Training Roadmap What are the ethical issues we face as providers? What are the confidentiality issues we face as providers? How does integrated care affect client confidentiality? How do HIPAA, 42 CFR-part 2, and state confidentiality policies influence practice?
Changing Landscape of SUD Tx. ACA and other regulations are moving SUD Tx. toward more coordinated and integrated care. SUD tx. will be delivered in a variety of different settings, including mental health and PC facilities. One perceived barrier to care integration = the laws/policies that govern SUD, MH and PC treatment differ (42 CFR vs. HIPAA) This may affect how providers share information with others who may be involved with client care. Integrated care entities will require access to SUD info to provide best care.
Discussion: What are some examples of ethical issue in a substance abuse program that you have experienced? Witnessed?
Ethics Ethics codes = laws that guide professionals in helping clients in a fair, respectable, objective, and humane way Personal values guide moral conduct appropriate for work settings Understanding the connection between law and ethics and feeling a responsibility to integrate both appropriately
Ethics Ethical behavior requires a familiarity with laws, and the profession’s philosophy and code of ethics. Sensitivity to the moral dimensions of counseling and your personal principles Understanding your agencies policies and procedures for client services (conflict of interest, referrals, chain of command, roles, responsibilities)
Professional Boundaries The emotional and physical line that gives our clients space to focus on themselves - not on us. The limits that control the professional’s power so that clients are not hurt. The parameters that keep the professional as objective as possible.
Professional Boundaries Provider’s responsibility to maintain professional boundaries: Set proper limits Maintain a treatment focus Be aware of thoughts/feelings generated by the client, or about the client Seek supervision – know what to do with these feelings.
What Type of Relationship? Social/Friendship Business/Bartering Gift-giving Romantic/Sexual
Handling clients who want a different type of relationship Set firm limits Explain why you are setting the limits Try not to be rejecting as you set clear limits
Sexual Relationships: Legal and Ethical Issues Illegal in all 50 states to ever engage in any form of sexual contact with a client Sexual contact can include: intercourse, oral sex, fondling, any other kind of sexual touching, nudity, kissing, spanking, verbal suggestions, innuendoes, or advances. Considered exploitation by healthcare professional Damage to Client’s mental health Loss of trust in helping professions Loss of objectivity to provide appropriate tx. Client focus is on counselor rather than his/her tx. New code allows for client-counselor relations 5 years after termination of professional relationship.
THINGS TO CONSIDER? What is your goal in providing the client with information? What will the information mean to the client? Are you sending confusing messages? Are you sure that it is meeting a client need and not a personal need? Is there another way to accomplish your goal without personal disclosure? Are you okay with EVERYONE in the clinic knowing the information?
ACTIVITY: How do you respond? Have you ever been in a gang? Are you married?/Have a boy/girlfriend? Do you have children? Have you ever used drugs? What kind of drugs did you use? Are you in recovery? What part of town do you live in? How old are you? Do you make a lot of money? How much do they pay you here?
Confidentiality Important legal and ethical responsibility Preserving privacy fosters trust and encourages help-seeking behavior. Balance between a patient’s legitimate desire to maintain privacy of sensitive information and permitting the sharing of information that will improve treatment or public health or safety.
Confidentiality in SUD Treatment Involves: HIPAA 42 CFR, part 2 State-based confidentiality policies Additional Protections for HIV infection, DV, genetics, etc Not meant to prevent info-sharing. Federal laws are a baseline; states may adopt more strict regulations. State laws vary widely, presenting challenges for developing unified policy solutions across states Also difficult for technology vendors to develop functionality.
20 Confidentiality in SUD Treatment Questions: How does 42 C.F.R., Part 2 relate to other laws, such as HIPAA and State-specific confidentiality laws? Who has to follow 42 C.F.R., Part 2? What information does it protects? What disclosures are allowable and prohibited by 42 C.F.R., Part 2? By HIPAA What precautions need to be taken when sharing information across agencies?
HIPAA Health Insurance Portability and Accountability Act of 1996 Protects health coverage for workers/families when they change/lose their job. Gives privacy and security of PHI (Protected Health information) Administrative simplification – a way to standardize information sharing within a complex healthcare system. Establishes national standards for electronic health care transactions; sets minimum privacy protections
What is Protected Health Information (PHI)? 2 Components Identifies the client Health Information Any information that is oral, written, electronic, created or received by health care provider, health plan, public health authority, employer, insurer, or others. Relating to past, present or future physical or mental health status, health care, and payment for such services.
42 U.S. Code 290dd 42 CFR Part 2 Regulations governing confidentiality of alcohol and drug abuse patient records First issued 1975, revised 1987 Designed to help deal with the stigma of addiction Imposes restrictions upon disclosure of PHI for clients enrolled in any federally-assisted alcohol and drug abuse program Requires notification of confidentiality, consent forms, prohibition of re-disclosure
26 Confidentiality in Substance Abuse Treatment Settings Confidentiality is necessary because without that guarantee, many individuals with substance abuse problems would be reluctant to participate fully in treatment
What Programs Must Follow 42 C.F.R., Part 2? Individual/Entity which provides alcohol/drug diagnosis, treatment, or referral for treatment; OR An identified unit within a general medical facility which provides alcohol/drug diagnosis, treatment, or referral for treatment; OR Medical personnel or other staff in a general medical care facility whose primary function is the provision of alcohol/drug diagnosis, treatment, or referral for treatment.
Examples of 42 C.F.R., Part 2 Programs Free-standing alcohol/drug treatment programs Student Assistance Programs in a school PCP whose provision of these services is their principal practice Employee Assistance Programs Medical personnel or other staff in a general medical care facility whose primary function is the provision of alcohol/drug diagnosis, treatment, or referral for treatment; or as part of a specific unit within general medical facility identified as providing these services.
Examples of 42 C.F.R., Part 2 Programs ALSO, Must be federally-assisted: Gets federal assistance, even if not for alcohol/drug services; Conducted by federal government; Tax exempt by I.R.S.; Receives Medicaid or Medicare reimbursement; Authorized, licensed, certified or registered by Federal Govt.; Certified as a Medicare provider; Registered with DEA to dispense controlled substances for treatment of SUD, including clinicians with DEA registration who use controlled substances like benzos, methadone, buprenorphine for detox or maintenance.
Case Example Dr. Smith works in a Hospital E.R. Hospital receives federal assistance Patient receives care for a minor injury from a car- accident where s/he was driving and under the influence of alcohol/drugs. Dr. Smith calls specialized alcohol/drug unit to come to the E.R. to Screen patient for substance use issues and, if necessary, conduct a brief intervention. Patient leaves E.R. before specialized team arrives. Is Dr. Smith responsible for adhering to 42 C.F.R., Part 2?
Case Example Correct Answer: NO Dr. Jones works in a General Medical Facility, but not an identified Specialized Unit whose primary function is to provide alcohol/drug abuse diagnosis, treatment, or referral for treatment; 42C.F.R., Part 2 would have applied IF: The Medical Facility’s Primary Function was to provide alcohol / drug services; Patient stayed and received Screening/Assessment by Specialized staff; Patient had received alcohol/drug services from E.R. employee whose Primary Function is the diagnosis or referral for alcohol/drug treatment services.
General Rule of “Disclosures” A Program covered by 42 CFR, part 2 may ONLY release information or records that will directly or indirectly identify a client as a substance abuser or treatment patient: With a knowing and written CONSENT from the participant, AND Other EXCEPTIONS(explained below)
42 C.F.R. Part 2 - Allowable “Disclosures” Written authorization/ Consent Qualified Service Organization Internal communication (“need to know”) No patient-identifying information Medical emergency Audit/evaluation/ research Crimes (or threats of) on program premises or against program personnel Initial reports of suspected child abuse or neglect Court order meeting specifications of 42
34 Allowable Disclosures: Written Authorization/Consent Consent must include: Name of Program making disclosure; Name and title of individual or org. permitted to receive info.; Name of patient; Purpose of disclosure; How much & what kind of info. will be disclosed; Signature of Patient and date of Consent; wet/fax/scan/copy OK Statement of Patient’s Right to Revoke and Rules of Redisclosure Date of Expiration (Governed by State Law - No longer than 1 Yr) Source: 42 CFR §
35 Allowable Disclosures: Written Authorization/Consent Must be in writing (not oral/verbal) Must be current / not expired Even with consent, no info. obtained can be used to criminally investigate or prosecute a patient. Must include Redisclosure notification – notice that program may not redisclose patient info “unless further disclosure is expressly permitted by the written consent of the person.” Sample Consent Forms at: Source: 42 CFR §
36 Allowable Disclosures: Qualified Service Organization (QSO) Definition: An Organization that provides services to a program, such as: data processing; Electronic Medical Records – info exchange Holding/Storing patient data dosage preparation; laboratory analyses bill collecting legal, medical, accounting, or other professional services Source: 42 CFR §
37 Allowable Disclosures: Qualified Service Organization (QSO) A written agreement with a program under which that person: (1) Acknowledges that in receiving, storing, processing or otherwise dealing with any patient records from the programs, it is fully bound by these regulations; and (2) If necessary, will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by these regulations. Source: 42 CFR §
38 Allowable Disclosures: Internal Communications May disclose patient-identifying information without consent within a program IF the recipient needs the info to provide alcohol / drug services. If program is part of a larger multi-service organization, disclosure of info can only be made to personnel involved in records, billing, or direct clinical care of patient. Cannot be shared with program or agency personnel who do not need it in specific connection to their duties. Source: 42 CFR §
39 Allowable Disclosures: No Patient-Identifying Information Ok to disclose info. that does NOT identify a patient in any way. “Identifying” info includes: name, address, SSN, DOB, D/C date, date of death, phone numbers, account numbers, unique identifying characteristics, codes or numbers. Source: 42 CFR § 2.11; HIPAA 39
40 Allowable Disclosures: Medical Emergency Disclosure (and redisclosure) of patient-identifying info is permitted to medical personnel -but not family- if patient is experiencing a medical emergency. Documentation of disclosure must occur immediately afterward: Name of medical personnel and healthcare facility to who disclosure was made; Name of individual making disclosure; date & time Nature of Medical Emergency Source: 42 CFR §
41 Allowable Disclosures: Audit/Evaluation/Research Program can disclose patient-identifying info. without consent: Researchers – But they are prohibited from using it for any other purpose or from redisclosing it except back to the program (data/report must be de-identified). Auditor/Evaluator – May only use info for program audit and eval and redisclose only back to program; govt. agency overseeing Medicare/Medicaid audit; or court during a program (not a patient) investigation. Source: 42 CFR §
42 Allowable Disclosures: Crimes on Program Premises/Against Program Personnel If a crime is committed, or threatened, on program premises or against program personnel, staff may disclose identifying information including: suspect’s name, address, last known whereabouts, and status as a patient in the program. Duty to warn – Governed by State Laws (see below). Source: 42 CFR §
43 Allowable Disclosures: Crimes on Program Premises – What about “Duty to Warn?” “Duty to Warn” refers to an obligation to alert others (e.g. law enforcement) when someone threatens to commit a future crime, or confesses to a past crime. Governed by State Law Tarasoff v. Regents of U. of CA; other states do not require warning (e.g. HI, more permissive). There are ways to warn without violating 42 C.F.R., Part 2 Anonymous or non-patient identifying report Court order (“extremely” serious crime) Source: 42 CFR §
44 Allowable Disclosures: Child/Elder Abuse Reporting of Child Abuse/Neglect and Elder Abuse are governed by State Laws. 42 C.F.R., Part 2 allows for initial report and written confirmation of the report. BUT, does not permit programs to disclose records and patient-identifying information for an on-going investigation, without a Court Order. Source: 42 CFR §
Allowable Disclosures: Court Order A court may issue a special court order authorizing a program disclose patient-identifying info, but must follow special procedures. Before issuing order, court must: Provide notice to patient & program, and provide opportunity for patient/program to make oral or written statement to the court. Must have “good cause” for the disclosure. “Good cause” is defined as: Public interest and need for disclosure outweigh an adverse effect disclosure will have on Patients, Doctor-Patient Relationship, Effectiveness of Program Services. No alternative way of getting the information.
Allowable Disclosures: Court Order Court-ordered disclosures have Limits: Only access to info essential to fulfill purpose of order Must be restricted to persons who need the info for that purpose. Court should take any other steps necessary to protect patient’s confidentiality (e.g., sealing court records). They may NOT authorize disclosure of “confidential communications” by patient to program, unless: Necessary to protect against threat to life or serious bodily injury Necessary to investigate or prosecute extremely serious crime In connection w/proceeding in which patient has already presented evidence re: confidential communications
47 Allowable Disclosures: Court Order OH NO……What do I do? I just received a subpoena Do not ignore! Remember: You may only disclose in response to subpoena if you receive: Patient Consent, or Special Court Order (NOT a subpoena signed by judge) Do NOT release without Special Court Order Read subpoena & all accompanying documents to understand what subpoena is asking program to do Seek advice from attorney Source: 42 CFR §
48 Allowable Disclosures: Court Order You have the right to appear and object Contact patient to see if s/he wants to consent (unless subpoena involves criminal prosecution of patient). If NO Patient consent, inform person who issued subpoena that 42 C.F.R., Part 2 prohibits program from complying, ask them to withdraw subpoena and seek Special Court Order. If unsuccessful and no attorney, appear on appropriate date (subpoena details date, time, and place of hearing), explain 42 C.F.R., Part 2, and request the judge “quash” subpoena. Bring copy of regs. Source: 42 CFR §
49 Allowable Disclosures: Court Order OH NO……What do I do? I just received a Search or Arrest Warrant Do not forcibly resist! Neither type of warrant is sufficient under 42 C.F.R. Pt. 2 to permit or require disclosure – only Special Court Order! Explain that program cannot cooperate without Special Court Order (show officers a copy of the regs) Notify a lawyer Ask to speak to prosecuting attorney or commanding officer and repeat your explanation (stress that illegally seized records will not be admissible in court Try prevention (form relationship w/local police) Source: 42 CFR §
Bottom Line: Confidentiality laws, regulations and policies do not preclude the sharing of information for care coordination, as long as proper written consents are in place. Confidentiality concerns should not stop addiction, mental health or primary care providers from providing quality care to patients. Instead of viewing confidentiality as a barrier, focus on educating clients on info sharing to ensure better quality services and communication between providers.
51 TIPS on Confidentiality and Disclosure The client’s rights and the limits of confidentiality should be explained at the beginning of treatment. Educate patients about informed consent and the importance of information sharing among all of the HC providers at the time of treatment. Respect decision of patients who opt out of info. sharing Information should only be released with the client’s or guardian’s permission; client information should not be communicated outside of the treatment team. Implement use of routine consent forms that include each necessary organization or provider, state/federal regs., signed. Encourage patients to expect communication, collaboration, shared tx. plans and joint decision-making.
PRACTICAL SAFEGUARDS What are some practices you do to ensure that Protected Health Information (PHI) is secured?
PRACTICAL SAFEGUARDS Do not leave papers containing PHI lying around where others can see them At end of workday – clear desk or other exposed areas of PHI and place I secure location (file, cabinet, desk drawer). Do not talk about patient PHI in public areas If you take work home don’t leave it in a place accessible to people not agency employees, keep locked in a briefcase or in car/trunk.
HIPAA vs. 42 C.F.R., Part 2 The laws cover a lot of the same material. Some points of difference – more specific or more recent rule usually applies. For the SUD Treatment providers, in most cases the rules of 42 CFR Part 2 are more stringent In some cases HIPAA is more stringent.
Disclosure for Payment HIPAA PERMITS disclosure without patient consent for the purpose of payments. 42 CFR Part 2 PROHIBITS these disclosures with out patient consent. SUD/AOD providers must follow 42 CFR Part 2.
Re-disclosure of Information HIPAA is silent on this topic. 42 C.F.R., Part 2 requires that a statement prohibiting re- disclosure accompanies the patient information that is disclosed. SUD/AOD providers must follow 42 C.F.R., Part 2.
Disclosures to Other Providers HIPAA allows, but does not require, programs to make disclosures to other healthcare providers without authorization. 42 CFR Part 2 limits this to medical emergencies. SUD/AOD providers must follow 42 C.F.R., Part 2.
Medical Emergencies HIPAA allows health care providers to inform family members of the individual’s location and condition without consent in emergency circumstances or if a person is incapacitated. 42 CFR Part 2 limits this disclosure to medical personnel ONLY. SUD/AOD providers must follow 42 C.F.R., Part 2.
Disclosure to Public Health HIPAA permits disclosure to a public health authority for disease prevention or control, or to a person who may have been exposed to or at risk of spreading a disease or condition. 42 C.F.R., Part 2 prohibits these disclosures unless there is an authorization, court order, or the disclosure is done with out revealing patient information. SUD/AOD providers must follow 42 CFR Part 2; BUT California state laws compel notification.
Right to Access Records HIPAA REQUIRES a covered program to give an individual access to his/her own health information (with few exceptions). 42 CFR Part 2 gives programs DISCRETION to decide whether to permit patients to view or obtain copies of their records, unless they are governed by a state law that gives right to access. SUD/AOD providers must follow HIPAA.
HITECH In 2009, the American Recovery and Reinvestment Act of 2009 (ARRA) was signed into law. Health Information Technology for Economic and Clinical Health Act (HITECH) – was a key part of ARRA. Expanded and changed some regulations to promote the adoption and meaningful use of health information technology. HITECH Act addresses the privacy and security concerns associated with the electronic transmission of health information and electronic medical records.
The role of Health IT HIT enables integrated tx. by linking programs, services and providers HIT can help providers: Communicate and collaborate between providers and programs Track progress of those who leave a program Reduce redundancy between programs and providers Increase delivery of Evidence-based care Extend the efficiency of the workforce. Increased accessibility to health records raises questions of how to ensure pt. confidentiality and trust. Functionality to promote integrated care while protecting privacy and confidentiality.
HITECH HIPAA Privacy, Security, & Enforcement Rules apply directly to business associates (BAs) Expanded definitions of BAs (HIOs, e-Prescribing Gateways, data transmission services), and requirement of Revised agreements – to strengthen privacy. Marketing, Fundraising, & Sale of PHI Stronger patient rights Stronger enforcement & penalties Breach notification Revised Notice of Privacy Practices Revised BA agreements