EMS agency, CARES staff and the state coordinator (if the state is a CARES participant). In addition, Integrated Health Systems can request permission to establish a multiple hospital user CARES account allowing for centralized data access and institutional level reporting.