1. Client Advocacy: What to do When Your Client’s HIV Confidentiality or Testing Rights Have Been Violated. Sally Friedman Legal Director Legal Action Center (212) 243-1313

2. 2 Who’s the Legal Action Center?  Anti-Discrimination & Privacy work: People with criminal records, alcohol/drug histories, and/or HIV/AIDS Legal services & litigation Advice to providers Trainings Policy advocacy & research

3. 3 How to get help?  Call the Legal Action Center 212-243-1313 800-223-4044 (toll-free)  Clients: Ask for “paralegal on call”  Providers: Ask for “attorney on call” Monday – Friday, 1 to 5 pm

4. 4 This training has 3 parts:  Part 1: Review of the Basics: Fundamentals of New York’s HIV Testing and Confidentiality Law Assumes you’ve received overview before  Part 2: Client Advocacy: HIV Confidentiality or Testing Rights Violated by a Different Agency  Part 3: Client Advocacy: HIV Confidentiality or Testing Rights Violated by Your Agency

5. 5 Part 1: Review of the Basics

6. 6 Review of the Basics Hand-outs Book: HIV/AIDS Testing, Confidentiality and Discrimination: What you Need to Know About New York Law Flow chart on NYS HIV confidentiality law HIPAA & Article 27-F Materials for HIV Providers in New York State

7. 7 Review of the Basics HIV confidentiality

8. 8 Relevant Laws  Major Laws governing confidentiality of health information – and HIV related information:  HIPAA – Federal law  NYS Public Health Law, Article 27-F

9. 9 HIPAA – the basics What is HIPAA? Health Insurance Portability Accountability Act of 1996

10. 10 HIPAA – the basics What is HIPAA? (cont.)  Establishes minimum federal safeguards to protect the privacy of medical records and other “personal health information.”  Applies to health information transmitted in any form: electronically, or oral.

11. 11 HIPAA – the basics HIPAA applies to “Covered Entities”: Health Care Providers that transmit health information electronically in connection with billing & related activities (“covered transactions”) Health Plans, and Health Care Clearinghouses

12. 12 Article 27-F –the basics New York State law that governs: HIV testing HIV confidentiality HIV reporting HIV partner notification Also note related provisions about HIV case reporting in Pub. Health Law §§ 2130-2139

13. 13 Article 27-F – the basics Who is Covered? ANY person who receives HIV-related information about a protected individual: while providing a covered “health or social service” ex: doctors, foster care, school nurses OR pursuant to a proper written consent.

14. 14 Article 27-F Who is Covered (cont.)? ANY governmental agencies that: provide, supervise or monitor health or social services Examples: ACS (DSS), DOCS, HRA OR obtain HIV related info pursuant to Article 27-F

15. 15 Article 27-F Does NOT apply to:  Protected individuals themselves  Friends, relatives  Courts  Insurers  Pharmacies  Federal agencies (military, federal prisons)  Schools (except medical staff)  Employers

16. 16 Article 27-F Does NOT apply to (cont.) : BUT other laws may protect confidentiality. Examples: U.S. Constitutional right to privacy – applies to government Americans with Disabilities Act – applies to employers Privacy Act – applies to federal government

17. 17 HIPAA & Article 27-F: Who Must Comply with Both? Health care providers In New York State Who transmit health information electronically In connection with a covered transaction

18. 18 When federal and state laws regulate the same thing  HIPAA pre-empts any “contrary” state law provision except when the state law relates to privacy of health information AND is “more stringent” than the HIPAA provision – provides greater privacy protection/more rights for the individual who is the subject of protected information.  Article 27-F’s “more stringent” protections must be followed by providers covered by both HIPAA and New York’s HIV confidentiality law

19. 19 General Confidentiality Rule HIPAA: A covered entity may not “use or disclose” protected personal health information which is created or received by a covered entity AND relates to the past, present or future physical or mental health of an individual. Article 27-F: Health & social service providers AND people who receive HIV related info pursuant to written consent may not disclose (or redisclose) any HIV related information about a protected individual.

20. 20 Article 27-F: HIV Related Information i ncludes: Case scenario: In the Waiting Room

21. 21 Article 27-F: HIV Related Information includes (cont): Case scenario: Mary goes to general practice for HIV test. 8 people are in waiting room with Mary. Nurse calls to Mary over the front desk: “Mary, please come here for your HIV test.” Violated Art. 27-F?

22. 22 Article 27-F: HIV Related Information includes (cont): Yes. “HIV-related information” includes: Had HIV test – even if results not disclosed.

23. 23 Article 27-F: HIV Related Information includes (cont): “HIV-related information” also includes: Is HIV negative Has HIV infection, HIV related illness or AIDS Has an HIV related condition Takes medication specific to HIV disease Is a contact of someone with HIV All of this is protected personal health information under HIPAA if in the hands of a covered entity.

24. 24 Article 27-F Disclosures With Consent  Any and all confidential HIV related information can be disclosed with (proper) written consent.

25. 25 Article 27-F Capacity to Consent  Does the individual, regardless of age, have the ability to: 1. Understand & appreciate the nature & consequences of proposed disclosure (or proposed HIV test) AND 2. Make an informed decision about whether or not to permit the disclosure (or agree to be tested for HIV)?  Same standard for deciding capacity to consent to disclosures and HIV testing

26. 26 Consent – to disclosure of HIV related information  Voluntary & revocable at any time  Written  Contain specific elements required by both HIPAA & Article 27-F  Form must be approved by DOH  DOH-approved consent form complies with both Article 27-F & HIPAA

27. 27 Approved Consent Form Revised DOH-approved form – 2005: HIPAA Compliant Authorization for Release of Medical Information and Confidential HIV-Related Information

28. 28 What’s notable about the Authorization for Release?  May authorize multiple parties to share the information with one another But need to sign 1 st page for that to happen.  May authorize HIV and/or non-HIV medical information.

29. 29 Article 27-F No Redisclosure  Remember: Person receiving HIV related information pursuant to consent may not redisclose  Person providing HIV related information pursuant to consent must provide notice prohibiting redisclosure  Sample Notice Prohibiting Redisclosure is in hand-outs

30. 30 Article 27-F No Redisclosure (cont.) Always use it when you release confidential HIV-related information with consent For confidential drug/alcohol patient- identifying information, a Notice Prohibiting Redisclosure is also required  Sample forms: OASAS website  www.oasas.state.ny.us/mis/forms

31. 31 Exceptions: When OK to disclose Sometime, it’s legal to disclose HIV information without consent.

32. 32 Proper consent Health care providers/facilities THE GENERAL RULE: A provider may not disclose any HIV-related information about any protected individual. Internal communications Proper form - specifically authorized disclosure of HIV - name of protected individual - name of provider - name of recipient - reason/purpose - dated - time period consent effective - signed Court order HIV/AIDS case notification Parents/ legal guardians (very limited) Other: - review/monitoring - foster care/adoption - third party payers - newborns - sex offenders - criminal justice agencies - child/elder abuse/neg. - occupational exposure Contact notification New York State HIV/AIDS Confidentiality Law Exceptions: conditions permitting disclosures

33. 33 Exception: Internal communications Agency staff may share HIV related information IF the staff members: Are allowed access to client records in ordinary course of business; Are specifically authorized in the agency’s written “need-to-know” protocol; and Have a reasonable need to know or share the information to carry out their authorized duties

34. 34 Exception: Internal communications (cont.) Need-to-know list  Job titles  Job functions Justify why staff on list have reasonable “need to know” to be able to perform their job duties

35. 35  HIPAA has similar concept: Must make reasonable efforts to limit information to the “minimum necessary” to accomplish the intended purpose Exception: Internal communications (cont.)

36. 36 Exception: Disclosures to Other Health Care Providers Case scenario.  Mary’s primary care doctor wants to prescribe her a new medication, but is concerned about potential interaction with her HIV medications.  Calls her HIV doctor to discuss.  Mary did not sign HIV-specific written authorization for either doctor. Did Mary’s doctors violate Art. 27-F?

37. 37 Exception: Disclosures to Other Health Care Providers Answer: No. May disclose HIV related information to a health care provider when it is necessary to provide appropriate care or treatment to: 1.The individual 2.His or her child OR 3.A contact

38. 38 Exception: Disclosures to Other Health Care Providers (cont.)  Person with HIV info – not person seeking it – has authority to decide when disclosure is “necessary” for appropriate care or treatment.  Document the disclosure.  NOTE: Providers may require staff to seek written consent if not an emergency.

39. 39 Other Exceptions Other exceptions include: 1.Physicians’ Disclosures about Minors 2.Case reporting 3.Partner notification 4.Foster care & adoption 5.3 rd party payers 6.Convicted (& some indicted) sex offenders We won’t discuss these here.

40. 40 Review of the Basics: HIV testing

41. 41 Article 27-F – HIV TESTING: THE BASIC RULE  No HIV testing without voluntary, informed, HIV-specific, and written CONSENT  By the person who has capacity to consent to the HIV test.

42. 42 Art. 27-F - HIV testing Capacity to consent Similar to “capacity” standard for disclosures:  Is this individual, regardless of his or her age, 1. Able to understand & appreciate the nature & consequences of the proposed procedure: being tested for HIV? AND 2. Able to make an informed decision about whether or not to have an HIV test?

43. 43 Art. 27-F - HIV testing Capacity to consent (cont.)  Who consents if person getting tested lacks “capacity?” The person authorized by law to make health care decisions for him or her. Example: Parent of minor Court-appointed guardian Health care proxy

44. 44 Article 27-F e xceptions: HIV testing without consent  Mandatory HIV testing allowed: Newborns Convicted and some indicted sex offenders, upon victim’s request (court must order) Foster care (certain circumstances) Lawsuit where HIV status of one party is at issue & material to litigation, and court orders HIV test

45. 45 Part 2: CLIENT ADVOCACY HIV Confidentiality or Testing Rights Violated by a Different agency

46. 46 Part 2: CLIENT ADVOCACY Hand-outs:  Sample Complaint forms  Sample Complaint narrative

47. 47 Client Advocacy – Confidentiality Breach by Different Agency Let’s hear from you:  Ever happened in your agency?  Did you ever receive such a complaint?  What did you do?

48. 48 Client Advocacy – Confidentiality Breach by Different Agency Case scenario: Michael’s Pre-Employment Exam

49. 49 Client Advocacy – Confidentiality Breach by Different Agency  You are Michael’s case worker.  Michael got a new job.  Michael is very upset one day and tells you: new boss said, “I hope you’re feeling OK. I just saw your pre-employment medical report, and it said that you have HIV.”  Michael did not sign a consent for this disclosure – and even told doctor not to disclose. He asks you what he can do. What should you do?

50. 50 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  First – Do you think the doctor violated Michael’s HIV confidentiality rights? Yes. Disclosures to employers are never permitted without HIV-specific, written consent. Even true if HIV status relevant to Michael’s ability to do his job. Still need consent.

51. 51 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  Though you’re not a lawyer – and shouldn’t be the ultimate judge of whether the disclosure was illegal, it’s helpful to think it through if you can.  But don’t tell client: disclosure definitely did or did not violate the law. Could say that you think the disclosure may have violated the law.

52. 52 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  So what do you do next? Options – more on each, later: 1.Counsel client. 2.Do informal advocacy yourself, 3.Refer Michael to attorneys. 4.Refer Michael to an oversight agency.

53. 53 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 1.Counsel your client.  Do encourage your client to explore options and rights. These include:  Informal advocacy  Referral to attorney  Complaints to oversight agencies  Lawsuits.

54. 54 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 1.Counsel your client (cont.).  Do not say definitely – whether disclosure violated the law.  Do not give false hopes of millions of dollars in lawsuit awards.

55. 55 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 2. Informal advocacy with alleged breacher: Help client file complaint with the entity that breached his confidentiality (supervisors, director, legal counsel) Ask for copies of all consent forms Michael signed. Demand a thorough investigation.

56. 56 Client Advocacy – Confidentiality Breach by Different Agency (cont.)  If breach had occurred within Michael’s workplace, educate Michael & employer that – It is illegal to discriminate based on employee’s HIV status, under  Federal law: Americans with Disabilities Act  NYS law: State & NYC Human Rights Laws. Americans with Disabilities Act (ADA) requires employer to maintain confidentiality of HIV information.

57. 57 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 3. Referrals to attorneys. Instead of or in addition to doing informal advocacy yourself Attorneys will evaluate legality of disclosure & counsel client about options. Referral: Legal Action Center, and see www.lawhelp.org. www.lawhelp.org

58. 58 Client Advocacy – Confidentiality Breach by Different Agency (cont.) 4. Refer client to oversight agency (“administrative remedy”). Art. 27-F – DOH Complaint process HIPAA complaint with Office of Civil Rights NYS Office of the Professions (licensed professionals) NYS Office of Professional Medical Conduct (doctors and physician assistants)

59. 59 Administrative remedies: Article 27-F – DOH Process  File complaint with DOH-AIDS Institute, Special Investigation Unit (SIU)  Complaint form is in hand-outs  (800) 962-5065

60. 60 Administrative remedies: Article 27-F – DOH Process (cont.) What will DOH do with it? Confidentiality breach: Might refer it to agency overseeing or employing “breacher” – HRA, DOH Home Care or Hospitals Bureaus, Dept of Correctional Svc HIV testing complaint: Might also refer it to DOH agency overseeing medical professionals/health care facilities, or Office of Professions overseeing other licensed professionals (e.g., nurses)

61. 61 Administrative remedies: Article 27-F – DOH Process (cont.) 5,000 civil fine criminal penalty if willful Usual remedy = “statement of deficiencies” requiring corrective action

62. 62 Administrative remedies: Article 27-F – DOH Process (cont.) May ask attorney, legal service provider like Legal Action Center to represent client in this proceeding But don’t need a lawyer

63. 63 Administrative remedies: Article 27-F – DOH Process (cont.)  Advocating for your client at the DOH ] Help write the complaint  Include details about what happened  Support your conclusion; e.g., don’t assume that because someone learned your client’s status, the breacher had to be X  Sample Complaint Narratives – HIV confidentiality; HIV testing (in hand-outs)

64. 64 Administrative remedies: Article 27-F – DOH Process (cont.)  Monitor progress of complaint  If don’t get resolution, keep calling! Speed and thoroughness of investigations may vary by agency No pre-set timeframes

65. 65 Administrative remedies: Article 27-F – DOH Process (cont.)  Appeal: May appeal within 60 days of mailing of the finding But client likely will not be advised of right to appeal

66. 66 Administrative remedies: Article 27-F – DOH Process (cont.)  Value of the DOH process: Client may feel vindicated; got “justice”; voice was heard Corrective action may prevent further breaches or HIV testing violations Do not need a lawyer Usually much faster than a lawsuit

67. 67 Administrative remedies: Article 27-F – DOH Process (cont.) Downside to DOH process: Depending on which agency reviews case:  may take a long time  may not do thorough investigation  may not take corrective action sufficient for your client Process and correspondence may not be clear to client

68. 68 Administrative remedies: Article 27-F – DOH Process (cont.) Downside to DOH process (cont’d): No money for client Fines & criminal penalties virtually never imposed

69. 69 Administrative remedies: HIPAA violations Penalties  Individuals may file complaint with HHS/Office of Civil Rights  Sample complaint form is in hand-outs  Civil fines are $100 per violation, with a maximum of $25,000/year for each.  Criminal fines: $50,000 to $250,000, & one to ten years imprisonment  HHS usually aims for “corrective action” rather than fines or imprisonment

70. 70 Administrative Remedies: Professional Licensing Rules  Article 27-F and HIPAA violations also might violate State laws/rules governing the professions  Complaints against physicians may be filed with Office of Professional Medical Conduct  opmc@health.state.ny.us opmc@health.state.ny.us  Complaint form is in hand-outs

71. 71 Administrative Remedies: Office of Professional Medical Conduct  Complaints against physicians may be filed with Office of Professional Medical Conduct  opmc@health.state.ny.us opmc@health.state.ny.us  Complaint form is in hand-outs

72. 72 Administrative Remedies NYS Office of the Professions  Complaints against other licensed professionals (e.g., social workers, pharmacists; nurses, CBO counseling and testing providers)  Can be filed with NYS Education Dept., Office of the Professions  Central office: 212/951-6400  Complaint form is in hand-outs

73. 73 Lawsuits  May sue in court for violations of Article 27-F confidentiality & HIV testing provisions  Generally need a lawyer  May not sue for HIPAA violations.

74. 74 Lawsuits (cont.)  Damages include: Emotional harm  Did the word spread to others?  Ostracism?  Depression? Isolation?  Anger?  Lost sleep or appetite? Employment consequences; Lost wages

75. 75 Lawsuits (cont.) Damages also include: Physical harm:  Affected ability/willingness to stay in health care?  Stress-related complications? Other out-of-pocket losses Punitive damages (sometimes)

76. 76 Lawsuits (cont.)  Don’t give client unrealistic expectation of easy money  Downside to lawsuits: Can take many years Hard to find free legal counsel Have to relive the trauma through testimony and continuous contact with attorney

77. 77 Lawsuits (cont.)  Downside to lawsuits (cont’d): Adversarial model can make clients even angrier, as wrongdoer may defend position Client’s emotional life & personal behavior & HIV status will be on display and subject to probing

78. 78 Lawsuits (cont.)  Advantages of lawsuits: Might win or get good settlement Victory/good settlement might feel like “justice” Publicity/legal precedent may help educate others about issues and individuals’ rights and legal protections

79. 79 Part 3: CLIENT ADVOCACY HIV Confidentiality or Testing Rights Violated by Your Agency

80. 80 CLIENT ADVOCACY Let’s hear from you:  Did anyone ever complain to you about your own agency’s breach of confidentiality/testing rights?  What did you do?

81. 81 CLIENT ADVOCACY Case scenario: Rita’s home health aide  You’re a supervisor in a home care agency  Rita calls you to complain: Rita’s neighbor said he found out Rita’s HIV status from her home health aide.  Rita wants a different aide, but she also demands that the aide be fired.  What should you do?

82. 82 CLIENT ADVOCACY  Follow your agency’s complaint procedure.  Make sure your agency’s complaint procedure complies with HIPAA.

83. 83 HIPAA requires covered entities to: 1.Provide process for patients to make complaints concerning HIPAA policies and procedures. 2.Establish sanctions to be imposed against workforce for violations of privacy policies. Responding to Complaints – Your Agency

84. 84 Responding to Complaints – Your Agency (cont’d) HIPAA also requires covered entities to: 3.Designate a staff member to be responsible for receiving complaints. (Can be the privacy official.) 4.Document all complaints received and their disposition.

85. 85 Responding to Complaints – Your Agency (cont’d) Suggestion: Acknowledge importance of confidentiality Don’t belittle client’s complaint Inform client – complaint procedure Don’t give client the “run around”

86. 86 Responding to Complaints – Your Agency (cont’d)  Conduct thorough investigation Talk to witnesses Look at documentation Get client’s feedback

87. 87 Responding to Complaints – Your Agency (cont’d)  After investigation & conclusion: Retrain staff/remind them of policies – even if no violation occurred Deliver conclusion to client respectfully

88. 88 Responding to Complaints – Your Agency (cont’d)  If violation is verified: Apologize Take disciplinary action against individual who violated the law Update agency policies, if necessary, to prevent further violations Train staff about policies Inform client – corrective actions taken

89. 89 Responding to Complaints – Your Agency (cont’d)  Good practice to understand the harm: May believe “everyone” knows status; life will never be the same Severe emotional harm – depression, anxiety, paranoia Anger Ostracism and even physical harm Reliving trauma of diagnosis

90. 90 Responding to Complaints – Your Agency (cont’d)  Understand what client might want: vindication; acknowledgment that someone hurt them policy change & training: “this shouldn’t happen to anyone else” money

91. 91 Call on us for help!  Legal services for people affected by HIV/AIDS – statewide!  Training on HIV-related legal issues for HIV service providers – statewide!  Hot-line and technical assistance on HIV-related legal issues – statewide! Legal Action Center: 212-243-1313 or 800-223-4044

92. 92 That’s it. Thank you!