Transcript Your policies & procedures

How to Create and Update Your
Agency’s HIV Confidentiality
Policies & Procedures and
Ensure Staff Compliance
7/20/15
Technical difficulties?
 Call 212-243-1313 and ask for
Vanessa Severino or email her at
[email protected]
OR
 Click on “chat-technical qu’s” box –
right side of your screen
2
Who is Your Trainer?
Sally Friedman, Esq.
Legal Action Center
3
Who is the Legal Action
Center?
 Non-profit law & policy organization
 Anti-discrimination & privacy work
 Substance Use Disorders
 HIV/AIDS
 Criminal Records
 Legal services, litigation, policy, technical
assistance
4
How to get help?
 Website has many resources!
 www.lac.org
 Free publications, free webinars and more
 Call with questions about privacy or
discrimination relating to HIV/AIDS,
substance use disorders, and/or criminal
records – (212) 243-1313
 Refer clients
(see services on next slide)
5
Free Legal Services
Including –
 HIV testing & confidentiality
 Discrimination based on:
 HIV status
 Alcohol/drug history
 Criminal record –
 Rap sheet review and error correction
 Certificates of Relief and Good Conduct
 Job & Housing Discrimination
 You will get a flyer at the end of webinar.
6
Visit LAC on Facebook:
https://www.facebook.com/pages/Legal-Action-Center/117162234980967
And
Twitter: https://twitter.com/lac_news
Background
Why are you here?
8
First, some legal background
 The New York State HIV Confidentiality Law –
Article 27-F of the Public Health Law –
protects the confidentiality of HIV-related
information about people who receive services
from most health care or social services providers
in New York.
 Your agency must comply with Article 27-F’s
confidentiality requirements.
9
Some legal background (cont.)
 Regulations implementing Article 27-F require
providers subject to the law to:
 establish HIV confidentiality policies and
procedures, and review/update at least
annually
 require all staff to understand & follow them,
 ensure – and document – that all employees
receive initial training on HIV confidentiality
before they have access to HIV-related
information.
More….
10
Some legal background (cont.)
 Update staff if changes in law or regulations.
 Per 2012 change in DOH regulations, staff
update only required if change in relevant
law or regulations. But annual updates
make sense to ensure staff compliance.
 April 1, 2014: slight change in the law (more
on that later) -- so updates are required.
11
First, some legal background
 If your someone in your agency violates the
confidentiality law, your agency could be
liable.
 So you’ll want to get and keep your staff
educated about HIV confidentiality requirements.
12
Goals of training
Goals of initiative: help your agency
develop in-house capacity to ensure –
 Your HIV Confidentiality Policies and
Procedures are in place, up to par, and
updated at least annually, AND
 Staff responsible for your organization’s HIV
confidentiality training are ready and able to
accomplish this successfully.
13
This HIV confidentiality capacitybuilding initiative: Target audience
This training is for –
 Program directors, managers, and
supervisors or staff responsible for –
 developing and updating your agency’s HIV
confidentiality policies and procedures,
or
 educating staff about HIV confidentiality.
14
By end of training, you should
be able to . . .
 State the major requirements of the NYS
HIV confidentiality law (and HIPAA, if your
agency must comply with it, too)
 Develop (or update) your agency’s own HIV
Confidentiality Policies and Procedures to
comply with HIV confidentiality law
 and…
15
By end of training, you should
be able to. . . (cont.)
 Conduct annual review and update of your
agency’s HIV Confidentiality Policies and
Procedures;
 Know resources for the initial HIV staff
training;
 Conduct simple, annual reminders for staff
about HIV confidentiality law and policies that
should improve compliance.
16
Training isn’t about ALL
confidentiality laws
 Other laws also protect HIV information,
but this training won’t cover them.
 They include:
 Constitutional right to privacy
 Federal Privacy Act
 HIPAA
 State mental health privacy laws
17
This training is NOT about
HIV testing
 But note change in law as of April 1, 2014:
 No longer need written informed consent for HIV test
except in correctional facilities.
 See DOH hand-outs for more information.
18
Hand-outs
 For this presentation, download “Model HIV
Confidentiality Policies & Procedures,” which
you received by email.
 All hand-outs are available on www.lac.org –
click on: resources–HIV-Confidentiality &
Testing or http://lac.org/resources/hivaids-

resources/confidentiality-testing-resources/ohow-createupdate-agencys-hiv-confidentiality-policies-proceduresensure-staff-compliance-2015/ OR
I will show you how to find them through webinar
platform.
19
Hand-outs (cont.)




This PowerPoint
DOH Dear Colleague Letter 5/2/14
NYS HIV Testing Law Update May 2014
AI Technical Assistance Bulletin – DOH-5032
 More…
20
Hand-outs
(cont.)
 Q&A – DOH-2557
 Technical Assistance Bulletin – HIPAA
Compliant Authorization….. (2005)
 Flow chart
 HIPPA Compliance Checklist
 HIPAA Info Sheet for HIV Providers-NYS
 HIV Confidentiality Case Studies
21
Hand-outs
(cont.)
 HIV/AIDS Testing, Confidentiality &
Discrimination (2012 revision) with 2014
supplement – must have!
22
Other resources
 HIV/AIDS Confidentiality Law
Overview
Free webinar available 24/7 through AIDS
Institute Clinical Education Initiative:
http://www.ceitraining.org/resources/audio-video.cfm
23
Questions/discussion?
 You can ask questions!
 Every 20 minutes or so – question & answer
break.
 Click on “Q&A-content” box, bottom right
 5-minute break at mid-point
24
Step 1
Your Agency’s Policies
& Procedures:
How to Create &
Implement Them
25
Your policies & procedures –
preliminary steps
1. Determine how/when the
confidentiality law applies to your
agency (Model Policies & Procedures, p.3):
 Health and social service provider?
 See App. 3 of Model Policies & Procedures
 If not – have a contract with the AIDS
Institute requiring compliance with Art. 27-F?
26
Your policies & procedures –
preliminary steps
Poll #1
Is your agency:
1. “Health or social service provider” – as defined by
Article 27F
2. Contractor with the AIDS Institute?
3. Both?
4. Neither?
5. Don’t know?
27
Your policies & procedures –
preliminary steps (cont.)
 If not (neither “health or social service
provider” or contract with AIDS Institute) –
 then only requirement to comply with
Art. 27-F is: when receive HIV-related
information through written release.
28
Your policies & procedures –
preliminary steps (cont.)
2. Determine which confidentiality
regulations apply to your agency.
1. Which state agency regulates your agency?
2. Which regulations apply?
1. Example: DOH regulations – Part 63
29
Your policies & procedures –
preliminary steps (cont.)
3. Decide on terminology you will use in
your Polices & Procedures.
1. “Confidential HIV-related information” (Art.
27-F term) or “Personal health information”
(“PHI”) (term AI uses in App. F)
2. “Capacity to consent”
3. Anything else?
30
Your policies & procedures –
requirements
Required Components
1. Training & Updating
2. Internal communications protocols
3. Protocols to safeguard security of
confidential records & information
and……
31
Your policies & procedures –
requirements (cont.)
Required Components (cont.)
4. Protocols for handling requests by
other parties for HIV-related
information
5. Anti-discrimination provisions
We’ll discuss these more later…
32
Your policies & procedures –
content
Suggested components
Introduction:
1.
2.
3.
4.
Purpose
Confidentiality policy
Staff responsible
Definitions
See Model Policies & Procedures, p. 5
33
Your policies & procedures –
content (cont.)
Required Components
1. Training & updating:
 Policies & procedures to educate all staff on –
 New York’s HIV confidentiality law, and
 Your agency-specific HIV confidentiality
policies and procedures.
34
Your policies & procedures –
content (cont.)
1. Training & updating: (cont.)
 Policy must require –
 Annual review and update of
agency’s HIV Confidentiality Policies
and Procedures, and
 Initial employee orientation and
updates when relevant law/reg.
changes
 Designate staff responsible for both.
35
Your policies & procedures –
content (cont.)
1. Training & updating (cont.)
 Maintain list of all employees who have received
such training.
 Include volunteers and peers who have
access to HIV-related information.
 Extent of training will depend on how much
access they have and extent of work they do.
36
Your policies & procedures –
content (cont.)
1. Training & updating (cont.)
 Obtain/update employee attestations:
 Have received this training.
 Have read and will abide by agency’s
HIV Confidentiality Policies and
Procedures.
 See sample attestation – App. 4 of Model
Policies & Protocols
37
Your policies & procedures –
content (cont.)
1. Training & updating (cont.)
 Volunteers and peers should sign
attestations too.
38
Your policies & procedures –
content (cont.)
1. Training & updating
(cont.)
 Inform your agency’s contractors
providing services in which HIV related
information might be disclosed:
 That they must follow the confidentiality
requirements.
More…
39
Your policies & procedures –
content (cont.)
1. Training & updating
(cont.)
 (contractors, cont.)
 Advisable to highlight the requirement
verbally
 Could provide contractor with literature
about Article 27-F
 Document that you have done so.
 Include this in the contract and/or MOU
40
Your policies & procedures –
content (cont.)
1. Training & updating(cont.)
 OPTIONAL:
 Provision – “Educating Clients about HIV
Confidentiality Policy & Rights”
 See Model Policies & Procedures, p.7
41
Your policies & procedures –
content (cont.)
2. Internal communications protocols:
 Develop “need to know” protocol & list.
(See Model Policies & Procedures, App. 5, p.
33):
 Protocol: Limit access to and disclosure of
HIV-related information to authorized
employees who reasonably need access to
perform designated job duties/functions.
Specify any limits on access.
More…..
42
Your policies & procedures –
content (cont.)
2. Internal communications protocols:
 Develop “need to know” protocol & list
(cont.)
 List job titles/functions within those job titles
for which employees are authorized to access
confidential HIV related information: your
“need to know” list.
43
Your policies & procedures –
content (cont.)
2. Internal communications protocols (cont.)
 Distribute “need to know” list to all employees
during employee education sessions.
 Require that only those staff who received such
education may have access to confidential HIVrelated information while performing the
authorized functions specified in your “need to
know” list.
44
Your policies & procedures –
content (cont.)
2. Internal communications protocols
(cont.)
 For agencies only bound by Art. 27-F
because of AIDS Institute contract,
 Add provision about internal release form.
(Model Policies & Procedures, p. 8)
45
Your policies & procedures –
content (cont.)
3. Protocols to safeguard security of
confidential records & information:
 Ensure that records containing confidential
HIV related information, including records
that are stored electronically, are:
 Maintained securely, and
 Used only for the purpose intended.
 See Model Policies & Protocols, p. 9
more…..
46
Your policies & procedures –
content (cont.)
3. Protocols to safeguard security of
confidential records & information:
Specify:



Where written & electronic records should
be stored
Who has access
Practical measures to ensure there is no
unauthorized access
47
Your policies & procedures –
content (cont.)
3. Protocols to safeguard security
of confidential records &
information (cont.):
 Cover “conversations about clients”
See ideas in Model Policies & Procedures, p. 10
 Cover how to contact clients at home. (see
next slide)
48
Your policies & procedures –
content (cont.)
3.
Protocols to safeguard security of
confidential records & information (cont.):
Case scenario/poll #2
 Jane is a social worker at the Help Center
(serves HIV+ clients and others). She calls her
client, Tom, at home. Someone else answers
and says Tom isn’t home.
How can Jane leave a message without
violating Article 27-F?
49
Your policies & procedures –
content (cont.)
3.
Protocols to safeguard security of
confidential records & information (cont.):
Possible answers:
1. Please have Tom call Jane.
2. Please have Tom call Jane at the Help Center.
3. Please tell Tom to call Jane about his HASA
appointment.
4. 1 or 2.
5. None of the above.
50
Your policies & procedures –
content (cont.)
3.
Protocols to safeguard security of
confidential records & information (cont.):
Correct answer: #4: 1 or 2
Disclosing “HASA” appt = disclosure of HIVrelated information. Tom would need to sign
an HIV-specific release form.
OK to mention the “Help Center. Would be
different if Jane worked at the “HIV Help
Center.”
51
Your policies & procedures –
content (cont.)
3.
Protocols to safeguard security of
confidential records & information (cont.):
What does YOUR agency do?
Please submit your responses using the chat
feature.
52
Your policies & procedures –
content (cont.)
3. Protocols to safeguard security
of confidential records &
information (cont.):
 Cover written, electronic (fax & email) & oral
communications, including through mobile
devices and remote access.
 Let’s review ideas in Model Policies &
Procedures, pp. 10-11.
53
Your policies & procedures –
content (cont.)
4.
Protocols for handling requests by other
parties for confidential HIV-related
information.
How do you decide whether you may disclose
HIV information?
 Designate staff person to decide
 Do you have a release?
54
Your policies & procedures –
content (cont.)
4.
Protocols for handling requests by other
parties for confidential HIV-related
information. Cover:
 When you have a release – or can get one
 DOH releases – June 2011.
 Provide “notice prohibiting redisclosure”
(See App. 6, Model Policies & Procedure)
 See Model Policies & Protocols, pp. 13-14
55
Your policies & procedures –
content (cont.)
4. Protocols for handling requests by other
parties for confidential HIV-related
information (cont.). Cover:
 What if there is no release?
 Is there some other authorization under Art.
27-F? (See slides, below.)
 Special procedure for subpoenas:
 Redact HIV information?
 Withhold that part of the record?
56
Your policies & procedures –
content (cont.)
Disclosures without a release –subpoenas
Case scenario/poll #3
 XYZ Service Center received a subpoena for
Tom’s records. They contain HIV information.
 A judge signed the subpoena.
 No release -- and can’t get one.
May XYZ Service Center disclose Tom’s
records?
57
Your policies & procedures –
content (cont.)
Disclosures without a release – to health
care providers
Possible answers:
1. Yes
2. No
58
Disclosures to
Health Care Providers (cont.)
Correct Answer: No
 No. Art 27F requires a special court order.
Subpoena isn’t sufficient unless Tom signed a
release form.
 Options:




Redact or withhold HIV info (and explain)
Explain that confidentiality law prohibits disclosure.
Don’t ever ignore subpoenas.
See pp 12-13.
59
Your policies & procedures –
content (cont.)
Disclosures without a release – to health
care providers
Case scenario/poll #4
 Jan has seen primary care doctor since HIV
diagnosis three years ago.
 Primary care doctor now plans to refer her to
a specialist.
Does doctor’s office need HIV release
form to disclose Jan’s HIV status to
specialist?
60
Your policies & procedures –
content (cont.)
Disclosures without a release – to health
care providers
Possible answers:
1. Yes
2. No
61
Disclosures to
Health Care Providers (cont.)
Correct Answer: No
 May disclose HIV related information –
without release – to outside health care
provider/facility when necessary for that
health care provider/facility to know the HIV
information in order to provide
appropriate care or treatment to:
1.
The protected individual, or
2.
His or her child, or
3.
His or her contact (spouse, sex
or needle-sharing partner).
62
Disclosures to
Health Care Providers (cont.)
Answer (cont.). Here –
 Knowing Jan’s HIV status is necessary for
specialist to give her appropriate care.
 Some agency policies require a written
release anyway in non-emergency situations
because they consider it good practice.
 DOH recommends that CBOs ask for a release.
 See Model Policies & Protocols p. 15
63
Your policies & procedures –
content (cont.)
Case scenario/poll #5
 Sam collapsed on the floor of his case
management office and passed out.
 Case manager calls 911 – EMS shows up.
Asks: what medications is Sam on?
May case manager reveal Sam’s HIV
medications?
64
Your policies & procedures –
content (cont.)
Disclosures without a release – to health
care providers
Possible answers:
1. Yes
2. No
65
Disclosures to
Health Care Providers (cont.)
Correct Answer: Yes
 Same as prior scenarios: may disclose HIV
related information – without release – to
outside health care provider/facility when
necessary for that health care provider/facility
to know the HIV information in order to
provide appropriate care or treatment to:
1.
The protected individual, or
2.
His or her child, or
3.
His or her contact (spouse, sex
or needle-sharing partner).
66
Your policies & procedures –
content (cont.)
Disclosures without a release (cont.)–
Physicians’ disclosures about
Minors & Incompetent Adults:
Applies only if physicians on staff
 See Model Policies & Protocols pp. 15-16
67
Your policies & procedures –
content (cont.)
Disclosures without a release (cont.)–
To “Contacts” (sexual or needlesharing partners) – if agency is not
a mandated case reporter
 Provisions will vary depending on
whether have physician on staff
 See Model Policies & Protocols pp. 17-19
68
Your policies & procedures –
content (cont.)
Disclosures without a release (cont.)–
To public health authorities for
HIV/AIDS case reporting
 Only if agency is mandated HIV case
reporter under Public Health Law Sec.
2130
 See Model Policies & Protocols p. 19
continued….
69
Your policies & procedures –
content (cont.)
Disclosures without a release (cont.)–
CHANGE IN LAW as of 4/1/14:
 DOH may
 use the information for “linkage and
retention in care” and redisclose (NEW)
 Share between local/state health
departments and health care providers
currently treating the patient.
70
Your policies & procedures –
content (cont.)
Disclosures without a release (cont.)–
To oversight authorities for
program monitoring, evaluation, &
review
See Model Policies & Protocols pp. 19-20
71
Your policies & procedures –
content (cont.)
Disclosures without a release (cont.)–
Occupational exposure
 Only include this provision in certain
occupational settings
 Ex: medical or dental offices, emergency
response functions performed, facilities
regulated by various state agencies
 See Model Policies & Protocols p. 20
72
Your policies & procedures –
content (cont.)
Disclosures without a release (cont.)–
Disclosures to insurers for health care
reimbursement
 Only include if your agency is a health
care provider/facility seeking
reimbursement for health care services
from private or public insurers
 See Model Policies & Protocols p. 21
73
Your policies & procedures –
content (cont.)
5. Anti-discrimination provision:
 Policy prohibiting employees, agents,
and contractors from discriminating
against persons having or suspected of
having HIV infection.
 See Model Policies & Protocols p. 22
74
Your policies & procedures –
content (cont.)
Optional: Grievance procedures
 Not required by Art. 27-F, though highly
recommended
 HIPAA does require patient complaint
process
 See Model Policies & Procedures, p. 23
75
Helpful resources for Step 1
Legal Action Center resources:
 Model HIV Confidentiality Policies and
Procedures for Human Service Providers
in New York State –
 Periodically get updated, so check
www.lac.org (resources) each year
76
Helpful resources for Step 1 (cont.)
More LAC resources:
 Hand-outs for this training
 LAC’s website: www.lac.org (click on
Training)
 Call LAC’s HIV Confidentiality Hotline
 212-243-1313 or 800-223-4044
 Ask for the attorney on call
77
Helpful resources for Step 1 (cont.)
 NYS Dept. of Health & AIDS Institute
resources:
 Hand-outs for this training
 DOH/AIDS Institute websites:
www.health.state.ny.us – and go from
there!
 DOH Confidentiality Hotline: 800-962-5065
 Your AIDS Institute contract manager and
other staff.
78
Step 2 – Your Annual Review
So How Do You
Conduct an Annual
Policy Review?
79
How to conduct your annual
policy review
 Review your agency’s existing HIV
Confidentiality Policies & Procedures:
 Identify gaps, needed additions or
changes:
 Elicit input from both new and experienced
staff
 Assess what your on-the-ground experience
has taught you over the past year
More…
80
How to conduct your annual
policy review
 Look to what the future will likely
bring
 Any changes in law? Ask Legal
Action Center or visit AI website.
 Update your policy accordingly
81
How to conduct your annual
policy review (cont.)
 Also update, as needed, your agency’s
 Need-to-know list
 Employee attestation forms
 Other documents required to document your
agency’s continuing compliance with Article
27-F’s HIV confidentiality requirements
82
Step 3: Staff Training
How to Train & Update
Your Staff?
83
Initial Staff Training
Remember: all employees must receive HIV
confidentiality training before get access to
HIV-related information
Options:

Have staff watch 1-hour webinar,
“HIV/AIDS Confidentiality Law Overview”
created by LAC. Available at:
http://www.ceitraining.org/cme/ more…
84
Initial Staff Training
Options (cont.):
 Conduct your own training.


LAC can provide model PowerPoint (similar
to webinar on DOH website).
Use hand-outs from this training.
85
How to provide staff updates
Remember: DOH regulations require
updates whenever there are changes to
relevant laws or regulations.
 Smart practice to provide some type
of annual reminder even if law/regs
haven’t changed.
86
How to provide staff updates
(cont.)
Prepare
1. Seek staff input in advance
 issues to be covered, questions about
existing agency policies & procedures and
the HIV law. The responses will inform the
nature of the training required.
2. Consider type of reminder/update you
need……
87
How to provide staff updates
(cont.)
Option One: simplest
 Send email:
 Highlight key components of HIV confidentiality
policies & procedures & attach them
 Note any changes in policies/procedures or law
 Note any problems/issues that have arisen in
the past year
88
How to provide staff updates (cont.)
Option Two: still simple
 Send email described in Option 1
 Also convene in-person meeting:
 Conduct Review of Agency’s HIV
Confidentiality Policies & Procedures:
1. Key components
2. Changes since last Annual Update
 Opportunity for Qs & As
89
How to provide staff updates (cont.)
Option Three: A little more work
1. Do all Options (1 and 2) activities, PLUS
2. Case studies
 Use LAC’s case studies (in hand-outs)
 Consider creating your own – tailored to
real life scenarios
3. Ask staff for real life examples of HIV
confidentiality issues at work, and discuss
4. Create games and activities.
90
How to provide staff updates (cont.)
Option Four: Thorough Review
1. Do all Options One, Two & Three, PLUS
2. Have a screening of “HIV Confidentiality Law
Overview” webinar on AI Clinical Education
Initiatives website:
http://www.ceitraining.org/cme/
3. Offer staff additional resources and training
materials, including those in your hand-outs
91
Helpful resources for Step 3
 Legal Action Center materials in hand-outs
for this training and noted above (can
download from LAC website: www.lac.org –
click on Resources/HIV/Confidentiality &
Testing/Training materials)
 New York State Department of Health and
AIDS Institute materials for this training
and noted above
92
Q&A
ANY QUESTIONS?
Call 212.243.1313 after the webinar with follow
up questions. Ask for attorney on call.
93
You can do it!
 The Legal Action Center is here to help you
make this capacity-building initiative a
success for everyone.
 Call on our lawyers for continuing support
and technical assistance, day in & day out:
Legal Action Center
Mondays through Fridays, 1pm to 5pm
212-243-1313 or 800-223-4044
94
Remember to send
your clients!
 Free legal services:





HIV & employment
HIV and medical forms – to disclose or not to disclose?
HIV privacy
Substance use and discrimination
Criminal record issues



Rap sheet review and error correction
Certificates of Relief and Good Conduct
Job and housing discrimination
 Flyer will arrive by email shortly!
95
Check Out Our Other
Trainings!!
 Training topics include:




Employment Rights of People with HIV, Viral
Hepatitis & Substance Use Disorders
Overcoming Employment & Housing Barriers for
People with Criminal Records
Legal Issues for an Aging HIV-Positive Population
Legal Rights & Risks of Adolescents in the Age of
AIDS
 Find them on the HIV resource page of LAC’s
website, http://lac.org/resources/hivaidsresources/
96
HOW DID WE DO?
In just a moment, a new window will
pop up with a survey monkey
evaluation.
Please remember we need your feedback in
order for you to receive your certificate.
Thank you!
Did you register?
If you haven’t officially registered with the NYS
Department of Health AIDS Institute,
http://www.hivtrainingny.org/ please DO IT NOW!
Get credit for your attendance!
Contact Vanessa Severino at [email protected]
98
Thank you!
This concludes the webinar.
Thank you.
And thanks to the AIDS Institute, New
York State Department of Health.
99
Keep up with the Legal Action Center by
following us on Facebook, Twitter, &
LinkedIn!
100