Client Advocacy: What to do When Your Client’s HIV Confidentiality or Testing Rights Have Been Violated. Sally Friedman Legal Director Legal Action Center (212)

2 Who’s the Legal Action Center?  Anti-Discrimination & Privacy work: People with criminal records, alcohol/drug histories, and/or HIV/AIDS Legal services & litigation Advice to providers Trainings Policy advocacy & research

3 How to get help?  Call the Legal Action Center (toll-free)  Clients: Ask for “paralegal on call”  Providers: Ask for “attorney on call” Monday – Friday, 1 to 5 pm

4 This training has 3 parts:  Part 1: Review of the Basics: Fundamentals of New York’s HIV Testing and Confidentiality Law Assumes you’ve received overview before  Part 2: Client Advocacy: HIV Confidentiality or Testing Rights Violated by a Different Agency  Part 3: Client Advocacy: HIV Confidentiality or Testing Rights Violated by Your Agency

5 Part 1: Review of the Basics

6 Review of the Basics Hand-outs Book: HIV/AIDS Testing, Confidentiality and Discrimination: What you Need to Know About New York Law Flow chart on NYS HIV confidentiality law HIPAA & Article 27-F Materials for HIV Providers in New York State

7 Review of the Basics HIV confidentiality

8 Relevant Laws  Major Laws governing confidentiality of health information – and HIV related information:  HIPAA – Federal law  NYS Public Health Law, Article 27-F

9 HIPAA – the basics What is HIPAA? Health Insurance Portability Accountability Act of 1996

10 HIPAA – the basics What is HIPAA? (cont.)  Establishes minimum federal safeguards to protect the privacy of medical records and other “personal health information.”  Applies to health information transmitted in any form: electronically, or oral.

11 HIPAA – the basics HIPAA applies to “Covered Entities”: Health Care Providers that transmit health information electronically in connection with billing & related activities (“covered transactions”) Health Plans, and Health Care Clearinghouses

12 Article 27-F –the basics New York State law that governs: HIV testing HIV confidentiality HIV reporting HIV partner notification Also note related provisions about HIV case reporting in Pub. Health Law §§

13 Article 27-F – the basics Who is Covered? ANY person who receives HIV-related information about a protected individual: while providing a covered “health or social service” ex: doctors, foster care, school nurses OR pursuant to a proper written consent.

14 Article 27-F Who is Covered (cont.)? ANY governmental agencies that: provide, supervise or monitor health or social services Examples: ACS (DSS), DOCS, HRA OR obtain HIV related info pursuant to Article 27-F

15 Article 27-F Does NOT apply to:  Protected individuals themselves  Friends, relatives  Courts  Insurers  Pharmacies  Federal agencies (military, federal prisons)  Schools (except medical staff)  Employers

16 Article 27-F Does NOT apply to (cont.) : BUT other laws may protect confidentiality. Examples: U.S. Constitutional right to privacy – applies to government Americans with Disabilities Act – applies to employers Privacy Act – applies to federal government

17 HIPAA & Article 27-F: Who Must Comply with Both? Health care providers In New York State Who transmit health information electronically In connection with a covered transaction

18 When federal and state laws regulate the same thing  HIPAA pre-empts any “contrary” state law provision except when the state law relates to privacy of health information AND is “more stringent” than the HIPAA provision – provides greater privacy protection/more rights for the individual who is the subject of protected information.  Article 27-F’s “more stringent” protections must be followed by providers covered by both HIPAA and New York’s HIV confidentiality law

19 General Confidentiality Rule HIPAA: A covered entity may not “use or disclose” protected personal health information which is created or received by a covered entity AND relates to the past, present or future physical or mental health of an individual. Article 27-F: Health & social service providers AND people who receive HIV related info pursuant to written consent may not disclose (or redisclose) any HIV related information about a protected individual.

20 Article 27-F: HIV Related Information i ncludes: Case scenario: In the Waiting Room

21 Article 27-F: HIV Related Information includes (cont): Case scenario: Mary goes to general practice for HIV test. 8 people are in waiting room with Mary. Nurse calls to Mary over the front desk: “Mary, please come here for your HIV test.” Violated Art. 27-F?

22 Article 27-F: HIV Related Information includes (cont): Yes. “HIV-related information” includes: Had HIV test – even if results not disclosed.

23 Article 27-F: HIV Related Information includes (cont): “HIV-related information” also includes: Is HIV negative Has HIV infection, HIV related illness or AIDS Has an HIV related condition Takes medication specific to HIV disease Is a contact of someone with HIV All of this is protected personal health information under HIPAA if in the hands of a covered entity.

24 Article 27-F Disclosures With Consent  Any and all confidential HIV related information can be disclosed with (proper) written consent.

25 Article 27-F Capacity to Consent  Does the individual, regardless of age, have the ability to: 1. Understand & appreciate the nature & consequences of proposed disclosure (or proposed HIV test) AND 2. Make an informed decision about whether or not to permit the disclosure (or agree to be tested for HIV)?  Same standard for deciding capacity to consent to disclosures and HIV testing

26 Consent – to disclosure of HIV related information  Voluntary & revocable at any time  Written  Contain specific elements required by both HIPAA & Article 27-F  Form must be approved by DOH  DOH-approved consent form complies with both Article 27-F & HIPAA

27 Approved Consent Form Revised DOH-approved form – 2005: HIPAA Compliant Authorization for Release of Medical Information and Confidential HIV-Related Information

28 What’s notable about the Authorization for Release?  May authorize multiple parties to share the information with one another But need to sign 1 st page for that to happen.  May authorize HIV and/or non-HIV medical information.

29 Article 27-F No Redisclosure  Remember: Person receiving HIV related information pursuant to consent may not redisclose  Person providing HIV related information pursuant to consent must provide notice prohibiting redisclosure  Sample Notice Prohibiting Redisclosure is in hand-outs

30 Article 27-F No Redisclosure (cont.) Always use it when you release confidential HIV-related information with consent For confidential drug/alcohol patient- identifying information, a Notice Prohibiting Redisclosure is also required  Sample forms: OASAS website 

31 Exceptions: When OK to disclose Sometime, it’s legal to disclose HIV information without consent.

32 Proper consent Health care providers/facilities THE GENERAL RULE: A provider may not disclose any HIV-related information about any protected individual. Internal communications Proper form - specifically authorized disclosure of HIV - name of protected individual - name of provider - name of recipient - reason/purpose - dated - time period consent effective - signed Court order HIV/AIDS case notification Parents/ legal guardians (very limited) Other: - review/monitoring - foster care/adoption - third party payers - newborns - sex offenders - criminal justice agencies - child/elder abuse/neg. - occupational exposure Contact notification New York State HIV/AIDS Confidentiality Law Exceptions: conditions permitting disclosures

33 Exception: Internal communications Agency staff may share HIV related information IF the staff members: Are allowed access to client records in ordinary course of business; Are specifically authorized in the agency’s written “need-to-know” protocol; and Have a reasonable need to know or share the information to carry out their authorized duties

34 Exception: Internal communications (cont.) Need-to-know list  Job titles  Job functions Justify why staff on list have reasonable “need to know” to be able to perform their job duties

35  HIPAA has similar concept: Must make reasonable efforts to limit information to the “minimum necessary” to accomplish the intended purpose Exception: Internal communications (cont.)

36 Exception: Disclosures to Other Health Care Providers Case scenario.  Mary’s primary care doctor wants to prescribe her a new medication, but is concerned about potential interaction with her HIV medications.  Calls her HIV doctor to discuss.  Mary did not sign HIV-specific written authorization for either doctor. Did Mary’s doctors violate Art. 27-F?

37 Exception: Disclosures to Other Health Care Providers Answer: No. May disclose HIV related information to a health care provider when it is necessary to provide appropriate care or treatment to: 1.The individual 2.His or her child OR 3.A contact

38 Exception: Disclosures to Other Health Care Providers (cont.)  Person with HIV info – not person seeking it – has authority to decide when disclosure is “necessary” for appropriate care or treatment.  Document the disclosure.  NOTE: Providers may require staff to seek written consent if not an emergency.

39 Other Exceptions Other exceptions include: 1.Physicians’ Disclosures about Minors 2.Case reporting 3.Partner notification 4.Foster care & adoption 5.3 rd party payers 6.Convicted (& some indicted) sex offenders We won’t discuss these here.

40 Review of the Basics: HIV testing

41 Article 27-F – HIV TESTING: THE BASIC RULE  No HIV testing without voluntary, informed, HIV-specific, and written CONSENT  By the person who has capacity to consent to the HIV test.

42 Art. 27-F - HIV testing Capacity to consent Similar to “capacity” standard for disclosures:  Is this individual, regardless of his or her age, 1. Able to understand & appreciate the nature & consequences of the proposed procedure: being tested for HIV? AND 2. Able to make an informed decision about whether or not to have an HIV test?

43 Art. 27-F - HIV testing Capacity to consent (cont.)  Who consents if person getting tested lacks “capacity?” The person authorized by law to make health care decisions for him or her. Example: Parent of minor Court-appointed guardian Health care proxy

44 Article 27-F e xceptions: HIV testing without consent  Mandatory HIV testing allowed: Newborns Convicted and some indicted sex offenders, upon victim’s request (court must order) Foster care (certain circumstances) Lawsuit where HIV status of one party is at issue & material to litigation, and court orders HIV test

45 Part 2: CLIENT ADVOCACY HIV Confidentiality or Testing Rights Violated by a Different agency

46 Part 2: CLIENT ADVOCACY Hand-outs:  Sample Complaint forms  Sample Complaint narrative

47 Client Advocacy – Confidentiality Breach by Different Agency Let’s hear from you:  Ever happened in your agency?  Did you ever receive such a complaint?  What did you do?

48 Client Advocacy – Confidentiality Breach by Different Agency Case scenario: Michael’s Pre-Employment Exam

49 Client Advocacy – Confidentiality Breach by Different Agency  You are Michael’s case worker.  Michael got a new job.  Michael is very upset one day and tells you: new boss said, “I hope you’re feeling OK. I just saw your pre-employment medical report, and it said that you have HIV.”  Michael did not sign a consent for this disclosure – and even told doctor not to disclose. He asks you what he can do. What should you do?

50 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  First – Do you think the doctor violated Michael’s HIV confidentiality rights? Yes. Disclosures to employers are never permitted without HIV-specific, written consent. Even true if HIV status relevant to Michael’s ability to do his job. Still need consent.

51 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  Though you’re not a lawyer – and shouldn’t be the ultimate judge of whether the disclosure was illegal, it’s helpful to think it through if you can.  But don’t tell client: disclosure definitely did or did not violate the law. Could say that you think the disclosure may have violated the law.

52 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  So what do you do next? Options – more on each, later: 1.Counsel client. 2.Do informal advocacy yourself, 3.Refer Michael to attorneys. 4.Refer Michael to an oversight agency.

53 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 1.Counsel your client.  Do encourage your client to explore options and rights. These include:  Informal advocacy  Referral to attorney  Complaints to oversight agencies  Lawsuits.

54 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 1.Counsel your client (cont.).  Do not say definitely – whether disclosure violated the law.  Do not give false hopes of millions of dollars in lawsuit awards.

55 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 2. Informal advocacy with alleged breacher: Help client file complaint with the entity that breached his confidentiality (supervisors, director, legal counsel) Ask for copies of all consent forms Michael signed. Demand a thorough investigation.

56 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  If breach had occurred within Michael’s workplace, educate Michael & employer that – It is illegal to discriminate based on employee’s HIV status, under  Federal law: Americans with Disabilities Act  NYS law: State & NYC Human Rights Laws. Americans with Disabilities Act (ADA) requires employer to maintain confidentiality of HIV information.

57 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 3. Referrals to attorneys. Instead of or in addition to doing informal advocacy yourself Attorneys will evaluate legality of disclosure & counsel client about options. Referral: Legal Action Center, and see

58 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 4. Refer client to oversight agency (“administrative remedy”). Art. 27-F – DOH Complaint process HIPAA complaint with Office of Civil Rights NYS Office of the Professions (licensed professionals) NYS Office of Professional Medical Conduct (doctors and physician assistants)

59 Administrative remedies: Article 27-F – DOH Process  File complaint with DOH-AIDS Institute, Special Investigation Unit (SIU)  Complaint form is in hand-outs  (800)

60 Administrative remedies: Article 27-F – DOH Process (cont.) What will DOH do with it? Confidentiality breach: Might refer it to agency overseeing or employing “breacher” – HRA, DOH Home Care or Hospitals Bureaus, Dept of Correctional Svc HIV testing complaint: Might also refer it to DOH agency overseeing medical professionals/health care facilities, or Office of Professions overseeing other licensed professionals (e.g., nurses)

61 Administrative remedies: Article 27-F – DOH Process (cont.) 5,000 civil fine criminal penalty if willful Usual remedy = “statement of deficiencies” requiring corrective action

62 Administrative remedies: Article 27-F – DOH Process (cont.) May ask attorney, legal service provider like Legal Action Center to represent client in this proceeding But don’t need a lawyer

63 Administrative remedies: Article 27-F – DOH Process (cont.)  Advocating for your client at the DOH ] Help write the complaint  Include details about what happened  Support your conclusion; e.g., don’t assume that because someone learned your client’s status, the breacher had to be X  Sample Complaint Narratives – HIV confidentiality; HIV testing (in hand-outs)

64 Administrative remedies: Article 27-F – DOH Process (cont.)  Monitor progress of complaint  If don’t get resolution, keep calling! Speed and thoroughness of investigations may vary by agency No pre-set timeframes

65 Administrative remedies: Article 27-F – DOH Process (cont.)  Appeal: May appeal within 60 days of mailing of the finding But client likely will not be advised of right to appeal

66 Administrative remedies: Article 27-F – DOH Process (cont.)  Value of the DOH process: Client may feel vindicated; got “justice”; voice was heard Corrective action may prevent further breaches or HIV testing violations Do not need a lawyer Usually much faster than a lawsuit

67 Administrative remedies: Article 27-F – DOH Process (cont.) Downside to DOH process: Depending on which agency reviews case:  may take a long time  may not do thorough investigation  may not take corrective action sufficient for your client Process and correspondence may not be clear to client

68 Administrative remedies: Article 27-F – DOH Process (cont.) Downside to DOH process (cont’d): No money for client Fines & criminal penalties virtually never imposed

69 Administrative remedies: HIPAA violations Penalties  Individuals may file complaint with HHS/Office of Civil Rights  Sample complaint form is in hand-outs  Civil fines are $100 per violation, with a maximum of $25,000/year for each.  Criminal fines: $50,000 to $250,000, & one to ten years imprisonment  HHS usually aims for “corrective action” rather than fines or imprisonment

70 Administrative Remedies: Professional Licensing Rules  Article 27-F and HIPAA violations also might violate State laws/rules governing the professions  Complaints against physicians may be filed with Office of Professional Medical Conduct   Complaint form is in hand-outs

71 Administrative Remedies: Office of Professional Medical Conduct  Complaints against physicians may be filed with Office of Professional Medical Conduct   Complaint form is in hand-outs

72 Administrative Remedies NYS Office of the Professions  Complaints against other licensed professionals (e.g., social workers, pharmacists; nurses, CBO counseling and testing providers)  Can be filed with NYS Education Dept., Office of the Professions  Central office: 212/  Complaint form is in hand-outs

73 Lawsuits  May sue in court for violations of Article 27-F confidentiality & HIV testing provisions  Generally need a lawyer  May not sue for HIPAA violations.

74 Lawsuits (cont.)  Damages include: Emotional harm  Did the word spread to others?  Ostracism?  Depression? Isolation?  Anger?  Lost sleep or appetite? Employment consequences; Lost wages

75 Lawsuits (cont.) Damages also include: Physical harm:  Affected ability/willingness to stay in health care?  Stress-related complications? Other out-of-pocket losses Punitive damages (sometimes)

76 Lawsuits (cont.)  Don’t give client unrealistic expectation of easy money  Downside to lawsuits: Can take many years Hard to find free legal counsel Have to relive the trauma through testimony and continuous contact with attorney

77 Lawsuits (cont.)  Downside to lawsuits (cont’d): Adversarial model can make clients even angrier, as wrongdoer may defend position Client’s emotional life & personal behavior & HIV status will be on display and subject to probing

78 Lawsuits (cont.)  Advantages of lawsuits: Might win or get good settlement Victory/good settlement might feel like “justice” Publicity/legal precedent may help educate others about issues and individuals’ rights and legal protections

79 Part 3: CLIENT ADVOCACY HIV Confidentiality or Testing Rights Violated by Your Agency

80 CLIENT ADVOCACY Let’s hear from you:  Did anyone ever complain to you about your own agency’s breach of confidentiality/testing rights?  What did you do?

81 CLIENT ADVOCACY Case scenario: Rita’s home health aide  You’re a supervisor in a home care agency  Rita calls you to complain: Rita’s neighbor said he found out Rita’s HIV status from her home health aide.  Rita wants a different aide, but she also demands that the aide be fired.  What should you do?

82 CLIENT ADVOCACY  Follow your agency’s complaint procedure.  Make sure your agency’s complaint procedure complies with HIPAA.

83 HIPAA requires covered entities to: 1.Provide process for patients to make complaints concerning HIPAA policies and procedures. 2.Establish sanctions to be imposed against workforce for violations of privacy policies. Responding to Complaints – Your Agency

84 Responding to Complaints – Your Agency (cont’d) HIPAA also requires covered entities to: 3.Designate a staff member to be responsible for receiving complaints. (Can be the privacy official.) 4.Document all complaints received and their disposition.

85 Responding to Complaints – Your Agency (cont’d) Suggestion: Acknowledge importance of confidentiality Don’t belittle client’s complaint Inform client – complaint procedure Don’t give client the “run around”

86 Responding to Complaints – Your Agency (cont’d)  Conduct thorough investigation Talk to witnesses Look at documentation Get client’s feedback

87 Responding to Complaints – Your Agency (cont’d)  After investigation & conclusion: Retrain staff/remind them of policies – even if no violation occurred Deliver conclusion to client respectfully

88 Responding to Complaints – Your Agency (cont’d)  If violation is verified: Apologize Take disciplinary action against individual who violated the law Update agency policies, if necessary, to prevent further violations Train staff about policies Inform client – corrective actions taken

89 Responding to Complaints – Your Agency (cont’d)  Good practice to understand the harm: May believe “everyone” knows status; life will never be the same Severe emotional harm – depression, anxiety, paranoia Anger Ostracism and even physical harm Reliving trauma of diagnosis

90 Responding to Complaints – Your Agency (cont’d)  Understand what client might want: vindication; acknowledgment that someone hurt them policy change & training: “this shouldn’t happen to anyone else” money

91 Call on us for help!  Legal services for people affected by HIV/AIDS – statewide!  Training on HIV-related legal issues for HIV service providers – statewide!  Hot-line and technical assistance on HIV-related legal issues – statewide! Legal Action Center: or

92 That’s it. Thank you!