1. How to Litigate an HIV confidentiality case

2. Sally Friedman Legal Director Legal Action Center (212) 243-1313 www.lac.org sfriedman@lac.org

3. 3 Today’s topics Part 1: HIV stigma & discrimination Part 2: Substantive HIV confidentiality protections Part 3: How to Litigate an HIV confidentiality case

4. 4 Part 1: Rationale for HIV confidentiality law  Stigma See articles in hand-outs.  Discrimination

5. 5 Part 2 Substantive HIV confidentiality Protections

6. 6 Applicable laws  Article 27-F, NYS Public Health Law Secs. 2780 et. seq.  HIPAA  Fiduciary duty of confidentiality  Constitutional right to privacy  Privacy Act (federal)

7. 7 Today’s focus:  Article 27-F, NYS Pub. Health Law  HIPAA  Will touch on fiduciary duty of confidentiality

8. 8 What is Article 27-F? HIV testing HIV confidentiality Today’s focus – the confidentiality provisions

9. 9 Article 27-F Who is Bound by the Law? ANY person who receives HIV-related information about a protected individual: while providing a “health or social service” OR pursuant to a proper written consent NY governmental agencies that: provide, supervise or monitor health or social services OR obtain HIV related info pursuant to Article 27-F

10. 10 Article 27-F Does NOT apply to:  Protected individuals themselves  Friends, relatives  Courts  Insurers  Federal agencies (military, federal prisons)  Schools (except medical staff)  Employers

11. 11 Article 27-F What information is protected? HIV test HIV test results, even if negative HIV infection or HIV related illness or AIDS HIV related condition Medication specific to HIV disease Contact of someone with HIV: Sexual partner, spouse, needle sharing

12. 12 What is HIPAA? Health Insurance Portability Accountability Act of 1996

13. 13 HIPAA Generally  Establishes a federal floor of safeguards to protect the privacy of medical records and other “personal health information”  Applies to health information transmitted in any form: electronic, written or oral.

14. 14 HIPAA Who is Covered? Covered Entities Are: Health Care Providers Health Plans Health Care Clearinghouses IF they transmit health information electronically in connection with certain covered transactions – generally concerning billing and eligibility

15. 15 HIPAA Covered Transactions processing claims payment and remittance coordination of benefits claim status enrollment and disenrollment in a health plan health plan eligibility health plan premium payments referral certification and authorization first report of injury health claims attachments

16. 16 HIPAA & Article 27-F Who Must Comply with Both? Most health care providers in New York State, provided they transmit health information electronically for purposes of billing or reimbursement.

17. 17 When Federal & State Laws Regulate the Same Subject HIPAA pre-empts any “contrary” state law provision except when, among other things:  The state law relates to privacy AND is “more stringent” than the HIPAA provision.

18. 18 HIPAA More Stringent Test  Provides greater privacy protection for the individual who is the subject of protected information.  Gives an individual greater rights to access or to amend his/her own health records;  Provides more information to an individual regarding a use, disclosure, or rights and remedies;  Provides a narrower scope or duration, or affords increased privacy protections, for express legal permissions for use or disclosure, or reduces the coercive effect of such permissions;  Provides for the retention or reporting of more detailed information in an accounting of disclosures;

19. 19 What is “fiduciary duty of confidentiality?”  Requires fiduciary to maintain confidentiality of HIV (and other) information  Covers: Health care providers Pharmacists Other fiduciaries

20. 20 What is Constitutional right to privacy?  Protects against disclosure of certain intimate information  Protects confidentiality of HIV information. Doe v. City of NY, 15 F.3 d 264 (2d Cir. 1994)

21. 21 Constitutional right to privacy: who is covered?  Government employees, officials, and agents acting under color of local, state, or federal law

22. 22 What is Privacy Act?  Prohibits some federal agencies from disclosing private information

23. 23 Article 27-F & HIPAA

24. 24 What’s the Law? The General Rule  HIPAA: A covered entity may not “use or disclose” protected health information which is created or received by a covered entity AND relates to the past, present or future physical or mental health of an individual.  Article 27-F: Health & social service providers AND people who receive HIV related info pursuant to written release may not disclose (or redisclose) any HIV related information about a protected individual. (§ 2782)

25. 25 Article 27-F Protected Persons Person who has HIV Person who has had an HIV test Contacts (spouse, sexual partner or needle-sharing partner)

26. 26 The Main “Exceptions” permitting disclosure  Both HIPAA & Article 27-F have “exceptions” that allow entities to share HIV information.  This training will cover five of them: Written consent Internal communications health care Partner notification Court order

27. 27 CONSENT Requirements for written consent:

28. 28 Article 27-F Consent  Voluntary & Revocable at any time  Written  Contain specific elements required by both HIPAA & Art. 27-F  Form must be approved by DOH (see sample)  Will be necessary during litigation.

29. 29 Article 27-F No Redisclosure  Person receiving information pursuant to consent may not redisclose  Person providing information pursuant to consent must provide notice prohibiting redisclosure (see sample). This needs to happen during litigation!

30. 30 Internal communications Requirements under Art. 27-F and HIPAA:

31. 31 Article 27-F Internal communications Agency staff may share HIV related information IF the staff members: Are allowed access to client records in ordinary course of business; Are specifically authorized in the agency’s written “need-to-know” protocol; OR Have a reasonable need to know or share the information to carry out their authorized duties

32. 32  Identify & document members of the workforce who need access  Identify & document the categories of information to which they need access  Identify & document any conditions to their access HIPAA Minimum Necessary Standard

33. 33 To Health Care Providers May disclose HIV related information to a health care provider when it is necessary to provide care to: 1.The individual 2.His or her child OR 3.A contact Document the disclosure.

34. 34 To Health Care Providers (cont.) This exception only operates if the disclosure is for the purpose of providing health care to the protected person (or his/her child or contact) – and not for purposes such as:  workers compensation,  Infection control

35. 35 Case Reporting & Partner Notification Physicians & labs who diagnose HIV are required to report every case of HIV infection, HIV related illness and AIDS diagnosis to DOH Report to State DOH State rediscloses contact info to local DOH for partner notification

36. 36 Case Reporting & Partner Notification (cont.)  Physicians report Known contacts Domestic violence risk Whether contacts have been notified

37. 37 Case Reporting & Partner Notification (cont.)  ONLY physicians and special Dept of Health staff are permitted to notify named partners of HIV infected individual  NO ONE ELSE is permitted to do partner notification

38. 38 Case Reporting & Partner Notification (cont.)  Physicians may notify contact if: Significant risk of infection Counsels about need to notify Does domestic violence screen Informs patient that –  Intends to notify & must tell DOH  Can choose to have DOH notify  Source person’s name won’t be revealed

39. 39 Court Orders & Subpoenas Subpoenas do NOT authorize disclosure of HIV-related information – even if “so ordered” by court Need client consent to respond to subpoena If no consent, may redact HIV information from records if possible

40. 40 Article 27-F Court Orders Court may order disclosure IF:  Compelling need for adjudication of lawsuit, or  Clear and imminent danger to life or health of persons unknowingly at significant risk, or  Applicant is lawfully entitled and disclosure is consistent with Article 27-F. (NYS Pub. Health Law § 2785)

41. 41 Article 27-F Court Order Procedure  Notice  Opportunity to be heard  Fictitious name  Confidential proceeding

42. 42 Article 27-F Complaints & Violations  $5,000 civil fine  criminal penalty if willful  private right of action (can sue)  file complaint with DOH: (800) 962- 5065

43. 43  No private right of action  May file a complaint with the Covered Entity and/or Office of Civil Rights of the U.S. Dept. of Health & Human Services within 180 days of the violation Penalties range from civil fine ($100 per violation to maximum $25,000 per calendar year) to various criminal fines & imprisonment. Rarely – if ever – imposed. HIPAA Enforcement and Complaints

44. 44 Part 2 How to Litigate an Article 27-F Case

45. 45 Establish what client wants  Clients goals often change. Usual range: acknowledgment that someone hurt them money BUT don’t forget about effect of lump sum on public benefits policy change & training: “it shouldn’t happen to anyone else” It’s largely about stigma & dignity

46. 46 Lawsuits Article 27-F  Individuals may sue in court for violations of Article 27-F  Damages include: Emotional harm Lost wages Other out-of-pocket losses Punitive damages

47. 47 Lawsuits HIPAA  Individuals may not bring lawsuits to enforce HIPAA

48. 48 Lawsuits Fiduciary duty of confidentiality  May add a claim for breach of common law fiduciary duty of confidentiality

49. 49 Lawsuits  Don’t give client unrealistic expectation of easy money  Downside to lawsuits: Can take many years Hard to find free legal counsel Have to relive the trauma through testimony and continuous contact with attorney Client’s medical (some) and mental health (most or all) records are discoverable

50. 50 Lawsuits  Downside to lawsuits (cont.): Adversarial model can make clients even angrier, as “breacher” defends position

51. 51 Lawsuits  Advantages of lawsuits: Might win or get good settlement Victory/good settlement might feel like “justice” Advocacy by counsel can restore client’s dignity

52. 52 Pre-litigation negotiations  Explain pros & cons of early settlement: Pros:  Spares client tremendous emotional toll: Probing associated with litigation (mental health & medical records are shared) Reliving the event  Get “something” as opposed to risk losing

53. 53 Pre-litigation negotiations (cont.) Cons:  May be unsuccessful and delay an ultimate resolution  Pre-litigation negotiations may be more productive if client doesn’t seek high monetary damages  See sample demand letter

54. 54 Getting the Litigation Started

55. 55 Releases for Disclosure to Opposing Counsel and the Courts  Need client’s written consent to release HIV-related information to opposing counsel (this includes their insurers)  Also need written consent to file HIV- related information with the courts  Will need more consents for discovery

56. 56 Releases for Disclosure to Opposing Counsel and the Courts  REMEMBER: people who receive HIV information pursuant to a release become bound by Art. 27-F too.  Must send the Notice Prohibiting Redisclosure!

57. 57 Motion to Proceed Under Pseudonym  Client may not want to proceed under real name  May file Order to Show Cause to proceed under pseudonym Different courts have different practices Some may barely be familiar with it Check with clerk  See sample papers

58. 58 Complaint  Decide: Defendants – individual who committed breach & employer? Relief (more on this later) Jury?  See sample, Doe v. Family Aides

59. 59 Confidentiality During Discovery  See sample confidentiality stipulations.  Educate opposing counsel about how HIV confidentiality rules affect discovery!  Don’t have health care providers send documents to the court record room unless confidentiality protections are put in place.

60. 60 Settlement Negotiations  Don’t forget about injunctive relief. Easy to get sidetracked on damages alone.  Confidentiality clauses (gag rules): try to limit them, but it’s the client’s ultimate decision.  Do NOT forget about effect of money on client’s government benefits. Call Legal Action Center for help.  How to put a price tag on emotional harm? (Next slide)

61. 61 Proving Harm: Damages  Different treatment by outside world: Ostracism Problems at work Physically accosted

62. 62 Damages: how much? Subjective changes Depression Paranoia Isolation Sleeplessness Lost appetite Headaches Quarreling with loved ones Got therapy Physical manifestations

63. 63 For more information  Legal Action Center can provide: detailed memo on caselaw awarding damages for privacy violations Sample client affidavits regarding emotional harm

64. 64 Recent successes  $65,000 settlement: Social Security Administration  $50,000 settlement: medical office  $35,000 settlement: police officer

65. 65 Administrative Remedies  Administrative remedies can be pursued simultaneously (though note deadlines). US – HHS, Office of Civil Rights NYS - Dept of Health NYS - Office of Prof. Medical Conduct NYS - Office of the Professions

66. 66 Administrative remedies Article 27-F – DOH Process  File complaint with DOH-AIDS Institute, Special Investigation Unit  Complaint form is in hand-outs  (800) 962-5065  Unit might refer it to agency overseeing or employing “breacher” HRA, DOH Home Care or Hospitals Bureaus, Dept of Corrections

67. 67 Administrative remedies Article 27-F – DOH Process (cont’d) 5,000 civil fine criminal penalty if willful Usual remedy = “statement of deficiencies” requiring corrective action

68. 68 Administrative remedies: Article 27-F – DOH Process (cont’d)  Monitor progress of complaint  If don’t get resolution, keep calling! Speed and thoroughness of investigations may vary by agency No pre-set timeframes

69. 69 Administrative remedies: Article 27-F – DOH Process (cont’d)  Appeal: May appeal within 60 days of mailing of the finding But client likely will not be advised of right to appeal

70. 70 Administrative Remedies NYS Office of Professional Medical Conduct  Violation of Article 27-F and HIPAA also can violate State laws/rules governing the professions  Complaints against physicians may be filed with Office of Professional Medical Conduct  opmc@health.state.ny.us opmc@health.state.ny.us  Complaint form is in hand-outs

71. 71 Administrative Remedies NYS Office of the Professions  HIV confidentiality breaches by other licensed professions (e.g., social workers, nurses, pharmacists)  Complaints can be filed with NYS Education Dept., Office of the Professions  Central office: 212/951-6400  Complaint form is in hand-outs

72. 72 Questions?  For help with HIV confidentiality litigation, call Legal Action Center and ask for:  Sally Friedman  Renee Martinez  212-243-1313