Confidentiality and Drug Courts

Caveats

1. I am not a lawyer

2. This is not legal advice

3. Consult your own lawyer

4. Get to know the Legal Action Center (LAC.org)

Confidentiality/Privacy

Several rules apply to participants in Drug treatment courts.

42 CFR Part 2 – The alcohol and substance abuse treatment confidentiality rule. Updated in 2017 and in 2018.

HIPAA – Federal rules covering all health related information.

42 U.S. Code 290dd42 CFR Part 2

• First issued 1975, revised 1987, 2017, 2018

• Designed to help deal with the stigma of addiction.

• Requires notification of confidentiality, consent forms, prohibition of redisclosure

• “I’m sorry I cannot acknowledge whether someone is or isn’t in our treatment program”.

What 42 CFR Covers:

• “Any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation or research which is directly or indirectly assisted by any department or agency of the United States.”

HIPAA

•Health Insurance Portability and Accountability Act of 1996

•Designed to ensure maintenance of health insurance coverage when you change jobs.

•Administrative simplification – Healthcare processes becoming very complex – look to standardize information – make it easier.

•Protect confidentiality and security of patient information

Is your Drug Court a HIPAA Covered Entity?

• http://www.cms.hhs.gov/hipaa/hipaa2/support/tools/decisionsupport/default.asp

HIPAA v. 42 CFR Part 2

• The laws cover a lot of the same material.

• Some points of difference – more specific or more recent rule usually applies.

• For the CD Treatment providers, in most cases the rules of 42 CFR Part 2 are more stringent

• In several cases HIPAA wins.

General Rule of Disclosure

• “Treatment Programs may only release information or records that will directly or indirectly identify a drug court participant as a substance abuser or treatment patient:• With a knowing and written consent from the participant, AND

• Nine limited exceptions

Elements of a Consent

1. Name of person or organization that may make the disclosure;

2. Name or title of person (or organization) to whom disclosure may be made;

3. Participant’s name;

4. Purpose of the disclosure;

5. How much and what kind of information may be disclosed;

6. Participant’s signature;

7. Date on which the consent was signed;

8. Date, event, or condition upon which the consent will expire

(Consent cannot be revoked unless in the juvenile or family court setting)

2017 Definition Changes

•Treating provider relationship means that, regardless of whether there has been an actual in-person encounter:• (1) A patient is, agrees to, or is legally required to be

diagnosed, evaluated, and/or treated, or agrees to accept consultation, for any condition by an individual or entity, and;• (2) The individual or entity undertakes or agrees to

undertake diagnosis, evaluation, and/or treatment of the patient, or consultation with the patient, for any condition.

2017 Definition Changes •A “Lawful Holder” of patient identifying Part 2

information is an individual or entity who has received such information as the result of a Part 2-compliant patient consent (with a prohibition on re-disclosure notice) or as a result of one of Part 2’s exceptions to the consent requirements.

•The Final Rule requires lawful holders of patient identifying Part 2 information to be bound by the requirements of Part 2 (i.e. Redisclosure)

2017 Consent Changes

•Amount and Kind of Information -• The consent form must now explicitly describe the substance use disorder-

related information to be disclosed

• Good = “all of my substance use disorder records”

•Bad = “all of my records”

Non-Treating Provider Releases

• § 2.31(a) (4) (iii) (B)(3) A general designation of an individual or entity participant(s) or class of participants that must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being disclosed.

Treating Provider Relationships

• Yes• SUD Treatment Programs

• Hospitals

• General Practitioners

• Etc.

• No• Drug Courts

• Probation Departments

• Departments of Social Services

• Etc.

Consents

Recipient Form Must Include

Individual Name of Individual

Entity with Treating Provider Relationships

Name of Entity

Third Party Payer Name of Entity

Entity without Treating Provider Relationship

Name of Entity, PLUSName of Individual

Consents

•A proper consent can authorize all parties involved in the drug court to share information necessary to monitor treatment progress and compliance.

•To be effective the consent form should be signed at the earliest possible time.

• Judge, coordinator, probation, etc., should get consent and fax it to treatment before 1st

appointment.

What This Means

•SUD Providers must indicate the name of an individual at a non-treatment entity (Drug Courts, Probation, District Attorney’s Office, etc.)

•That individual is the “lawful holder” of the information.

•Sharing that information with someone else at the entity requires an additional consent.

Requiring Consents

• HIPAA prohibits a program from conditioning treatment on a patient signing a consent, but

• The judge, probation/parole, child welfare can condition participation in the drug court program on the defendant signing the consent form.

Satisfying 42 CFR and HIPAA

• HIPAA requires all consents to be revocable, but

• HIPAA also allows for the use of an administrative order for information disclosure. Therefore,

• Drug courts can pair their 42 CFR consent with a HIPAA administrative order and/or build HIPAA language into their consent

Permitted disclosures -no consent

• Medical emergency

• Crimes on the premises

• Crimes against staff

• Administration / qualified service programs working with drug court

• Outside auditors, central registries and researchers

• No re-disclosures unless permitted

Mandatory disclosure -no consent

•State child abuse laws

•A valid court order

•State laws relating to cause of death

•Duty to protect others, to warn of imminent, serious harm

Changes in 2017/2018

•Entire rule updated to apply to electronic as well as paper exchange of patient identifying information

•Definitions (§ 2.11) – revised/added several definitions, e.g., added “Treating provider relationship”

•Applicability (§ 2.12) – Restrictions apply to information received from “Other lawful holders”

•Confidentiality restrictions and safeguards (§ 2.13) –added List of Disclosures requirement

Changes in 2017/2018

•Medical emergencies (§ 2.51) – Revised consistent with statutory language

•Research (§ 2.52) – E.g., more closely aligned with HIPAA and the Common Rule

•Audit and evaluation (§ 2.53) – Permits audits and evaluations to meet certain CMS requirements

•Clarified processes for Payment of Claims and use of Health Information Exchanges.

Changes in 2017/2018

•Allowed for simpler prohibition of redisclosure statement - “Federal law/42 CFR part 2 prohibits unauthorized disclosure of these records.”

•Part 2 now requires that both Part 2 programs and lawful holders have established formal policies and procedures for the security of both paper and electronic records. (The new security requirements align more closely with those of the HIPAA Security Rule.)

How to Resolve 95% of Confidentiality Issues

•Confidentiality Notice/Participant Handbook has section describing how info is used:• Announced in (open)Court/listed on docket• Discussed in Team Meeting with team members• etc.

• Thorough consents – have participant sign consent for above items

• Always act “as if” everything is confidential.

LAC.org