Client Advocacy: What to do When Your Client’s HIV Confidentiality or Testing Rights Have Been Violated 2013
2 Who’s the Legal Action Center? Anti-Discrimination & Privacy work: People with criminal records, alcohol/drug histories, and/or HIV/AIDS Legal services & litigation Advice to providers Trainings Policy advocacy & research
3 Free Legal Services Including – HIV testing & confidentiality Discrimination based on: HIV status Alcohol/drug history Criminal record – Rap sheet review and error correction Certificates of Relief and Good Conduct Job & Housing Discrimination
4 How to get help? Call the Legal Action Center 212-243-1313 800-223-4044 (toll-free) Clients: Ask for “paralegal on call” Providers: Ask for “attorney on call” Monday – Friday, 1 to 5 pm
5 This training has 3 parts: Part 1: Review of the Basics: Fundamentals of New York’s HIV Testing and Confidentiality Law Assumes you’ve received overview before Part 2: Client Advocacy: HIV Confidentiality or Testing Rights Violated by a Different Agency Part 3: Client Advocacy: HIV Confidentiality or Testing Rights Violated by Your Agency
6 Hand-outs PowerPoint Flow chart on NYS HIV confidentiality law HIV/AIDS Testing, Confidentiality & Discrimination: What You Need to Know About New York Law Two DOH “Technical Assistance” bulletins on 2011 release forms – DOH 2557 & 5032 DOH materials about Art. 27F changes Sample Complaint narratives All are available at http://lac.org/index.php/lac/149#advocacyhttp://lac.org/index.php/lac/149#advocacy More about Article 27-F amendments of 2010: http://www.health.ny.gov/diseases/aids/testing
7 Part 1: Review of HIV Confidentiality & Testing Basics
9 Relevant Laws Major Laws governing confidentiality of health information – and HIV related information: Federal Law: HIPAA (Health Insurance Portability & Accountability Act) New York Law: NYS Public Health Law, Article 27-F
10 HIPAA – what is it? (cont.) Federal law that establishes minimum safeguards to protect the privacy of medical records and other “personal health information” (“PHI”). Applies to personal health information no matter how it is shared: in electronic, written or oral form.
11 HIPAA: Who is covered? Covered Entities Are: Health Plans Health Care Clearinghouses Health Care Providers IF they transmit personal health information electronically in order to process payment or make eligibility determinations.
12 Article 27-F – what is it? New York State law that governs: HIV testing HIV confidentiality HIV reporting HIV partner notification Also note related provisions about HIV case reporting in Pub. Health Law §§ 2130-2139
13 Article 27-F Who is covered? 1.ANY person or agency who receives HIV-related information about a protected individual: while providing a covered “health or social service” Examples: health care professionals and health facilities, foster care agencies, school nurses, OR
14 Article 27-F Who is covered (cont.)? 2. Anyone who receives HIV information pursuant to a proper written release. This means – if you obtain a client’s HIV information pursuant to his or her signed HIV release form, you must follow Article 27-F. if you disclose a client’s HIV information pursuant to an HIV release form, the person/agency receiving it must follow Article 27-F too. OR
15 Article 27-F Who is covered (cont.)? 3.ANY New York state or local governmental agency that: provides, supervises or monitors health or social services Examples: DOH, OASAS, OTDA, DOCCS, HRA, DSS
16 Article 27-F Does NOT apply to: Protected individuals themselves Friends, relatives Courts Insurers Pharmacies Federal agencies (military, federal prisons) Schools (except medical staff) Employers
17 Article 27-F Does NOT apply to (cont.) : BUT other laws may protect confidentiality. Examples: U.S. Constitutional right to privacy – applies to government Americans with Disabilities Act – applies to employers Privacy Act – applies to federal government
18 HIPAA & Article 27-F: Who must comply with both? Most health care providers in New York State, assuming they transmit health information electronically for purposes of billing or reimbursement.
19 What happens if both HIPAA & Art. 27-F apply? HIPAA pre-empts “contrary” state law except if state law is “more stringent” than HIPAA – provides greater privacy protection or gives individuals more rights. Article 27-F is usually more protective (“stringent”), so you must follow Article 27-F.
20 General Confidentiality Rule HIPAA & Art. 27-F generally both prohibit the disclosure of health information about an individual. HIPAA: covers nearly all personal health information (which it calls “protected health information”) Article 27-F: covers only “HIV-related information.”
21 Article 27-F: The general rule (cont.) NO DISCLOSURE: A provider may not disclose any – HIV-related information obtained while providing health or social service or through a release.
22 Article 27-F: The general rule (cont.) “HIV-related information” includes – Had an HIV test (whether positive or negative) Has HIV infection, HIV related illness or AIDS Has been treated/is being treated for HIV Takes medication specific to HIV disease Is a “contact” of someone with HIV (spouse, sexual or needle-sharing partner)
23 Article 27-F: HIV Related Information i ncludes: Case study/Poll: In the Waiting Room
Article 27-F: The general rule (cont.) Case Study – waiting room John & other patients sitting in clinic waiting room. Clinician enters: “John, please come for your HIV test results.” Did clinician disclose protected HIV- related information? 1.Yes 2.No 24
25 Article 27-F: HIV Related Information includes (cont): Correct Answer: #1 – Yes. “HIV-related information” includes: Had HIV test – even if results not disclosed.
“Exceptions” to the General Rule: When Disclosure is Permitted Despite general non-disclosure rule: Both HIPAA & Article 27-F have “exceptions” that permit sharing HIV information. Main Article 27-F “exceptions” are outlined in Article 27-F flow chart (see slide below, and hand-out). 26
28 Main Article 27-F exceptions permitting disclosure Exceptions covered by this presentation: Written Release Disclosures to health care providers Note: Follow Article 27-F rules governing these exceptions, since it is more “stringent” – provides greater protections – than HIPAA.
Exception #1: Written Release Any and all confidential HIV related information can be disclosed with (proper) written release. Use DOH-approved release (complies with Article 27-F & HIPAA) OR Form that’s consistent with it. DOH forms are in hand-outs (more on that later) In writing. No oral release! Voluntary. 29
Written release (cont.) Signature – Do not ask client to sign blank or partially completed form. Who signs form? “Protected individual” if has “capacity to consent”: 1.Understand and appreciate nature and consequences of proposed disclosure and 2.Make an informed decision. 30
31 Approved Release Forms Authorization for Release of Health Information and Confidential HIV Related Information – DOH 2557 (in handouts) & DOH 2775ES (Spanish – on DOH website), rev’d 2/11 Authorization for Release of Health Information (Including Alcohol/Drug Treatment and Mental Health Information) and Confidential HIV/AIDS Related Information – DOH 5032 (in handouts) & 5032es (Spanish – on DOH website), rev’d 4/11
32 Helpful DOH Guidances on Release Forms DOH wrote “Technical Assistance Bulletins” with FAQs In Hand-outs Forms & bulletins available at http://www.health.state.ny.us/diseases/aids/forms/ http://www.health.state.ny.us/diseases/aids/forms/ informedconsent.htm
33 Article 27-F No Redisclosure Remember: Person receiving HIV related information pursuant to release may not redisclose Person providing HIV related information pursuant to consent usually must provide notice prohibiting redisclosure Sample Notice Prohibiting Redisclosure is in hand-outs
34 Article 27-F No Redisclosure (cont.) For confidential drug/alcohol patient- identifying information, a Notice Prohibiting Redisclosure is also required Sample forms: OASAS website www.oasas.state.ny.us/mis/forms
Article 27-F Written Release Case study/Poll: Release requirements (3 questions) 35
Article 27-F Releases – Case Study POLL (a) Sam works at case management program. Helping client get HIV housing through a City agency. Sam calls client: “OK to disclose your HIV status to the City agency today? You can sign a release when you come in next week.” Is Sam complying with Article 27-F? 36
Article 27-F Releases – Case studies (cont.) Possible Answers: 1.Yes 2.No 37
Article 27-F Releases – Case studies (cont.) Correct Answer: #2 – No Oral authorization to release information never sufficient under Art. 27-F. Specific HIV release form required before disclosure. Back to poll: prior knowledge 38
Article 27-F Releases – Case Study POLL (b) What if the client said, the agency already knows my HIV status. It is fine to discuss it with them. Does that allow Sam to discuss the client’s HIV with the agency? 1.Yes, as long as the agency mentions it first. 2.No, a written release is still required. 39
Article 27-F Releases – Case studies (cont.) Correct Answer: #2 – No Even if the other party already knows a person’s HIV status, a reference to the person’s HIV status counts as a “disclosure.” Specific HIV release form still required before disclosure. Back to poll: email / fax 40
Article 27-F Releases – Case studies (cont.) Poll (c) Could Sam have faxed or emailed client a form to sign and send back by fax or email? 1.Yes, if agency policies permit it. 2.No – never. 41
Article 27-F Releases – Case studies (cont.) Correct Answer – #1 Yes, if… Legally, faxed or scanned copy of release form is permitted. Agencies may set own policies. If permit emailing/faxing HIV information, set protocols to avoid accidental breach of confidentiality. 42
43 Exception #2: Disclosures to Health Care Providers Case scenario/poll. Referral to medical specialist
Exception #2: Disclosures to Health Care Providers Case Study – Referral to Specialist Jan has seen primary care doctor since HIV diagnosis three years ago. Primary care doctor now plans to refer her to a specialist. Does doctor’s office need HIV release form to disclose Jan’s HIV status to specialist? 44
45 Exception #2: Disclosures to Other Health Care Providers Possible answers: 1.Yes 2.No
46 Exception #2: Disclosures to Other Health Care Providers Correct answer: #2 – No. May disclose HIV related information to a health care provider when it is necessary to provide appropriate care or treatment to: 1.The individual 2.His or her child OR 3.A contact (spouse, sex or needle-sharing partner).
Disclosures to Health Care Providers (cont.) Answer (cont.). Here – Knowing Jan’s HIV status is necessary for specialist to give her appropriate care. Some agency policies require written release anyway – consider it good practice. DOH advises CBOs to always seek release for HIV disclosures to health care providers. Find out your agency’s policy. 47
48 Exception #2: Disclosures to Other Health Care Providers (cont.) Document the disclosure. Do not need notice prohibiting redisclosure.
Disclosures to Health Care Providers (cont.) Twist on the same case study/poll: Post-diagnosis referral for follow-up care 49
Disclosures to Health Care Providers (cont.) Poll Jan’s primary care doctor just made initial HIV diagnosis Arranging for follow-up medical care with another health care provider, as required by Art. 27-F Needs written release for the referral? 1.Yes 2.No 50
Disclosures to Health Care Providers (cont.) Correct answer: #2 – need oral consent No written release needed. BUT do need oral consent. 51
52 Other Exceptions Other exceptions include: 1.Internal Disclosures 2.Physicians’ Disclosures about Minors 3.Case reporting 4.Partner notification 5.Foster care & adoption 6.3 rd party payers 7.People convicted/charged w/sex offenses
54 Article 27-F – HIV Testing: Mandatory Offer DOH materials in your hand- outs for Q&A and guidance on Art 27-F amendments of 2010 Also available at http://www.health.state.ny.us/diseases/aid s/testing/hiv_testing_law.htm http://www.health.state.ny.us/diseases/aid s/testing/hiv_testing_law.htm HIV Testing, Confidentiality and Discrimination in New York
55 Article 27-F – HIV Testing: Mandatory Offer Mandatory HIV test offer (since Sept. 2010) : Health care providers in many settings must offer HIV test to patients aged 13-64 (or younger/older if evidence of risk activity), including: Providers of health services in inpatient or E.R. of hospital Primary care providers offering primary care svc in hospital outpatient dept or a diagnostic & treatment ctr, and …
56 Article 27-F – HIV Testing: Mandatory Offer Mandatory HIV test offer (cont.) : Physicians, physician assts, nurse practitioners, and midwives providing primary care in any setting. BUT not required to offer test if patient: Treated for life threatening emergency Previously been offered/subject of HIV test, unless another test is indicated Lacks capacity to consent.
57 Article 27-F – HIV Testing: Informed consent No HIV testing without voluntary, informed, HIV-specific CONSENT By the person who has capacity to consent to the HIV test.
58 Article 27-F – HIV Testing: Informed consent (cont.) Consent must be written, except oral consent OK for rapid HIV testing. But do need written consent for rapid testing in correctional facilities. Oral consent (rapid testing) must be documented in medical record by person ordering test.
59 Article 27-F – HIV Testing: Informed consent (cont.) When written consent is required, it may be either: On a general consent to medical care IF there’s space by signature to opt out of HIV test OR On HIV-specific consent to test form.
60 Art. 27-F - HIV testing Capacity to consent Similar to “capacity” standard for disclosures: Regardless of age, 1. Able to understand & appreciate the nature & consequences of HIV test AND 2. Able to make an informed decision
61 Art. 27-F - HIV testing Capacity to consent (cont.) Case study/poll: No capacity to consent to HIV test.
Art. 27-F - HIV testing Capacity to consent (cont.) Poll – no capacity to consent to HIV test Jon, age 25, is comatose in hospital. Doctors think he has AIDS but Jon lacks capacity to consent to HIV test. Doesn’t have a health care proxy & court hasn’t appointed guardian. May Jon’s partner legally consent to an HIV test for Jon? 1.Yes 2.No 62
63 Art. 27-F - HIV testing Capacity to consent (cont.) Correct answer: #1 – yes Generally, persons authorized by law to make health care decisions could be any of: Parent of minor Court-appointed guardian Health care proxy Surrogate under Family Health Care Decisions Act
64 Art. 27-F - HIV testing Capacity to consent (cont.) If no proxy or guardian, Family Health Care Decisions Act permits “surrogate” decision maker to make health care decisions in hospital/nursing home: Spouse/domestic partner, adult child, parent, sibling, or close friend, or If none, the physician, in consultation with other staff.
65 Art. 27-F - HIV testing Capacity to consent (cont.) Surrogate has authority to make all health care decisions – not just HIV testing, but also treatment. So John’s spouse or domestic partner can authorize the HIV test.
66 Art. 27-F - HIV testing Capacity to consent (cont.) More helpful information in: Fact Sheet: Family Health Care Decisions Act & HIV/AIDS http://www.health.ny.gov/diseases/aids/regulations/fhcda/ai_fact_sheet.htm
67 Article 27-F e xceptions: HIV testing without consent HIV testing without consent is allowed in limited circumstances, mainly: Newborns People with sex offense convictions/charges, upon victim’s request (court must order).
68 Part 2: CLIENT ADVOCACY HIV Confidentiality or Testing Rights Violated by a Different agency
70 Client Advocacy – Confidentiality Breach by Different Agency Let’s hear from you – poll: Any of your clients or patients ever complain that someone in a different agency breached their HIV confidentiality or testing rights? 1.Yes 2.No
71 Client Advocacy – Confidentiality Breach by Different Agency Let’s hear from you -- Poll: What did you do? 1.Referred the client to Dept. of Health? 2.Referred the client to a lawyer? 3.Both 1 and 2? 4.Other/None of the above
72 Client Advocacy – Confidentiality Breach by Different Agency Case scenario: Michael’s Pre-Employment Exam
73 Client Advocacy – Confidentiality Breach by Different Agency You are Michael’s case worker. Michael got a new job. Michael is very upset one day because his new boss said, “I hope you’re feeling OK. I just saw your pre-employment medical report, and it said that you have HIV.” Michael did not sign a release for this disclosure – and even told doctor not to disclose. He asks you what he can do. What should you do?
74 Client Advocacy – Confidentiality Breach by Different Agency (cont.) In general, most of you are not lawyers and shouldn’t be the ultimate judge of whether the disclosure was illegal. Don’t tell client: disclosure definitely did or did not violate the law. But could say that you think the disclosure may have violated the law.
75 Client Advocacy – Confidentiality Breach by Different Agency (cont.) First – Did the doctor violate Michael’s HIV confidentiality rights? Yes. Disclosures to employers are never permitted without HIV-specific, written release. Even true if HIV status relevant to Michael’s ability to do his job. Still need release.
76 Client Advocacy – Confidentiality Breach by Different Agency (cont.) So what do you do next? Options – more on each, later: 1.Counsel client. 2.Do informal advocacy yourself, 3.Refer Michael to attorneys. 4.Refer Michael to an oversight agency.
77 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 1.Counsel your client. Do encourage your client to explore options and rights. These include: Informal advocacy Referral to attorney Complaints to oversight agencies.
78 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 1.Counsel your client (cont.). Do not say definitely – whether disclosure violated the law. Do not give false hopes of millions of dollars in lawsuit awards.
79 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 2. Informal advocacy with alleged breacher: Help client file complaint with the entity that breached his confidentiality (supervisors, director, legal counsel) Ask for copies of all release forms Michael signed. Demand a thorough investigation.
80 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 3. Referrals to attorneys. Instead of or in addition to doing informal advocacy yourself Attorneys will evaluate legality of disclosure & counsel client about options. Referral: Legal Action Center, and see www.lawhelp.org. www.lawhelp.org
81 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 4.Refer client to an oversight agency “Administrative remedy” Here are the options….
82 Administrative remedies: Article 27-F – DOH Process File complaint with DOH. If complaint is against a hospital, file with the Centralized Hospital Intake Program Complaint form available at http://www.health.ny.gov/forms/doh-4299.pdf http://www.health.ny.gov/forms/doh-4299.pdf (800) 804-5447 If complaint is against any other provider, file with AIDS Institute, Special Investigation Unit (SIU) Complaint form available at: http://www.health.state.ny.us/forms/doh-2865.pdf http://www.health.state.ny.us/forms/doh-2865.pdf (800) 962-5065
83 Administrative remedies: Article 27-F – DOH Process Testing: First – file complaint with entity that did test without consent (or proper counseling). THEN File complaint: Johanne Morne NYS Dept of Health, AIDS Institute Corning Tower, Room 485 Albany, NY 12237 (518) 473-2907
84 Administrative remedies: Article 27-F – DOH Process (cont.) What will DOH do with it? Confidentiality breach: Might refer it to agency overseeing or employing “breacher” – eg, HRA, DOH Home Care Bureaus, DOCCS. HIV testing complaint: Might also refer it to DOH agency overseeing medical professionals/health care facilities, or Office of Professions overseeing other licensed professionals (e.g., nurses).
85 Administrative remedies: Article 27-F – DOH Process (cont.) $5,000 civil fine criminal penalty if willful Usual remedy = “statement of deficiencies” requiring corrective action
86 Administrative remedies: Article 27-F – DOH Process (cont.) May ask attorney, legal service provider like Legal Action Center to represent client in this proceeding But don’t need a lawyer
87 Administrative remedies: Article 27-F – DOH Process (cont.) Advocating for your client at the DOH Help write the complaint Include details about what happened Support your conclusion; e.g., don’t assume that because someone learned your client’s status, the breacher had to be X Sample Complaint Narratives – HIV confidentiality; HIV testing (in hand-outs)
88 Administrative remedies: Article 27-F – DOH Process (cont.) Monitor progress of complaint If don’t get resolution, keep calling! Speed and thoroughness of investigations may vary by agency No pre-set timeframes
89 Administrative remedies: Article 27-F – DOH Process (cont.) Appeal: May appeal within 60 days of mailing of the finding But client likely will not be advised of right to appeal
90 Administrative remedies: Article 27-F – DOH Process (cont.) Value of the DOH process: Client may feel vindicated; got “justice”; voice was heard Corrective action may prevent further breaches or HIV testing violations Do not need a lawyer Usually much faster than a lawsuit
91 Administrative remedies: Article 27-F – DOH Process (cont.) Downside to DOH process: Depending on which agency reviews case: may take a long time may not do thorough investigation corrective action may not satisfy your client Process & correspondence may be unclear No money for client Fines & criminal penalties virtually never imposed
92 Administrative remedies: HIPAA violations Individuals may file complaint with HHS/Office of Civil Rights (OCR) – within 180 days Sample complaint form is http://www.hhs.gov/ocr/privacy/hipaa/ complaints/index.html http://www.hhs.gov/ocr/privacy/hipaa/ OCR (toll-free): 800-368-1019
Administrative remedies: HIPAA violations Penalties: Civil & criminal fines Often impose “corrective action” 93
94 Administrative Remedies: Professional Licensing Rules Article 27-F and HIPAA violations also might violate State laws/rules governing the professions
95 Administrative Remedies: Professional Licensing Rules Physicians Complaints may be filed with Office of Professional Medical Conduct complaint form: call or download 800-663-6114 or email@example.com firstname.lastname@example.org
96 Administrative Remedies: Professional Licensing Rules Other licensed professionals For example, social workers, nurses, pharmacists Complaints may be filed with the NYS Education Dept., Office of the Professions 800-442-8106 OR http://www.op.nysed.gov/opd/complain.htm
97 Lawsuits May sue in court for violations of Article 27-F confidentiality & HIV testing provisions Generally need a lawyer May not sue for HIPAA violations.
98 Lawsuits (cont.) Damages include: Emotional harm Did the word spread to others? Ostracism? Depression? Isolation? Anger? Lost sleep or appetite? Employment consequences; Lost wages
99 Lawsuits (cont.) Damages also include: Physical harm: Affected ability/willingness to stay in health care? Stress-related complications? Other out-of-pocket losses Punitive damages (sometimes)
100 Lawsuits (cont.) Don’t give client unrealistic expectation of easy money Downside to lawsuits: Can take many years Hard to find free legal counsel Have to relive the trauma through testimony and continuous contact with attorney
101 Lawsuits (cont.) Downside to lawsuits (cont’d): Adversarial model can make clients even angrier, as wrongdoer may defend position Client’s emotional life & personal behavior & HIV status will be on display and subject to probing
102 Lawsuits (cont.) Advantages of lawsuits: Might win or get good settlement Victory/good settlement might feel like “justice” Publicity/legal precedent may help educate others about issues and individuals’ rights and legal protections
103 Part 3: CLIENT ADVOCACY HIV Confidentiality or Testing Rights Violated by Your Agency
104 CLIENT ADVOCACY Case scenario/poll: Rita’s home health aide You’re a supervisor in a home care agency. Rita calls to complain: neighbor said he learned Rita’s HIV status from her home health aide. Rita wants a different aide and demands that her old aide be fired. What should you do?
105 CLIENT ADVOCACY Case scenario/poll: Rita’s home health aide 1.Tell Rita she shouldn’t have disclosed her HIV status to her home health aide if she didn’t want her neighbors to learn it. 2.Fire the home health aide immediately. 3.Follow your agency’s grievance procedures.
106 CLIENT ADVOCACY Correct answer: #3 – Follow your agency’s grievance procedure. Make sure your agency’s grievance procedure complies with HIPAA.
107 HIPAA requires covered entities to: 1.Provide patient complaint process. concerning HIPAA policies and procedures. 2.Establish sanctions for violations of privacy policies. 3.Designate a staff member to receive complaints. (Can be privacy official.) 4.Document all complaints & their disposition. Responding to Complaints – Your Agency
108 Responding to Complaints – Your Agency (cont’d) Suggestion: Acknowledge importance of confidentiality Don’t belittle client’s complaint Inform client – complaint procedure Don’t give client the “run around”
109 Responding to Complaints – Your Agency (cont’d) Conduct thorough investigation Talk to witnesses Look at documentation Get client’s feedback
110 Responding to Complaints – Your Agency (cont’d) After investigation & conclusion: Retrain staff/remind them of policies – even if no violation occurred Deliver conclusion to client respectfully
111 Responding to Complaints – Your Agency (cont’d) If violation is verified: Apologize Take disciplinary action against individual who violated the law Update agency policies, if necessary, to prevent further violations Train staff about policies Inform client – corrective actions taken
112 Responding to Complaints – Your Agency (cont’d) Good practice to understand the harm: May believe “everyone” knows status; life will never be the same Severe emotional harm – depression, anxiety, paranoia Anger Ostracism and even physical harm Reliving trauma of diagnosis
113 Responding to Complaints – Your Agency (cont’d) Understand what client might want: vindication; acknowledgment that someone hurt them policy change & training: “this shouldn’t happen to anyone else” money
114 Call on us for help! Legal services for people affected by HIV/AIDS – statewide! Training on HIV-related legal issues for HIV service providers – statewide! Hot-line and technical assistance on HIV-related legal issues – statewide! Legal Action Center: 212-243-1313 or 800-223-4044
Thank you! Thank you. And thanks to the AIDS Institute, New York State Department of Health. 115