Transcript 10/13/16 Confidentiality Presentation

ADDRESSING CONFIDENTIALITY AND
DISCLOSURE ISSUES: BEHAVIORAL
HEALTH PROFESSIONALS IN
PRIMARY CARE
Robert P. Landau, Esq.
Roberts, Carroll, Feldstein & Peirce, Inc.
RI POLICY FAVORING PATIENTCENTERED MEDICAL HOME
• RI DOH emphasizes that Patient-Centered Medical Home
should include a family focus, interdisciplinary care, and
the integration of mental health/behavioral health
services in the primary care system
• RI DOH adopted Joint Principles of the Patient-Centered
Medical Home in March 2007 endorsed by American
Academy of Family Physicians, American Academy of
Pediatrics, American College of Physicians and American
Osteopathic Association
2
ISSUES FOR INTEGRATING
BEHAVIORAL HEALTH
• When and what to share behavioral health
information with PCPs, specialists
• Risks/benefits of integrated records
• Confidentiality/Disclosure issues
3
HIPAA
Applies to health care providers and covered entities
• Covered entity means: (1) A health plan. (2) A
health care clearinghouse. (3) A health care
provider who transmits any health information
in electronic form in connection with a
transaction covered by this subchapter
45 CFR Part 160.103
4
HIPAA
• Privacy Rule applies to "protected health information"
(PHI) which includes all "individually identifiable health
information" that is transmitted or maintained in any
format or medium, whether electronic, paper, or oral
• Every health care provider, regardless of size, who
electronically transmits health information in connection
with certain transactions, is a covered entity
• Privacy Rule covers a health care provider whether it
electronically transmits these transactions directly or uses
a billing service or other third party to do so on its behalf
5
HIPAA
“Individually identifiable health information” is information,
including demographic data, that relates to:
– the individual’s past, present or future physical or mental
health or condition,
– the provision of health care to the individual, or
– the past, present, or future payment for the provision of
health care to the individual,
– and that identifies the individual or for which there is a
reasonable basis to believe it can be used to identify the
individual
6
ACCESS TO BEHAVIORAL
HEALTH INFORMATION
• No patient authorization is required for use and disclosure
of PHI to carry out treatment, payment, health care
operations (TPO) under HIPAA
45 CFR Part 164.506(a)
• Can, but not required to, request patient consent to use or
disclose protected health information to carry out TPO
45 CFR Part 164.506(b)
• Minimum necessary disclosure standard does not apply to
TPO
45 CFR 164.502(b), 164.514(d)
7
ACCESS TO BEHAVIORAL
HEALTH INFORMATION
• Minimum necessary standard
Reasonable efforts to limit PHI to the minimum
necessary to accomplish the intended purpose of the
use, disclosure or request
• Exception for psychotherapy notes
45 CFR Part 164.508(a)(2
• Exception for Drug and Alcohol Abuse Programs
42 CFR Part 2
8
PSYCHOTHERAPY NOTES
• Notes recorded (in any medium) by health care provider
who is mental health professional documenting/analyzing
contents of conversation during private counseling session
or group, joint, or family counseling session and are
separated from the rest of the individual's medical record
• Excludes medication prescription/monitoring, counseling
session start/stop times, modalities/frequencies of
treatment, results of clinical tests, any summary of
diagnosis, functional status, treatment plan, symptoms,
prognosis, progress to date
45 CFR Part 164.501
9
PSYCHOTHERAPY NOTES
• Psychotherapy Notes often referred to as process notes
Cf. progress notes, medical record or official records
• Process notes capture therapist's impressions about patient,
contain details of psychotherapy conversation considered
to be inappropriate for medical record and are used by
provider for future sessions
• Often kept separate to limit access, even in an electronic
record system, because they contain sensitive information
relevant to no one other than treating provider
65 FR 82622, 82623
10
PSYCHOTHERAPY NOTES
• A commenter recommended allowing use or disclosure of
psychotherapy notes by members of an integrated health care
facility as well as the originator
• HHS Response/final rule makes it clear that any notes that
are routinely shared with others, whether as part of the
medical record or otherwise, are, by definition, not
psychotherapy notes, as defined, i.e., lose protected status
• To qualify for definition and increased protection, notes must
be created and maintained for use of provider who created
them and must not be only source of any information that
would be critical for treatment of patient or for getting
payment for treatment
11
PSYCHOTHERAPY NOTES
Summary information, such as the current state of the patient,
symptoms, summary of the theme of the psychotherapy
session, diagnoses, medications prescribed, side effects, and
any other information necessary for treatment or payment, is
always placed in the patient’s medical record
12
PSYCHOTHERAPY NOTES
Authorization always required except for:
• Use by originator of psychotherapy notes for treatment
• Use by covered entity for certain training situations
• Use or disclosure to defend against action by individual
• Requests from Secretary of HHS
• Disclosures required by law (e.g., mandatory reporting)
• Health oversight activities of originator
• Disclosures about decedents to coroners and MEs
• To prevent or lessen serious and imminent threat to health
or safety of a person or the public
45 CFR Part 164.508(a)(2)
13
PSYCHOTHERAPY NOTES
• Authorization is required to share with other providers,
including providers who work for the same entity
• Authorization cannot be combined with another
authorization (e.g., sharing other kinds of PHI)
45 CFR Part 164.508(c)(3)(2)
• No access right or obligation to share psychotherapy notes
with the patient or representative, even if disclosing
information would not be harmful to patient's physical,
mental or emotional health
45 CFR Part 164.524(a)(1)(i)
14
WHETHER TO INCLUDE
PSYCHOTHERAPY NOTES IN
INTEGRATED CHART
Pros
Cons
• Stronger protections under HIPAA
• Cannot share with other providers,
even within same entity, without
authorization
• Do not have to disclose to patient
• Requires firewall in EMR if notes
are electronic
• Based on protections, less concern
about chilling effect on
documentation
• Management, security and
compliance are more difficult
• Less transparent to patient
• Need clear policies/training on what
information to share
15
PSYCHOTHERAPY NOTES
• Some argue not to create/maintain HIPAA defined
psychotherapy notes
• Ethical rules, standard of care require appropriate
documentation
• If notes are prepared, but are commingled, then they are
not subject to HIPAA exception and can be shared
• But that raises general privacy and documentation issues
16
EMR ISSUES
•
•
•
•
Easier to satisfy separation requirement
Need firewall to limit access
Breaking the Glass issue
Epic Pop Up Warning
– WARNING: Access to Clinical Systems is RESTRICTED. Users
may only access the patients with whom they have direct care
responsibilities. Access to patient data is subject to audit.
Unauthorized access or disclosure of sign-on codes will lead to
disciplinary action up to and including termination of employment
or your medical staff appointment
• Need to know
• Electronic audit
17
SUBSTANCE ABUSE PROGRAM
RECORDS
• 42 CFR Part 2 prohibits federally assisted substance abuse
treatment programs from disclosing without patient’s
consent (elements are not same as HIPAA) information
that “would identify a patient as an alcohol or drug
abuser”
• Does not apply to all healthcare providers that have
substance abuse information
18
SUBSTANCE ABUSE PROGRAM
RECORDS
Restrictions on disclosure apply to any information, whether
or not recorded, which:
• Would identify patient as alcohol or drug abuser either
directly, by reference to other publicly available
information, or through verification of such an
identification by another person; and
• Is drug or alcohol abuse information obtained by a
federally assisted drug/alcohol abuse program for purpose
of treating alcohol or drug abuse, making a diagnosis for
that treatment, or making a referral for that treatment
42 CFR Part 2.12(a)
19
SUBSTANCE ABUSE PROGRAM
RECORDS
Under 42 CFR Part 2.11, a program is:
a) An individual or entity or identified unit of a general
medical facility that “holds itself out itself out as
providing, and provides, alcohol or drug abuse diagnosis,
treatment or referral for treatment,” OR
b) Medical personnel or other staff in general medical
care facility whose primary function is provision of
alcohol or drug abuse diagnosis, treatment or referral for
treatment and who are identified as such providers
This is meant to exclude providers for whom substance abuse
treatment and referrals are incidental to their regular practice
20
SUBSTANCE ABUSE PROGRAM
RECORDS
Does your entity:
• Receive federal assistance
• Include private-pay clinicians who use a controlled
substance (e.g., benzodiazepines, methadone or
buprenorphine) for detoxification or maintenance
treatment of a substance use disorder
• Advertise or characterize your services as substance abuse
treatment or referrals
• Notify other providers that you are available to receive
such referrals
• Have providers who primarily treat such cases
21
SUBSTANCE ABUSE PROGRAM
RECORDS
• Unlike HIPAA, no TPO exception for disclosures without
authorization
• To share without patient consent, need to be program that
shares administration with receiving entity; or have Qualified
Service Organization Agreement (QSOA)— analogous to
BAA
• When substance use disorder unit is component of larger
behavioral health program/general health program, specific
information about patient’s diagnosis, treatment or referral to
treatment can be exchanged without patient consent among
program personnel/administrative who need to know
information
22
SUBSTANCE ABUSE PROGRAM
RECORDS
A QSO is a person or organization that provides services
such as:
• Data processing, bill collecting, dosage preparation,
laboratory analyses
• Legal, medical, accounting or other professional services
• Services to prevent or treat child abuse or neglect,
including training on nutrition and child care and
individual and group therapy
23
SUBSTANCE ABUSE PROGRAM
RECORDS
A QSOA is a written agreement, wherein the QSO
acknowledges:
• By receiving, storing, processing or otherwise dealing
with any patient records from Part 2 program, it is fully
bound by the Part 2 regulations
• If necessary, will resist in judicial proceedings any efforts
to obtain access to patient records, except as permitted by
these regulations
24
SUBSTANCE ABUSE PROGRAM
RECORDS
• Part 2 compliant consent is similar to HIPAA, except it
must have statement that information cannot be redisclosed without consent unless permitted by federal law
• Thus, if you want multiple parties to receive the
information, they must all be named on the consent
HIPAA information can be re-disclosed without consent
• Information you receive from a Part 2 provider also needs
to be segmented because it cannot be re-disclosed
25
OTHER HIPAA EXCEPTIONS,
NO AUTHORIZATION NEEDED
Uses and disclosures for which an authorization or
opportunity to agree or object is not required
• Required by law
• Public health activities
• Disclosures about victims of abuse, neglect or domestic
violence
• Health oversight activities
• Disclosures for judicial and administrative proceedings
• Law enforcement purposes
45 CFR Part§ 164.512
26
OTHER HIPAA EXCEPTIONS,
NO AUTHORIZATION NEEDED
•
•
•
•
Decedents
Cadaveric organ, eye or tissue donation purposes
Research purposes
To avert serious threat to health or safety if covered entity,
in good faith, believes use or disclosure: (i)(A) Is
necessary to prevent or lessen serious and imminent threat
to health or safety of person or public; and (B) Is to person
or persons reasonably able to prevent or lessen threat,
including the target of threat; or (ii) Is necessary for law
enforcement authorities to identify or apprehend an
individual
27
OTHER HIPAA EXCEPTIONS,
NO AUTHORIZATION NEEDED
• Specialized government functions
• Workers' compensation
45 CFR Part§ 164.512
28
RI LAW ON CONFIDENTIALITY
• Generally cannot release health care records to third
parties unless one of 24 exceptions apply where no
consent is required
RIGL § 5-37.3
•
Key exceptions:
(5) Between or among qualified personnel and health care
providers within the health care system for purposes of
coordination of health care services given to the patient
and for purposes of education and training within the
same health care facility
29
RI LAW ON CONFIDENTIALITY
By health care provider to:
• Appropriate law enforcement personnel or to person if
health care provider believes that person or his/her family
is in danger from patient
• Appropriate child protective agencies if patient is minor
child or parent/guardian of child and/or health care
provider believes, after providing health care services to
patient, that child is or has been physically,
psychologically or sexually abused and neglected as
reportable pursuant to section 40-11-3
30
RI LAW ON CONFIDENTIALITY
• Appropriate law enforcement personnel or division of
elderly affairs if the patient is elder person and healthcare
provider believes, after providing healthcare services to
the patient, that elder person is or has been abused
31
RI LAW ON CONFIDENTIALITY
Need to know basis under RIGL 5-37.3-4
(c) Third parties receiving and retaining patient's
confidential health care information must establish at
least the following security procedures:
(1) Limit authorized access to personally identifiable
confidential health care information to person having a
"need to know" that information
32
IMPORTANCE OF
DOCUMENTATION
One position:
Documentation by behavioral health provider in integrated
record should be relatively brief and focused on information
needed by medical provider:
– What is the diagnosis, is it different from what medical provider thought?
– What type of treatment will be provided?
– Is the patient engaged in treatment? If not, what are obstacles and what
should the care team watch out for?
– Is treatment helping? If not, what adjustments might be needed?
– What, if any, treatment or coordination of care is needed from medical
provider?
33
IMPORTANCE OF
DOCUMENTATION
Another position
• Documentation can be self-serving
• The records must contain sufficient information to justify the
course of treatment, including, but not limited to: active
problem and medication lists; patient histories; examination
results; test results; records of drugs prescribed, dispensed, or
administered; and reports of consultations and hospitalizations
– § 11.4, Rules and Regulations for the Licensure and Discipline of
(R5-37-MD/DO)
Physicians
34
IMPORTANCE OF
DOCUMENTATION
• Remember this is the first thing a Plaintiff attorney
reviews to evaluate whether to sue
• Accurate and thorough documentation is effective risk
management
• If something happens to you, do your records facilitate
continuity of care?
• Will displaying your records to a jury help you win or lose
a case?
35
RECOMMENDATIONS
• It is important to inform a new client about the exceptions
to confidentiality at the first session and then have the
client sign a document acknowledging those exceptions
• As appropriate, the provider should review the exceptions
during the sessions
• Revise general patient consent and authorization forms to
incorporate information about the sharing of behavioral
health information among providers and other members of
care team.
• Explain benefits of coordinated care and information
sharing among members of care team
36
RECOMMENDATIONS
• Keep substance abuse treatment records, when generated
by substance abuse treatment facilities and programs that
receive federal assistance, separate
• Substance abuse treatment information in primary care or
other medical settings can be shared like other types of
personal health information in medical record
• Keep psychotherapy notes separate
• Psychotherapy notes rarely need to be shared with rest of
team
37
ISSUES UNIQUE TO INTEGRATED
BEHAVIORAL HEALTH
Relatively few differences between traditional outpatient and
primary care based behavioral health
• Perhaps incentive to minimize documentation
• Need to control/limit access to psychotherapy notes,
certain substance abuse records
• Requires firewall in EMR if notes are electronic
• Management, security and compliance are more difficult
• Need clear policies/training on what information to share
38
HYPOTHETICAL,
MINOR’S RIGHTS
Assume minor is treated by psychologist for drug abuse
issues and minor tells you not to tell parent, but parent
demands access to information
39
HYPOTHETICAL,
MINOR’S RIGHTS
In the event a child refuses permission to contact parents to
seek parental consent and if, in the judgment of a qualified
professional, that contact would not be helpful or would be
deleterious to the child who is voluntarily seeking treatment for
substance abuse or chemical dependency, then non-invasive,
non-custodial treatment services may be provided by a
qualified professional without parental consent; provided,
during the course of treatment, the qualified professional shall
make attempts to obtain permission from the child to obtain
parental consent for and parental involvement in the treatment
services.
RIGL § 14-5-4
40
HYPOTHETICAL, EMERGENCY
Client with suicidal ideation is brought by rescue to inpatient
psychiatric hospital where client is stabilized, discharged, and
referred to integrated primary care facility for follow-up care.
• Client does not want his inpatient provider to disclose
relevant information to LICSW, in part because of client’s
paranoia symptoms
• Client later states he is going to kill his mother and then
himself, but demands that this be kept confidential
because it is privileged
41
DUTY TO PROTECT
• In Rhode Island, the social worker licensing statute
provides an exception to confidentiality “when there is a
clear and present danger to the safety of the patient or
client or to other individuals.”
The NASW Code of
Ethics is incorporated into the statute and regulations as a
ground for discipline
• In Rhode Island, the psychology licensing statute and
regulations incorporate the “ethical principles governing
psychologists and the practice of psychology, as adopted
by the Board” as a ground for discipline
42
DUTY TO PROTECT
Emergency situations
(b) No consent for release or transfer of confidential health
care information shall be required in the following situations:
(1) To a physician, dentist, or other medical personnel who
believes, in good faith, that the information is necessary for
diagnosis or treatment of that individual in a medical or
dental emergency
– R.I.G.L. § 5-37.3-4. Limitations on and permitted disclosures
43
HYPOTHETICAL, HIV
A client at an integrated primary care facility is being treated
by a LICSW for bipolar disorder and heroin addiction and is
HIV+. The social worker learns that client is sexually
involved with another client of the facility who does not
know about the client’s HIV status. The client promises to
practice safe sex and tell the partner about the HIV, but
there’s no evidence that the client will follow through. The
social worker is unsure about her duty to protect the sexual
partner and how to manage of confidential information
related to HIV.
44
HYPOTHETICAL, HIV
(a) In all cases when an individual's HIV test results are
disclosed to a third-party, other than a person involved in
the care and treatment of the individual, and except as
permitted by § 23-6.3-7 (permitted disclosures re:
confidentiality), and permitted by [HIPAA], the person so
disclosing shall make reasonable efforts to inform that
individual in advance of:
(1) The nature and purpose of the disclosure;
(2) The date of disclosure;
(3) The recipient of the disclosed information.
RIGL § 23-6.3-10 [Applies to physicians, CNMs, NPs, Pas]
45
HYPOTHETICAL, HIV
(b) Health care providers may inform third-parties with
whom an HIV infected patient is in close and continuous
exposure related contact, including, but not limited to a
spouse and/or partner, if the nature of the contact, in the
health care providers opinion, poses a clear and present
danger of HIV transmission to the third-party, and if the
physician has reason to believe that the patient, despite
the health care provider's strong encouragement, has not
and will not inform the third-party that they may have
been exposed to HIV.
RIGL § 23-6.3-10
46
HYPOTHETICAL, HIV
(a) It is unlawful for any person to disclose to a third-party the results
of an individual's HIV test without the prior written consent of that
individual, except for:
(1) Laboratory/facility that performs HIV tests shall report test results
to health care provider who requested test and to director
(2) Health care provider shall enter HIV test results in patient's
medical record.
(3) Notification to Director of DCYF
(4) As provided in § 5-37.3, § 40.1-5-26,§§ 23-6.3-10 and 236.3-14 or otherwise permitted by law.
(5) By health care provider to appropriate persons entitled to be
informed about infectious/communicable diseases
RIGL § 23-6.3-7
47
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Any person of the age of sixteen (16) or over or married may
consent to routine emergency medical or surgical care. A
minor parent may consent to treatment of his or her child.
– R.I.G.L. § 23-4.6-1. Consent to medical and surgical care
48
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Abortion
• Unless minor is emancipated, generally need consent of both
minor and one parent to perform abortion unless judicial
proceeding invoked by minor
– R.I.G.L. § 23-4.7-6. Minors - Parental consent - Judicial proceedings
• Emancipation means that minor is free from the custody and
control of minor’s parents and the state before minor’s eighteenth
birthday. There is no emancipation statute in Rhode Island,
however, a Family Court judge may declare in a court order that
minor is capable (mature enough) of emancipated status
49
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Contraception
No Rhode Island statute on point
Per Rhode Island Office of the Child Advocate, minor’s right
to privacy outweighs parent’s right to consent to
contraceptives
AAP and AMA advocates encouraging minor to involve
parents
50
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Custody
Be aware of who has legal custody of minor
Have parents sign forms indicating that parent has legal
authority to consent to medical treatment
51
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Child abuse
(b) No consent for release or transfer of confidential health care
information shall be required in the following situations:
(4) By a health care provider to appropriate law enforcement
personnel, or to a person if the health care provider believes that
person or his or her family is in danger from a patient; …or to
appropriate law enforcement personnel or appropriate child protective
agencies if the patient is a minor child or the parent or guardian of
said child and/or the health care provider believes, after providing
health care services to the patient, that the child is or has been
physically, psychologically or sexually abused and neglected as
reportable pursuant to § 40-11-3;
–
R.I.G.L. § 5-37.3-4
52
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Any person who has reasonable cause to know or suspect
that any child has been abused or neglected as defined in §
40-11-2 or has been a victim of sexual abuse by another child
shall, within twenty-four (24) hours, transfer that information
to the department of children, youth and families or its agent
who shall cause the report to be investigated immediately
– R.I.G.L. § 40-11-3(a)
53
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Treatment of minor for chemical dependency
In the event a child refuses permission to contact parents to seek
parental consent and if, in the judgment of a qualified professional,
that contact would not be helpful or would be deleterious to the child
who is voluntarily seeking treatment for substance abuse or chemical
dependency, then non-invasive, non-custodial treatment services may
be provided by a qualified professional without parental consent;
provided, during the course of treatment, the qualified professional
shall make attempts to obtain permission from the child to obtain
parental consent for and parental involvement in the treatment
services.
– R.I.G.L. § 14-5-4
54
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
Voluntary treatment of alcoholics
(a) An alcoholic may apply for voluntary treatment
directly to an approved public treatment facility. If the
proposed patient is a minor or an incompetent person, he or
she, a parent, a legal guardian, or other legal representative
may make the application.
– R.I.G.L. § 23-1.10-9
55
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
STD/STI testing, examination
• Persons under eighteen (18) years of age may give legal consent
for testing, examination, and/or treatment for any reportable
communicable disease. R.I.G.L. § 23-8-1.1
• Persons under eighteen (18) years of age may give legal consent
for examination and treatment for any sexually transmitted
disease.
• For the purposes of this section, physical examination and
treatment by a licensed physician or his or her designated
representative upon the person of a minor who has given consent
shall not constitute an assault or an assault and battery upon the
person. R.I.G.L. § 23-11-11
56
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
HIV test results
(a) In all cases when an individual's HIV test results are
disclosed to a third-party … the person so disclosing shall
make reasonable efforts to inform that individual in advance
of:
(1) The nature and purpose of the disclosure;
(2) The date of disclosure;
(3) The recipient of the disclosed information.
57
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
(b) Health care providers [defined as MD, PA, NP, CNM]
may inform third-parties with whom an HIV infected patient
is in close and continuous exposure related contact,
including, but not limited to a spouse and/or partner, if the
nature of the contact, in the health care providers opinion,
poses a clear and present danger of HIV transmission to the
third-party, and if the physician has reason to believe that the
patient, despite the health care provider's strong
encouragement, has not and will not inform the third-party
that they may have been exposed to HIV.
R.I.G.L. § 23-6.3-10
58
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
• When the individual's physical or mental condition is of an
imminent and serious danger to the physical or mental
health of another person
(4) By a health care provider to appropriate law
enforcement personnel, or to a person if the health care
provider believes that person or his or her family is in
danger from a patient;
– R.I.G.L. § 5-37.3-4 (b)
59
SPECIAL
CONFIDENTIALITY/CONSENT
ISSUES
(1) Any physician, who after examining a person, has reason
to believe that the person is in need of immediate care and
treatment, and is one whose continued unsupervised presence
in the community would create an imminent likelihood of
serious harm by reason of mental disability, may apply at a
facility for the emergency certification of the person thereto.
RI Mental Health Law, Emergency certification, § 40.1-5-7
60
THANK YOU FOR YOUR
ATTENTION
Robert P. Landau, Esq.
61