1. 6.04 The Interaction Between 42 CFR Part 2 and HIPAA Privacy
Janelle Wesloh BA, LADC
Director of RMIS & Privacy Operations
Hazelden Foundation Center City, MN

2. Background… NOT a Lawyer Counseling background
Electronic Medical Record Design/SA
Corporate Privacy Office
Assessment/Gap Analysis
Training
Monitoring
If need legal advice, this is not it! Consulted with legal throughout
14 years in field, most with non-profit CD
Designed and administrated EMR
Did assess and gap with no combined tools

3. Hazelden Foundation Since 1949 3 MN Facilities Chicago, IL
Center City, Plymouth,
St. Paul
Chicago, IL
New York, NY
Newberg, OR
5 States and WI (Regulations of WI for Insurance Purposes, must be certified by WI)

4. Hazelden
Hazelden provides men, women, and teens with treatment for alcoholism and addiction.
Hazelden’s programs and publications are grounded in 12 Step philosophy for lifelong recovery.
Hazelden pioneered the model of care for drug addiction and alcoholism treatment that is now used around the world.

5. 2004 Statistics Patients Served: 4,611
Publishing: Products Sold = 3,158,791
Education:
22 Master of Arts Graduates
5 Certificate in Addiction Counseling Graduates
244 Professionals in Residence
Research: 18 clinical research projects and papers
Volunteer Support:
Over 140 volunteers donated more than 11,000 hours of service
Employees: 1,020

6. Hazelden Center City Campus

7. Goals Brief review of Federal Drug & Alcohol Confidentiality law
Examples where the two rules do not agree
Examples of how Hazelden complies with both rules
Outcomes
Resources

8. Federal Drug and Alcohol Confidentiality Regulations
Two laws enacted in the early 1970’s (one for alcohol, one for drugs)
Guarantee strict confidentiality of information about persons receiving alcohol and drug prevention and treatment services
Regulations implementing the statues were issued in 1975
Amended in 1987: Mandated abuse reporting
Consolidated the statutes in 1992 (42 U.S.C 290-2), the regulations were not changed (42 CFR Part 2)
DHHS issued and responsible for interpreting 42
1986 amendment to remove restrictions on programs’ compliance with state laws mandating the reporting of child abuse and neglect
Legal Citation is 42 USC 290-2
Regulation is 42 CFR Part 2

9. Applicability
Any information (including referral and intake) about alcohol and drug abuse patients obtained by a program
Includes (not limited to):
Treatment or rehab programs
EAP
Programs within a general hospital
School-based programs
Private practitioners who provide alcohol or drug abuse diagnosis, treatment or referral
Federal assistance: receives federal funds in any form (even if not directly paid for the drug/alc services) OR assisted by IRS through tax exempt status OR allowance of tax deductions for contributions, OR authorized to conduct business by the federal Gov't (Medicare provider, methadone or chemotherapy tx) or conducted directly by Fed Gov’t,
VA and armed forces have separate rule

10. Intent of 42 CFR Part 2
Insure that an alcohol or drug abuse patient is not made more vulnerable by reason of the availability of his or her patient record than an individual who has an alcohol or drug problem and who does not seek treatment

11. More about 42 CFR Part 2
Regulations PROHIBIT the disclosure and use of patient records, with a few exceptions.
Disclosure MAY occur if an exception exists but it does not REQUIRE the disclosure (except with a court order).

12. 42 CFR Part 2 Allowable Disclosures
Written authorization
Internal communication (“need to know”)
No patient-identifying information
Medical emergency
Qualified Service Organization
Audit and evaluation
Crimes (or threats of) on program premises or against program personnel
Initial reports of suspected child abuse or neglect
Court order meeting specifications of 42
Research
Consent vs Authorization (we use Authorization as Consent has several meanings)
Each have its own specific and significant and sometime complicated requirements and limitations. Certain conditions must be met and certain procedures followed. Consulation with the Privacy Officer, Program director or Legal advice is recommended. HIPAA allows more, but 42 overrides (strictly prohibited). Communications with in a program or between a program and an entity having direct administrative control over that program
Research: can’t be re-disclosed, have a reviewed protocol, no identifying pt info in any report other than back to the program

13. More interesting 42 CFR Part 2 facts
Applies even if the person seeking the information already has it or has other ways to obtain it
Applies to law enforcement or other official, even with a subpoena
Disclosing even the presence of a patient at a facility or unit which is identified as a place where only drug/alcohol services are provided requires written authorization

14. Of Interest
The memories and impressions of program staff are considered “records” protected by the regulations even if they are never recorded in any form.
A payer or funding source that maintains records of a recipient of drug/alcohol treatment becomes subject to 42 CFR Part 2 to the same extent as the program from which the information came.
Includes Managed Care entities.
Can’t redisclose

15. The Challenge
Hazelden is covered by two federal laws and six states’ laws.
Some differences
Some inconsistencies
Need to understand both
How they interact
How to comply

16. Which “wins”? Generally, the more recently enacted, HOWEVER:
Not if earlier law has a more narrow, precise, or specific subject
Not if later law addresses an issue on which an earlier law was silent

17. Continued…
Many HIPAA provisions PERMIT something but don’t mandate it.
42 CFR Part 2 PROHIBITS all disclosures unless specifically allowed by the regulation.

18. Examples of “rule conflict”

19. Disclosure for Payment
HIPAA PERMITS disclosure with out patient consent for the purpose of payments.
42 CFR Part 2 PROHIBITS these disclosures with out patient consent.
CD providers must follow 42 CFR Part 2.

20. Patient Rights & Administrative Requirements
HIPAA imposes several new administrative requirements and establishes new patient rights.
These are not included in 42 CFR Part 2.
CD providers must follow HIPAA.
Admin req include training, privacy officer, safeguards, compliant system, sanctions, track and document disclosures with an accting when requested, procedures for min nec

21. Personal Representatives
HIPAA permits a “personal representative” (e.g. power of attorney) to sign consent forms on behalf of the patient.
42 CFR Part 2 limits those who may act in the place of the patient to individuals who have been legally appointed the patients’ guardian.
CD providers must follow 42 CFR Part 2.
Exception is if program director determines the medical condition prevents “knowing or effective action on his or her own behalf”, the prog dir may authorize disclosures without pt consent for the sole purpose of obtaining payment for services from a 3rd party payor

22. Re-disclosure of Information
HIPAA is silent on this topic.
42 CFR Part 2 requires that a statement prohibiting re-disclosure accompanies the patient information that is disclosed.
CD providers must follow 42 CFR Part 2.
Prohibition is clear and strict.

23. Disclosures to Other Providers
HIPAA allows, but does not require, programs to make disclosures to other healthcare providers without authorization.
42 CFR Part 2 limits this to medical emergencies.
CD providers must follow 42 CFR Part 2.

24. Medical Emergencies
HIPAA allows health care providers to inform family members of the individual’s location and condition without consent in emergency circumstances or if a person is incapacitated.
42 CFR Part 2 limits this disclosure to medical personnel ONLY.
CD providers must follow 42 CFR Part 2.
CD providers need a release to contact family members in medical emergencies
Disc for med emergencies must be documented the recipient of the information, who disclosed, date/time and nature of emergency

25. Disclosure to Public Health
HIPAA permits disclosure to a public health authority for disease prevention or control, or to a person who may have been exposed to or at risk of spreading a disease or condition.
42 CFR Part 2 prohibits these disclosures unless there is an authorization, court order, or the disclosure is done with out revealing patient information.
CD providers must follow 42 CFR Part 2.
Even is state law regarding this are pre-empted by 42 CFR…

26. Court Orders
HIPAA makes no mention of any standards or procedures that a court must follow when issuing a court order.
42 CFR Part 2 has specific requirements.
CD providers must follow 42 CFR Part 2.
Court must follow certain procedures and makes particular determinations specified in 42. Subpoena, search warrant or arrest warrant, even if signed by a judge and called a court order is not sufficient, when standing alone to require or even permit a program to make a disclosure. A subpoena can be used to compel a program to attend a hearing to see whether a court order should be issued. Before a court can issue an order, the program an any patient whose records are sought must be given notice that a party is requesting the order and some opportunity to make an oral or written statement to the court. Must use fictitious names for an y known patient and all proceedings must be confidential. Before issuing the order, The court must find that there is good cause for the disclosure. Determines the public interest and the need for disclosure outweigh any adverse effect that the disclosure will have on the pt, the dr pt relationship and the effectiveness of ht program's services. If the info is available elsewhere, the court shouldn’t issue the order. The judge may inspect the records in private before making the decision. Must be limited to the info essential to fulfill the purpose of the order and restricted to those who need the info for that purpose. Must take other steps to protect pts confidentiality such as sealing records from public scrutiny.
Separate set of criteria for crimial investigation or prosecutions: 5 stringent criteria. Must be “extremely serious crime”

27. Disclosure of Abuse
HIPAA permits disclosure about any individual believed to be a victim of abuse, neglect or domestic violence.
42 CFR Part 2 limits the exception to initial reports of child abuse or neglect (no other kinds of abuse or neglect).
CD providers must follow 42 CFR Part 2, but if a state law compels to report other abuse:
Obtain authorization Anonymous reporting
QSO/BA with state agency Court order

28. Right to Access Records
HIPAA REQUIRES a covered program to give an individual access to his/her own health information (with few exceptions).
42 CFR Part 2 gives programs DISCRETION to decide whether to permit patients to view or obtain copies of their records, unless they are governed by a state law that gives right to access.
CD providers must follow HIPAA.

29. Privacy Notice
HIPAA requires the Privacy Notice to be given at the time of first service.
42 CFR Part 2 requires the notice must be given at admission or as soon as a patient is capable of rational communication.
CD providers must follow HIPAA.
Both require notice of the existence of federal law and give a
written summary of each 42 is very specific as to the language, says EXACTLY what to say, HIPAA only specifies 1st line and what needs to be covered.

30. Minimum Necessary
Under HIPAA, the standard of “Minimum Necessary” does not apply to uses or disclosures:
to or by a health care provider for treatment
made pursuant to a consent
made to HHS for compliance and enforcement
required by law
Or required for compliance with the regulations

31. HOWEVER…
42 CFR Part 2 overrides these permissible exceptions to “Minimum Necessary”.
CD providers must limit ALL DISCLOSURES to that information which is necessary to carry out the purpose of the disclosure (except to the patient him/herself).
42 silent on disclosures to self and HIPAA says Min Nec doesn’t apply so follow HIPAA. Must also follow the related admin “stuff” like ID members of workforce who need access to PHI, categories of info to which they need access, and any conditions to access that exist. P&P around routine and non routine disclosures to ensure meet min nec
HIPAA says don’t need to check auth for min nec if is another covered entity or BA, or public official, or for Research, HOWEVER, 42 does require to ensure these disclosures are limited to min nec.

32. Integrating HIPAA and 42 CFR Part 2

33. Action Steps Conducted risk assessment and gap analysis
Determined Privacy Officer and privacy structure
Determined which Hazelden services are covered by which law
Combined the Privacy Notices and added acknowledgment
Combined the QSOA and BA
Formulated written policies and formalized procedures around patient rights and administrative requirements.
Set up a Privacy Board for research
Consents/authorizations have different required elements for 42/HIPAA, blended these. Don’t accept those that don’t have all. (Sample form?)
42 didn’t specify the patient rights that are mandated by HIPAA. HIPAA forced formalization of these rights with written forms, procedures and policies. Some we did before (access, amend, accting of disclosure) but put new requirements around how it is done (time frames, written requests, etc…) Right to request restrictions impacted internal only where pt can request how data is to be used with other staff, but don’t have to agree to them. External is no change as had to do release anyway so have right to request any restriction by virtue of how they fill out the release.
Complaints go to different places:
42: United States Attorney for the judicial district in which the violation occurred. Methadone to FDA. Penalties for people or agencies, first offense fine of 500, up to 5000 for each subsequent offense

34. Action Steps, Cont… Set up training for “workforce”
Set up complaint system
Formulated a formal sanction policy
Added a system to track and document disclosures needed for Accounting of Disclosures
Changed Authorizations: format and giving copies
Developed a process for written revocation of authorizations
Developed auditing system
Workforce def. Changed for us to include volunteers and board members.

35. Menu of Privacy & Confidentiality Policy & Procedures

36. Example of On-line Privacy & Confidentiality Policy

37. Example of On-line Privacy & Confidentiality Form

38. Program/Service Classification Grid
Does program transmit PHI? Does it maintain PHI?
Is it a “registry” rather than health info?
Program/Service Classification Grid

39. Section of Authorization to Disclose Information

40. Outcomes Increased protection of patients privacy and confidentiality
Compliance with HIPAA
Strengthened compliance with 42 CFR Part 2
Lower risk for organization
Streamlined, cohesive privacy and confidentiality policies on the intranet
Structure to support operational needs and questions around both rules
Accountability and awareness
Standardized training and tools
Sample of Self Directed Learning CD?

41. Resources
To order “Confidentiality and Communication: A Guide to the Federal Drug & Alcohol Confidentiality Law and HIPAA” by The Legal Action Center:
42 CFR Part 2 Regulation
HIPAA and 42 CFR Part 2 Crosswalk
Will be adding to this…