Ethics, Confidentiality, and Ethics, Confidentiality, and HIPAA!HIPAA!

Legal Issues Legal Issues in Problem-Solving Courtsin Problem-Solving Courts

Louisiana Drug Court Conference Louisiana Drug Court Conference

New OrleansNew Orleans

February 22, 2006February 22, 2006

Confidentiality/PrivacyConfidentiality/Privacy

42 CFR Part 2 – The alcohol and substance 42 CFR Part 2 – The alcohol and substance abuse treatment confidentiality rule.abuse treatment confidentiality rule.

HIPAA – New federal rules covering all health HIPAA – New federal rules covering all health related information.related information.

42 U.S. Code 290dd42 U.S. Code 290dd42 CFR Part 242 CFR Part 2

First issued 1975, revised 1987First issued 1975, revised 1987

Designed to help deal with the stigma of Designed to help deal with the stigma of addiction.addiction.

Requires notification of confidentiality, Requires notification of confidentiality, consent forms, prohibition of redisclosureconsent forms, prohibition of redisclosure

““I’m sorry I cannot acknowledge whether I’m sorry I cannot acknowledge whether someone is or isn’t in our treatment someone is or isn’t in our treatment program”.program”.

What 42 CFR Covers:What 42 CFR Covers:

““Any program or activity relating to Any program or activity relating to substance abuse education, prevention, substance abuse education, prevention, training, treatment, rehabilitation or training, treatment, rehabilitation or research which is directly or indirectly research which is directly or indirectly assisted by any department or agency of assisted by any department or agency of the United States.”the United States.”

HIPAAHIPAA

HHealth ealth IInsurance nsurance PPortability and ortability and AAccountability ccountability AAct of 1996ct of 199645 CFR Parts 160 and 164, Subparts A and E45 CFR Parts 160 and 164, Subparts A and EDesigned to ensure maintenance of health Designed to ensure maintenance of health insurance coverage when you change jobs.insurance coverage when you change jobs.Administrative simplification – Healthcare Administrative simplification – Healthcare processes becoming very complex – look to processes becoming very complex – look to standardize information – make it easier.standardize information – make it easier.Protect confidentiality and security of patient Protect confidentiality and security of patient informationinformation

Privacy StandardsPrivacy Standards

Places restrictions on the use and/or Places restrictions on the use and/or disclosure of “Protected Health Information” disclosure of “Protected Health Information” –PHI–PHI

Effective 4/14/03Effective 4/14/03

Essentially applies “42 CFR p.2-like” Essentially applies “42 CFR p.2-like” requirements to all health care.requirements to all health care.

Protected Health Information (PHI) Protected Health Information (PHI)

Any health information:Any health information:– Oral , paper, or electronicOral , paper, or electronicIncluding identifying demographic informationIncluding identifying demographic information

Relating toRelating to: : – Physical or mental health (Physical or mental health (treatmenttreatment) of individual,) of individual,– Provision of health care to an individual (Provision of health care to an individual (operationsoperations) ) – PaymentPayment for provision of health care to individual for provision of health care to individual

Security StandardsSecurity Standards

Security of information against non-approved Security of information against non-approved accessaccess

Electronic creation, transmission, and storage of Electronic creation, transmission, and storage of information a significant concern – hackersinformation a significant concern – hackers

Requirements for logging of access, automatic Requirements for logging of access, automatic log offs, encryption of information sent by log offs, encryption of information sent by internet.internet.

Regulations take effect in 4/05Regulations take effect in 4/05

Minimum Necessary StandardMinimum Necessary Standard

When using/disclosing PHI, only the When using/disclosing PHI, only the minimum necessary information should be minimum necessary information should be shared.shared.The disclosure should cover only the The disclosure should cover only the authorized informationauthorized informationIndividuals, family, visitors, etc. who do not Individuals, family, visitors, etc. who do not have a need to know PHI should not have have a need to know PHI should not have access to it.access to it.

Is your Problem-Solving Court a Is your Problem-Solving Court a HIPAA Covered Entity?HIPAA Covered Entity?

http://www.cms.hhs.gov/hipaa/hipaa2/suphttp://www.cms.hhs.gov/hipaa/hipaa2/support/tools/decisionsupport/default.aspport/tools/decisionsupport/default.asp

HIPAA v. 42 CFR Part 2HIPAA v. 42 CFR Part 2

The laws cover a lot of the same material.The laws cover a lot of the same material.

Some points of difference – more specific Some points of difference – more specific or more recent rule usually applies.or more recent rule usually applies.

For the CD Treatment providers, in most For the CD Treatment providers, in most cases the rules of 42 CFR Part 2 are more cases the rules of 42 CFR Part 2 are more stringent stringent

In several cases HIPAA wins.In several cases HIPAA wins.

Do These Laws Apply to Do These Laws Apply to Problem-Solving Court Problem-Solving Court

Practitioners?Practitioners?

How Do We Know They Apply?How Do We Know They Apply?

Persons who are protected as Persons who are protected as “Patients”“Patients”

A person is a “patient” if they have sought A person is a “patient” if they have sought or received a treatment programs or received a treatment programs services. services.

If someone fails to appear for an initial If someone fails to appear for an initial appointment, that information is protected appointment, that information is protected because they have “sought” treatment. because they have “sought” treatment.

Defining the Program Defining the Program

1.1. A unit a office of the problem-solving court A unit a office of the problem-solving court itself provide diagnosis, treatment or makes itself provide diagnosis, treatment or makes referrals to CD treatment. referrals to CD treatment.

Is a “Program” under 42 CFR Part 2. Is a “Program” under 42 CFR Part 2.

Is a “Covered Entity” if it transmits PHI Is a “Covered Entity” if it transmits PHI electronically.electronically.

Requires a valid multi-party consent to Requires a valid multi-party consent to disclose information to the problem-solving disclose information to the problem-solving court team.court team.

Defining the Program Defining the Program

2.2. The program is independent of the The program is independent of the problem-solving court. problem-solving court.

Requires valid multiparty consents for re-Requires valid multiparty consents for re-disclosure of information to the problem-disclosure of information to the problem-solving court team.solving court team.

General Rule of DisclosureGeneral Rule of Disclosure

““Treatment Programs may only release Treatment Programs may only release information or records that will directly or information or records that will directly or indirectly identify a problem-solving court indirectly identify a problem-solving court participant as a substance abuser:participant as a substance abuser:– With a knowing and written consent from the With a knowing and written consent from the

participant, ANDparticipant, AND– limited exceptionslimited exceptions

How do You Obtain Written How do You Obtain Written Consent from Your Consent from Your

Participants?Participants?

Elements of a ConsentElements of a Consent

1.1. Name of person or organization that may make the Name of person or organization that may make the disclosure;disclosure;

2.2. Name or title of person (or organization) to whom Name or title of person (or organization) to whom disclosure may be made;disclosure may be made;

3.3. Participant’s name;Participant’s name;4.4. Purpose of the disclosure;Purpose of the disclosure;5.5. How much and what kind of information may be How much and what kind of information may be

disclosed;disclosed;6.6. Participant’s signature;Participant’s signature;7.7. Date on which the consent was signed;Date on which the consent was signed;8.8. Date, event, or condition upon which the consent will Date, event, or condition upon which the consent will

expireexpire(Consent cannot be revoked unless in a civil or juvenile court setting)(Consent cannot be revoked unless in a civil or juvenile court setting)

And under HIPAAAnd under HIPAA

Must be in plain languageMust be in plain languageCan be signed by a personal representative Can be signed by a personal representative (then, must contain a description of the (then, must contain a description of the representative’s authority to act on patient’s representative’s authority to act on patient’s behalf)behalf)Patients must be given copy of written formPatients must be given copy of written formPrograms must keep copy of form for six years Programs must keep copy of form for six years from expiration datefrom expiration dateProgram must ensure that consent complies with Program must ensure that consent complies with applicable requirements of 45 CFR section applicable requirements of 45 CFR section 164.508164.508

ConsentsConsents

A proper consent can authorize all parties A proper consent can authorize all parties involved in the problem-solving court to share involved in the problem-solving court to share information necessary to monitor treatment information necessary to monitor treatment progress and compliance. progress and compliance.

To be effective the consent form should be To be effective the consent form should be signed at the earliest possible time. signed at the earliest possible time.

Judge, coordinator, probation, etc., should get Judge, coordinator, probation, etc., should get consent and fax it to treatment before 1consent and fax it to treatment before 1stst appointment.appointment.

Requiring ConsentsRequiring Consents

HIPAA prohibits a program from HIPAA prohibits a program from conditioning treatment on a patient signing conditioning treatment on a patient signing a consent, a consent, butbut

The judge (problem-solving court) can The judge (problem-solving court) can condition participation in the court program condition participation in the court program on the defendant signing the consent form. on the defendant signing the consent form.

Consent GuidelinesConsent Guidelines

Criminal Justice System (CJS) consentsCriminal Justice System (CJS) consents– Determine whether assessment and treatment Determine whether assessment and treatment

participation is an official condition that the participation is an official condition that the person must meet. person must meet.

– CJS consents have special rules under 42 CJS consents have special rules under 42 CFR part 2 – irrevocable until expiration. CFR part 2 – irrevocable until expiration.

– HIPAA requires all consent be revocable. HIPAA requires all consent be revocable.

Satisfying 42 CFR and HIPAASatisfying 42 CFR and HIPAA

HIPAA requires all consents to be revocable, butHIPAA requires all consents to be revocable, but

HIPAA also allows for the use of an HIPAA also allows for the use of an administrative order for information disclosure. administrative order for information disclosure. Therefore, Therefore,

Programs that provide both substance abuse Programs that provide both substance abuse and mental health treatment services can pair and mental health treatment services can pair their 42 CFR consent with a HIPAA their 42 CFR consent with a HIPAA administrative order and/or build HIPAA administrative order and/or build HIPAA language into their consentlanguage into their consent

Option 1- Court Order & Irrevocable Option 1- Court Order & Irrevocable ConsentConsent

Use of Court Order (court or administrative Use of Court Order (court or administrative body) – Satisfies HIPAAbody) – Satisfies HIPAA– ““Standing order”Standing order”– ““Limited HIPAA Order”Limited HIPAA Order”– Irrevocable consent – 42 CFR Part 2 Irrevocable consent – 42 CFR Part 2

Option 2 – Revocable ConsentsOption 2 – Revocable Consents

““Unlikely” the individual will revoke consent if it Unlikely” the individual will revoke consent if it means they will be in violation of terms of means they will be in violation of terms of sentence.sentence.

Saves Court work – no ordersSaves Court work – no orders

If revoked, programs will have to inform court If revoked, programs will have to inform court that a 42 CFR Part 2 court order is needed.that a 42 CFR Part 2 court order is needed.

Consent needs to describe specifically how Consent needs to describe specifically how disclosed info will be used.disclosed info will be used.

Use and RedisclosureUse and Redisclosure

Under 42 CFR § 2.35, information from a CJS Under 42 CFR § 2.35, information from a CJS release may be redisclosed and used only in release may be redisclosed and used only in connection to their official duties with respect to connection to their official duties with respect to the particular criminal proceeding.the particular criminal proceeding.

The information may not be used in other The information may not be used in other proceedings, for other purposes or with respect proceedings, for other purposes or with respect to other individuals. (42 CFR § 2.12(d)(1))to other individuals. (42 CFR § 2.12(d)(1))

Permitted disclosures -no consentPermitted disclosures -no consent

Medical emergencyMedical emergencyCrimes on the premisesCrimes on the premisesCrimes against staffCrimes against staffAdministration / qualified service programs working Administration / qualified service programs working with treatment facility (must have business with treatment facility (must have business associate agreement under HIPAA—see 67 associate agreement under HIPAA—see 67 Federal Register 53264 for sample contract Federal Register 53264 for sample contract language—published by HHS office for Civil Rights)language—published by HHS office for Civil Rights)Outside auditors, central registries and researchers Outside auditors, central registries and researchers No re-disclosures unless permittedNo re-disclosures unless permittedAll disclosures must be documentedAll disclosures must be documented

Mandatory disclosure -no Mandatory disclosure -no consentconsent

State child abuse lawsState child abuse lawsA valid court order A valid court order State laws relating to cause of deathState laws relating to cause of deathDuty to protect others, to warn of Duty to protect others, to warn of imminent, serious harmimminent, serious harm

Subpoenas v. Court OrdersSubpoenas v. Court Orders

Part 2 allows information to be released by Part 2 allows information to be released by subpoena if patient has signed consent subpoena if patient has signed consent permitting releasepermitting releaseIf no consent, then see 42 CFR Part 2, Subpart If no consent, then see 42 CFR Part 2, Subpart E for procedures the court must follow, findings, E for procedures the court must follow, findings, and limitsand limitsHIPAA allows information release under HIPAA allows information release under subpoena with assurance patient has been subpoena with assurance patient has been given notice (or reasonable efforts made to give given notice (or reasonable efforts made to give notice) with the opportunity to objectnotice) with the opportunity to object

Can a Judge share treatment Can a Judge share treatment information in open court?information in open court?

The Judge may decide that sharing The Judge may decide that sharing information about progress/difficulty in information about progress/difficulty in treatment is a “legitimate part of the court’s treatment is a “legitimate part of the court’s official duties and responsibilities with official duties and responsibilities with respect to the criminal proceedings”.respect to the criminal proceedings”.

Remember the Minimum Necessary Remember the Minimum Necessary Information standard. Information standard.

What if your court clerk answers What if your court clerk answers the telephone, “Good morning. the telephone, “Good morning.

Smith County Drug Court.”Smith County Drug Court.”Is this a violation of the Is this a violation of the

confidentiality laws?confidentiality laws?

HypotheticalHypothetical

Joe and Mary are in your drug court. They have Joe and Mary are in your drug court. They have different primary counselors at different different primary counselors at different agencies. At a pre-staffing meeting of treatment agencies. At a pre-staffing meeting of treatment providers, the counselors share the following providers, the counselors share the following information: Mary’s counselor reports that Mary information: Mary’s counselor reports that Mary is thrilled because she and Joe are going to try is thrilled because she and Joe are going to try to have a baby. Joe’s counselor reports that Joe to have a baby. Joe’s counselor reports that Joe is excited that she and Mary are trying to have a is excited that she and Mary are trying to have a baby, but that although they’ve begun having baby, but that although they’ve begun having unprotected sex, he’s unwilling to share with unprotected sex, he’s unwilling to share with Mary that he’s HIV positive.Mary that he’s HIV positive.

HypotheticalHypothetical

What ethical issues are presented?What ethical issues are presented?

What confidentiality issues are presented?What confidentiality issues are presented?

What difference, if any, would it make if What difference, if any, would it make if the whole team had been given this the whole team had been given this information?information?

What difference, if any, would it make if What difference, if any, would it make if Mary or Joe were underage?Mary or Joe were underage?

Resources Resources

Legal Action Center (Legal Action Center (www.LAC.orgwww.LAC.org))– Confidentiality and Communication (2003)Confidentiality and Communication (2003)– Of Substance –Of Substance – newsletter newsletter

www.hipaadvisory.comwww.hipaadvisory.com