Lega gal Issues in n Inf nformation n Sharing g Bet etween een - - PowerPoint PPT Presentation

Lega gal Issues in n Inf nformation n Sharing g Bet etween een Beha havioral Health h and nd Cri rimina nal Justi tice ce Syst ystems

John Petrila, J.D., LL.M. Vice President of Adult Policy jpetrila@texasstateofmind.org

Qu Quest stion 1: 1:

Two officers responding to a call find a person threatening to commit suicide or harm his

• mother. One officer calls the local mental

health center and asks if the person is currently a patient at the Center.

Can the Center can give the officer this information Under federal law? T or F Under state law? T or F

2

Qu Quest stion 2 2

Treatment staff from the jail call the local hospital to ask for the name of the medication a recently booked person is taking. Can the hospital can provide this information Under federal law? T or F Under state law? T or F

3

Qu Quest stion 3 3

Your client appears to lack the capacity to make a decision about treatment and a family member is asking you to provide her with detail about the client’s current medication. Can you provide this information? Under federal law? T or F Under state law? T or F

4

To Today

• Some basic facts about federal and state

law including some recent changes especially in light of the Parkland School shooting

• A framework for thinking about data sharing
• Some examples from the future

5

Lif ife e with ithout ac acronym yms is is har ardly w ly worth th liv livin ing…

HIPAA 42 CFR Part 2 HMIS CJIS FERPA State Law

6

Definitiona nal i issu ssues…

• Privacy Act: “personally identifiable information”
• HIPAA: “protected health information”
• FERPA: “personally identifiable information”
• 42 CFR Part 2: “any information…relating to a

patient received or acquired by a federally assisted acohol or drug program”

• HMIS: “protected personal information”
• FL 394.4615: A clinical record shall be maintained

for each patient...

7

Elvis i is s alive and and rai aisi sing HI HIPAA quest stions

• ns….

….

8

Birthday parties in nursing homes in New York and Arizona have been canceled for fear that revealing a resident’s date of birth could be a violation. Patients were assigned code names in doctor’s waiting rooms – say “Zebra” for a child in Newton, Mass.,

• r “Elvis” for an adult in Kansas City, Mo. –

so they could be summoned without identification.

HIP IPAA: Wh What at an and Wh Why?

• Federal regulation

effective 2003

• National standard for

privacy and security of protected health information

• Sets a floor and states

can have stricter laws

• A c

cou

• uple of
• f bi

big i issu ssues:

• Misunderstanding of

the law

• Confusion over when

law applies

• Misplaced fear of

liability

9

How To F Fig igure I e It t All ll Ou Out… t…

10

Doe

• es “

s “the the law” l let t me discl sclose? I It t depend nds…Crea eating a g a fr framework

• Why do you want to share information?
• What type of information do you want to

share?

• Who do you want to share it with?
• Who decides if you will share it?

11

In th thinking abou g about the t these se i issu ssues es…

• Does the law require a particular disclosure
• r prohibit a particular disclosure?
• May I disclose something?
• Should I make the disclosure?

12

Why Do Do You W Wan ant t to Sh Shar are Informati tion?

• Identify a target population?
• Identify geographic areas of greatest impact?
• Evaluate program outcomes?
• Improve services at the point of intervention?
• Data analytics?

13

A Cincinna nati ti E Exam ample

14

What t types of i

• f inf

nfor

• rmation?
• Information that does not identify

individuals?

• Information that does identify individuals?
• Information that might identify a person?
• Health information?
• Housing status?
• Demographics?

15

Wh Who Do Y

• You Want

ant to S

• Shar

hare it W t With th?

• Law enforcement on the street?
• The jail?
• Probation officers?
• A community treatment provider?
• A hospital emergency department?
• A researcher?

16

Se Sequentia ial I l Intercept Mo Model an l and Dat Data a Sh Shar arin ing

17

Blah Blah Blah

Un Under HI HIPAA, C Covered E Entit itie ies Ma May Dis Disclo lose P PHI HI Wit ithout C Consent

A Health Care Provider A Health Plan A Health Care Clearinghouse This includes providers such as:

• Doctors
• Clinics
• Psychologists
• Dentists
• Chiropractors
• Nursing Homes
• Pharmacies

...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. This includes:

• Health insurance

companies

• HMOs
• Company health plans
• Government

programs that pay for health care, such as Medicare, Medicaid, and the military and veterans health care programs This includes entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or

Preempti tion

• HIPAA sets a floor
• A state law more protective of privacy

prevails

• With mental health, state law is generally

more protective

• With substance abuse federal law is

generally more restrictive (42 CFR Part 2)

• With HIV, state law generally will prevail

http://www.hhs.gov/hipaafaq/state/399.html

HIPAA: C : Consen ent i is not requir ired f for dis isclo losures o

• r uses

Necessary to carry out treatment Payment, or Health care operations (administrative, financial, legal, and quality improvement activities of a covered entity necessary to run its business and support the core functions of treatment and payment) http://www.hhs.gov/ocr/privacy/hipaa/understanding/ coveredentities/usesanddisclosuresfortpo.html

Unde der Fl Florida La Law

Consent is not required when a facility administrator “deems release to…an aftercare treatment provider…is necessary for treatment of the patient…(or) aftercare planning (394.4615) Disclosure may be made without consent to “…attending physicians, or other health care practitioners and providers currently involved in the care or treatment of the patient...” (395.3025(4) Confidentiality may be waived “when there is a clear and immediate probability of physical harm to the patient or client, to other individuals, or to society”

21

Som

• me Rece

cent nt 4 42 CFR FR Devel elopm pmen ents

• Disclosure for research expanded
• Patient can now consent to disclosure to providers in

general

• Patient may request list of entities to whom disclosure

made

• Attempting to clarify access for program audit purposes etc.
• https://www.samhsa.gov/newsroom/press-

announcements/201701131200

22

Fl Flor

• rida La

Law C Conf

• nfide

dentiality ty S SA Records

Appropriate disclosure may be made without consent 1. To medical personnel in a medical emergency. 2. To service provider personnel if such personnel need to know the information in

• rder to carry out duties relating to the

provision of services to an individual.

(397.501 (7)(a)(1)(2)

23

Qu Quest stion 1: 1:

Two officers responding to a call find a person threatening to commit suicide or harm his

• mother. One officer calls the local mental

health center and asks if the person is currently a patient at the Center.

Can the Center can give the officer this information Under federal law? T or F Under state law? T or F

24

Intercept t 1: : At P t Point nt o

• f I

f Interventi tion

25

• Officer without MHP present

HIPA PAA: Yes, “to prevent or lessen a serious and imminent threat to health or safety” or under “care and control” of the officer

• Officer with MHP present

Yes, the MHP is a covered entity FL FL La Law: Yes, to prevent harm (officer only)/continuity of care (if MHP present)

Qu Quest stion 2 2

Treatment staff from the jail call the local hospital to ask for the name of the medication a recently booked person is taking. Can the hospital can provide this information Under federal law? T or F Under state law? T or F

26

Intercept t 2: : In th n the Jai ail: M May y Treat atmen ent P t Provide der S Shar hare PHI HI?

27

HIPA PAA, yes if for 1 of 4 purposes:

• Provide healthcare
• Ensure health and safety of

inmates and others

• Protect transporting officer
• Promote law enforcement on

premises

• For safety and security of

correctional facility

• Florid

ida a Law: Yes, continuity of care

Sharing ng I Inf nformati tion w with th Fam amilies es: Qu Quest stion 3 3

Your client appears to lack the capacity to make a decision about treatment and a family member is asking you to provide her with detail about the client’s current medication. Can you provide this information? Under federal law? T or F Under state law? T or F

28

Fl Flor

• rida La

Law ( (394.4 .4615( 5(9)

Nothing in this section is intended to prohibit the parent or next of kin…from requesting and receiving information limited to a summary of that person’s treatment plan and current physical and mental condition. Release…shall be in accordance with the code

• f ethics of the profession involved.

29

From

• m HHS

HHS.G .GOV

“Where a patient is not present or is incapacitated, a health care provider may share the patient’s information with family, friends, or others involved in…care or payment for care... ...as long as the HCP determines, based on professional judgment, that doing so is in the best interests of the patient.”

30

Speci cifically…

“A psychiatrist may discuss the drugs a patient needs to take with the patient’s sister who is present with the patient at a mental health care appointment” Sharing Information Related to Mental Health (HHS.gov, 3/22/2017)

31

HI HIPAA an and Dis Disclo losure: F Fam amilie ilies ( (an and Paymen ent)

• May share information with family members
• r others involved in care or for payment if
• Patient does not object
• Patient lacks ability to object but clinician believes

is in patient’s best interest

• It is an emergency

32

What t May B y Be Discl sclosed ed? E Exampl ples es…

• Drugs a patient needs to take
• Warning signs that may signal a developing

emergency

• But note:
• If patient objects, may not disclose
• Least information necessary is standard

33

Intercept t 3: : The Cou

• urts: No

Not C t Covered d Entiti ties! s!

34

• Courts can compel

production

• Courts can use

waivers of confidentiality or standard language to facilitate continuity of care

The HI HIPAA Se Securit ity R Ris isk A Analy alysis is St Standard

§164.308(a (a)(1 )(1): ): S Security ty M Management t Process ss §164.308(a (a)(1 (1)(i )(ii)(A i)(A) – Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.

Risk sk A Anal nalys ysis

Scope: Potential risks and vulnerabilities to confidentiality, availability and integrity of all e- PHI that you create, receive, maintain or transmit Identify and document potential threats and vulnerabilities Assess current security measures Determine likelihood and potential impact of threat occurrence as well as level of risk Document all of this

http://www.onlinetech.co m/resources/references/ tips-for-passing-a-hipaa- audit

http://www.hhs.gov/ocr/privac acy/ y/hip ipaa/ a/ad adminis istr trati ati ve/secu curityrule/n /nist800 0066 66.pdf pdf

Se Sequentia ial I l Intercept Mo Model an l and Dat Data a Sh Shar arin ing

39

Blah Blah Blah

True or

• r Fal

alse se…. ….

A police officer comes to your facility and asks whether Tex Smith, who is wanted for murder, has ever been a patient. You may disclose this information to the law enforcement officer: True False

40

Permit itted Dis Disclo losure: L Law Enforcem emen ent

For identification and location of suspect, fugitive, missing person or material witness

Name and address Date/place of birth Social security number ABO blood type Type of injury Date and time of treatment Date and time of death (if applicable) Distinguishing physical characteristics DNA, dental bodily fluids not covered

http://www.hhs.gov/hipaafaq/permitted/law/505.html

Fl Flor

• rida La

Law

A hospital can provide identification and location information to a law enforcement

• fficial about an individual listed in the

facility’s directory, if the official asks for the individual by name and the individual has not

• pted out of the directory.

So Source: HIPAA Requirements and Florida Law: Disclosures of PHI for Law Enforcement Purposes. Florida Hospital Association (2016)

42

Fam amily E y Edu ducat cational Rights ts an and d Privacy A Act (FERP ERPA)

• Protects PII from education records
• Permitted disclosures without parental

consent:

“Directory Information” – School Officials – “Studies” – “Audits and Evaluations” – Health and Safety emergencies among others.

43

Expandi ding the the U Use se of E

• f Edu

ducati cational Records s

• These final regulations allow FERPA-permitted entities to

disclose PII from education records without consent to authorized representatives, which may include other state agencies, or to house data in a common state data system, such as a data warehouse administered by a central state authority for the purposes of conducting audits or evaluations of federal- or state-supported education programs

44

The Marjory S y Stone

• neman D

Douglas Hi High h Schoo hool P Public S c Saf afety y Act ct

• Creates a “Risk Protection Order Act” (790.401)
• Creates authorization for a “mobile suspicious

activity reporting tool”(943.082) and threat assessment teams (1006.07)

• Requires the threat assessment team to consult

with law enforcement when a student exhibits a pattern of behavior, based upon previous acts or the severity of an act, that would pose a threat to school safety (1006.13(2)(f)

45

Reporti ting/Confidenti tiality ty

• All

ll care providers for students experiencing

• r at risk of SED or mental illness may share

information to ensure service access or safety

• Any

ny response to immediate crisis is to be reported to the threat assessment team

1006.07(7)(d )(d)( )(e) e)

Text o

• f t

the A e Act c can be e found here re: h : http:/ ://laws. ws.flru lrules.o s.org rg/2018/3

46

Oh Oh Lo Lord, , It’s t’s th the La Lawyers…

47

You

• u just v

st viol

• lated

ed HI HIPAA…No Now W What? hat?

• A new employee in your electronic records

group just sent a clinical file by unencrypted email and the email was hacked

• The client, after receiving notice, hires a

lawyer to sue you

• This lawsuit places you at grave risk:
• True?
• False?

48

No No P Private Cau ause of A

• f Acti

ction…

Under HIPAA (the courts are unanimous) Florida law: Any facility or private mental health practitioner who acts in good faith in releasing information pursuant to this section is not subject to civil or criminal liability for such release (349.4615(7).

49

The Problem em of

• f Menta

tal Illness: I In Da Dallas C Coun unty

• Law enforcement calls with behavioral

health identifier went from 10,319 in 2012 to 12,141 in 2015 (18% increase)

• 17

17% o % of f in inmat ates o

• n a

a giv given d day ha have severe ere behavio vioral h health th needs ds

• Over h

half of

• f these in

individ idual als have been t to

• jail

jail 4+ tim times es b between 2 2011-2014

51

52

May treatment providers share information?

• Yes, they are

covered entities Kn Knitti ting t togeth ther th the e en enti tire sys ystem:

Using g ident entifiable e data at point nt of service e int nter ervent ntions ns

53

Governanc nce: W Whe hen n Creati ting A An MOU OU…

54

The I D S

Agency 1 Agency 2 Agency 3 Agency 4

MO U MOU MO U MOU

DUA DUA DUA DUA Researcher 1 Researcher 2 Researcher 3 Researcher 4

Model 1

Description of Model 1: Under this model, the IDS forms separate MOUS with each agency

• ver time as
• needed. The

IDS forms separate DUAs with each researcher

• ver time as

needed.

Som

• me Li

Links nks for

• r R

Referen ence ce

• https://www.hhs.gov/hipaa/for-professionals/faq (good resource for questions
• n HIPAA maintained by HHS/Office of Civil Rights)
• https://www.hhs.gov/hipaa/for-professionals/faq/disclosures-for-law-

enforcement-purposes (HIPAA and law enforcement)

• https://www.bja.gov/Publications/CSG_CJMH_Info_Sharing.pdf (article by John

Petrila and Hallie Fader—Towe on laws governing information sharing in CJ/MH collaborations

• Florida Hospital Association: HIPAA Requirements and Florida Law: Disclosures
• f PHI for Law Enforcement Purposes
• https://www.hhs.gov/sites/default/files/hipaa-privacy-rule-and-sharing-info-

related-to-mental-health.pdf (guidance on sharing mental health information with families and friends under HIPAA)

• http://laws.flrules.org/2018/3 (text of the Marjory Stoneham Douglas High

School Public Safety Act)

• https://www.aisp.upenn.edu/resources/legal-agreements-and-other-supporting-

documents/ (toolkits for data sharing agreements)

56

The truth is: mental illness affects more people than you may think, and we need to talk about it. It’s Okay to say… ” okaytosay.org