1. HIPAA and 42 C.F.R. Part 2 Confidentiality
Terri S. Morrison
First Assistant Legal Counsel
Colorado Judicial Department
HIPAA and 42 C.F.R. Part 2 Confidentiality
Best Practices Conference, April 27, 2011

2. Confidentiality of Alcohol and Drug Abuse Records
42 U.S.C. § 290 dd-2
Confidentiality of Alcohol and Drug Abuse Records

3. 42 U.S.C. §290dd-2
Enacted in the early 1970’s to guarantee confidentiality of information about persons receiving alcohol and drug prevention and treatment services
Amended in 1986 to permit mandated reporting of child abuse
Amended 1992, consolidated drug and alcohol “substance” abuse

4. Code of Federal Regulations
42 C.F.R. Part 2
Issued in 1975 revised in 1987
Federal agency primarily responsible for implementing and interpreting Regulations: Dept. of Health and Human Services

5. Why Privacy Protection?
Reduction of stigma
Fostering trust
Preserving confidentiality
Encourage people to seek help
Avoid damaging consequences of disclosure

6. HIPAA, 42 U.S.C. §1320d-1320d-8
Health Insurance Portability and Accountability Act of 1996
45 C.F.R. Parts 160 and 164
Rules enacted in 2003

7. HIPAA and 42 C.F.R. Part 2
Both prohibit the use and disclosure of records or other patient related information.

8. Both Regulations. . .
“establish standards for maintenance, use and disclosure of health information, including what must be done before a disclosure of confidential information can be made, the manner in which the information may be disclosed, and to whom it may be disclosed.” -- Confidentiality and Communication
Legal Action Center 2006

9. Brief Comparison
HIPAA
42 C.F.R. Part 2
Permits but does not mandate disclosure of health information:
Permits disclosure for w/out consent for payments
Requires patient access to records
Prohibits all disclosures except those specifically allowed by the regulations
Prohibits disclosure without patient consent
Permits patient access to records

10. Who is Covered?
HIPAA
42 C.F.R. PART 2
“Program”- any person or organization that in whole or in part provides alcohol or drug abuse diagnosis, treatment or referral for treatment or prevention; AND
“Federally assisted”- receives fed’l funds even if funds do not pay for D/A services
“Covered entity”:
Health Plans
Health care clearinghouses
Health care providers who transmit health information in electronic form
Courts are NOT

11. HIPAA requirements for Covered Entity
Privacy Official
Training
Safeguards– admin., tech., physical
Complaints
Track and document disclosures
Disclose minimum information
Document policies, procedures and designations

12. Consent Required, 42 C.F.R. Part 2
Disclosure of treatment records content is only permitted in the manner specified by statute, a general release does not suffice.
Without consent, a specific court order is required
Order must be for non-criminal purposes, 42 C.F.R. §2.64(a); notice of application to person whose records are sought and opportunity to respond or appear §2.64(b)

13. Elements of Written Consent
Name or designation of program making disclosure
Name/title of person to whom disclosure is made
Name of the patient/client
Purpose of the disclosure
How much and what kind of info. to disclose
Signature of patient/ minor with parent*

14. Elements of Consent (cont’d)
Date consent signed
Statement re: revocation
Date, event or condition upon which consent expire (e.g. termination of probation)

15. Prohibition on Redisclosure 42 C.F.R. §2.32
Written statement that must accompany each disclosure made with the patient’s consent
Informs the recipient of the prohibition on redisclosure and specific release requirement
Indicates that Federal rules restrict use of information to criminally investigate or prosecute a patient

16. Disclosure to Criminal Justice System, 42 C.F.R. §2.35
May be made to those who have made participation a condition of the disposition of a criminal proceeding
Only to those with a need to monitor progress
Signed consent of patient
Redisclosure only to carry out official duties

17. Subpoena & 42 C.F.R. Part 2
A subpoena is insufficient to overcome the privacy protection of 42 C.F.R. Part 2
A court must find good cause for ordering release after finding
Other ways not available or not effective
Public interest and need outweigh potential injury to the patient
See United States v. Oberle, 136 F. 3d 1414, 1420 (10th Cir. 1998) finding no good cause for release

18. HIPAA and Qualified Protective Order
Court order or stipulation by parties that information will not be used other than for litigation purposes and PHI will be returned or destroyed at end of litigation

19. Death of Patient
HIPAA
42 C.F.R. Part 2
Allows disclosure to coroner, medical examiner or funeral director
If covered entity believes patient suffered a suspicious death can disclose to law enforcement
Requires consent from legal representative or family member
If covered entity believes patient suffered a suspicious death can disclose to law enforcement

20. Exceptions to the general rule 42 C.F.R. Part 2
Written consent
Internal communications
No identifying information
Medical emergency
Court order
Crime at program
Research
Audit and evaluation
Child abuse

21. Mandated reporting of child abuse
Substance abuse by itself not a condition that must be reported as child abuse or neglect, there must be some reason to suspect actual or imminent harm to a child
Release only applies to initial reports– subsequent reports require consent or court order.

22. Medical and Mental Health Records
HIPAA
§ (1)(f), C.R.S. allows access to MH records only to persons authorized by court order after notice and opportunity for hearing for person who is subject of the record and the custodian of the record
§ (1), C.R.S. governs who may not testify w/out consent—physicians, therapists

23. Medical and Mental Health Records
People v. Reynolds, 578 P.2d 647,649 (Colo. 1978) the privileges afforded by § , C.R.S. apply equally in criminal cases where confidential medical and MH information is sought
§ , C.R.S. crime to disclose medical and MH information without authorization, “theft”

24. Medical and Mental Health Records
Johnson v. Trujillo, 977 P.2d 152 (Colo. 1999) the party seeking to overcome the privilege bears the burden of establishing that the privilege has been waived
Privacy attaches to medical matters Whalen v. Roe, 429 U.S (1977); People v. Sisneros, 55 P.3d 797 (Colo. 2002)