STATE BAR OF TEXAS MARRIAGE DISSOLUTION: 2015 APRIL 10, 2015 DALLAS, TEXAS

HIPAA is the federal law which protects the confidentiality of a patient’s protected health information (“PHI”) which is maintained by a covered entity. -45 C.F.R. § (2009) 2

Protected Health Information: All individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. (Excludes individually identifiable health information in certain education records and employer files)

Individually identifiable health information: Information, including demographic data, collected from the individual, that is:  (1) created or received by a health-care provider, health plan, employer, or health-care clearinghouse,  (2) relates to: the individual’s past, present or future physical or mentalhealth, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and  (3) that identifies the individual, or for which there is a reasonable basis to believe it can be used to identify the individual.

Covered entity: Health plan, health-care clearinghouse, and a health-care provider who transmits any health information in electronic form in connection with a transaction covered by 45 C.F.R. subchapter C.

1.Patient may personally request the information; 2.Patient may sign an authorization in favor of a third party; 3.Party seeking the information may obtain a court order pursuant to 45 C.F.R. § (e); or 4.Party seeking the information can use a subpoena, discovery request, or other lawful process. 6

A covered entity may also disclose PHI in response to: (1)Subpoena, (2)Discovery request, or (3)Lawful process not accompanied by a court order. Party seeking information must provide covered entity satisfactory assurance that reasonable efforts have been made to: (1) ensure that the individual who is the subject of the requested PHI has been given notice of the request, or (2)to secure a qualified protective order that meets the requirements of 45 C.F.R. section (e)(1)(v). -45 C.F.R. § (e)(1)(ii)(A), (B). 7

Provide covered entity with a written statement and accompanying documentation demonstrating that: (1) Party requesting PHI has made a good faith attempt to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address); (2) The notice included sufficient information about the litigation in which the PHI is requested to permit the individual to raise an objection; and (3) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and: (i) No objections were filed; or (ii) All objections have been resolved by the court and the disclosures being sought are consistent with such resolution. -45 C.F.R. § (e)(1)(iii)

Provide a written statement and accompanying documentation demonstrating that: (A) The parties have agreed to a qualified protective order; or (B) The party seeking the PHI has requested a qualified protective order from the court. Qualified Protective Order: (A) Prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which such information was requested; and (B) Requires the return to the covered entity or destruction of the PHI at the end of the litigation or proceeding. -45 C.F.R. § (e)(1)(iv)

Tex. Health & Safety Code § (2) expands HIPAA’s definition of “covered entities” as including a person or entity that: ◦ (a) Engages in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting PHI; ◦ (b) Comes into possession of PHI; (c) Obtains or stores PHI; or ◦ (d) Is an employee, agent, or contractor of a person described in (a) – (c ).

 Attorney’s are held to the privacy and security standards of the Texas Health & Safety Code.  Attorneys are now subject to criminal and civil penalties for privacy and security violations. -Tex. Health & Safety Code § et. seq

◦ Obtain an authorization from your client to allow you to use their medical records in the course of the lawsuit, including when responding to discovery requests. ◦ Include language in authorization presented to opposing party for obtained records to be used in hearings, trial, and deposition.

 Covered entity must provide notice to an individual for whom the covered entity creates or receives PHI if the individual’s PHI is subject to electronic disclosure.  A general notice can satisfy this requirement. ◦ Practice Pointer: Post written notice in the office, on firm’s website, or any other place where it is likely to be seen. -Tex. Health & Safety Code § (a)

 All employees of a covered entity must be trained on applicable state and federal law concerning the protection of health information.  Training to be commensurate with employee’s duties.  Training should include:  Security and access of PHI  Proper disclosure or release of PHI, and  How to properly request PHI from third parties.  Personnel not working directly on a specific case or matter should not have access to any PHI or other confidential information. -Tex. Health & Safety Code § (a)

 Health provider using an electronic record system is not required to produce medical records upon request, even with a written authorization, in less than 15 business days.  15 day turn around time applies to health providers and not “covered entities.” -Tex. Health & Safety Code § (a)

 Texas health care providers have a right to require a reasonable fee for copying the records.  Can refuse to produce records even with an appropriate patient authorization if reasonable fee is not paid. -Tex. Health & Safety Code § (b); 22 Tex. Admin Code § 165.2(b)

Confidential Mental Health Information: 1)Communications between a patient and a professional, and 2)Records of the identity, diagnosis,evaluation, or treatment of a patient that are created or maintained by a professional. - Tex. Health & Safety Code § (a). 17

"Patient" means a person who consults or is interviewed by a professional for diagnosis, evaluation, or treatment of any mental or emotional condition or disorder, including alcoholism or drug addiction. -Tex. Health & Safety Code §

1.A person authorized to practice medicine in any state or nation; 2.A person licensed or certified by Texas to diagnose, evaluate, or treat any mental or emotional condition or disorder; or 3.A person the patient reasonably believes is authorized, licensed, or certified as provided by Texas Health and Safety Code § (2). -Tex. Health & Safety Code §

Confidential communications or records may not be disclosed except as authorized by: 1.Health and Safety Code Section , 2.Health and Safety Code Section , 3.Health and Safety Code Section Tex. Health & Safety Code § (b). 20

A professional may disclose confidential information to: (1) A person who has the written consent of the patient, or (2) A parent if the patient is a minor, or (3) A guardian if the patient has been adjudicated as incompetent to manage the patient's personal affairs.

A patient is entitled to have access to the content of a confidential record made about the patient, except that – the professional may deny access to any portion of a record if the professional determines that release of that portion would be harmful to the patient's physical, mental, or emotional health.

A professional may disclose confidential information in: (1) a judicial proceeding in which the patient waives in writing the right to the privilege of confidentiality; (2) a judicial proceeding if the judge finds that the patient, after having been informed that communications would not be privileged, has made communications to a professional in the course of a court ordered examination relating to the patient's mental or emotional condition or disorder;

(3) a judicial proceeding affecting the parent child relationship; (4) a judicial or administrative proceeding where the court or agency has issued an order or subpoena.

 Parent’s right of access to a child’s psychological records is not absolute despite court-ordered right to access child’s psychological records and statute authorizing disclosure of confidential information to a parent.  Mental health professional is not required to provide access to a child’s confidential records if parent who requests them is not acting on behalf of the child.  Professional may also deny a parent who is acting on the child’s behalf access to child’s records under Section (b).

 Individual may petition the district court of the county in which the person resides for appropriate relief to contest the denial of access.  If individual is not a resident of Texas, person may petition a Travis County district court.  If professional denies access to patient, process to compel records is outlined in Health & Safety Code § , and burden of proving denial is proper is on the professional denying access. -Texas. Tex. Health & Safety Code §

 A person who receives information from confidential communications or records may not disclose the information beyond the authorized purposes for which the person obtained the information.  A person aggrieved by improper disclosure of confidential information has a civil cause of action for damages. -Tex. Health & Safety Code § § (d); (c). 27

The following records are generally confidential and may be disclosed only for specified purposes – Records of the identity, diagnosis, prognosis, or treatment of any patient that are maintained in connection with the performance of any program or activity relating to alcoholism or drug abuse or alcohol/drug-abuse education, training, treatment, rehabilitation, or research that is conducted, regulated, or directly or indirectly assisted by any federal department or agency. -42 C.F.R. § § 2.1;

Consent Requirements:  Specific name or general designation of the program or person permitted to make the disclosure;  Name or title of the individual or the name of the organization to which disclosure is to be made;  Purpose of the disclosure;  How much and what kind of information is to be disclosed;  Expiration date, event, or condition no later than reasonably necessary to fulfil purpose;  Statement that consent is subject to revocation anytime. -42 C.F.R. § 2.31(a). 29

 Any person having a legally recognized interest in the disclosure can petition court for disclosure in civil proceeding.  Application may be filed independently or as part of a pending civil suit. 30

 Must use a fictitious name (i.e. John Doe) to refer to patient.  May not contain or otherwise disclose any patient identifying information, unless- a) patient is the applicant, b) patient has given written consent to disclosure, or c) court has ordered the record of the proceeding sealed.  Adequate notice to patient and person holding the records to file a written response or to appear in court to provide evidence on the statutory and regulatory criteria for disclosure. Required notice cannot disclose patient identifying information to other persons. -42 C.F.R. § 2.64(a); 42 C.F.R. § 2.64(b).. 31

 Any oral argument, review of evidence, or hearing on the application must be held in the judge’s chambers or in some manner which ensures that patient identifying information is not disclosed to anyone other than a party to the proceeding, the patient, or the person holding the record, unless the patient requests an open hearing in a manner that meets the written consent requirements of the regulations.  Judge may examine patient records sought in the application. -42 C.F.R. § 2.64(c). 32

Order for disclosure of the records can only be entered if court determines “good cause” exists for disclosure.  Good cause exists when: (1) no other means of obtaining the information are available; and (2) the public interest and the need for disclosure outweighs the injury to the patient, to the physician-patient relationship, and to the treatment services.

 Court may order disclosure of confidential communications made by a patient to a program in the course of diagnosis, treatment, or referral for treatment only if: 1.Disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances that constitute suspected child abuse and neglect and verbal threats against third parties; 34

2.Disclosure is necessary in connection with the investigation or prosecution of an extremely serious crime, such as one that directly threatens loss of life or serious bodily injury, including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, or child abuse and neglect; or 3.Disclosure is in connection with litigation or other administrative proceedings in which the patient offers testimony or other evidence pertaining to the content of the confidential communications. -42 C.F.R. § 2.63(a). 35

 Any person who violates the regulations relating to the confidentiality of alcohol- or drug-treatment records shall be fined not more than $500 in the case of a first offense and not more than $5,000 in the case of each subsequent offense. -42 C.F.R.§ 2.4.

Except as provided by TFC § , the following information is confidential, and is not subject to public release under Chapter 552, Government Code: (1)a report of alleged or suspected abuse or neglect made under TFC Chapter 261 and the identity of the person making the report; and (2)except as otherwise provided in this section, the files, reports, records, communications, audiotapes, videotapes, and working papers used or developed in an investigation or in providing services as a result of an investigation.

 Notwithstanding Subsection (b), the department, on request and subject to department rule, shall provide to the parent, managing conservator, or other legal representative of a child who is the subject of reported abuse or neglect information concerning the reported abuse or neglect that would otherwise be confidential if the department has edited the information to protect the confidentiality of the identity of the person who made the report and any other person whose life or safety may be endangered by the disclosure.

A court may order the disclosure of information that is confidential under TFC § if: (1)a motion has been filed with the court requesting the release of the information; (2) a notice of hearing has been served on the investigating agency and all other interested parties; and

(3) after hearing and an in camera review of the requested information, the court determines that the disclosure of the requested information is: (A) essential to the administration of justice; and (B) not likely to endanger the life or safety of: (i) a child who is the subject of the report of alleged or suspected abuse or neglect; (ii) a person who makes a report of alleged or suspected abuse or neglect; or (iii) any other person who participates in an investigation of reported abuse or neglect or who provides care for the child. -TFC § (b)

Court, on its own motion, may order disclosure of information that is confidential under TFC § if: (1)the order is rendered at a hearing for which all parties have been given notice; (2) the court finds that disclosure of the information is: (A) essential to the administration of justice; and

(B) not likely to endanger the life or safety of:  (i) a child who is the subject of the report of alleged or suspected abuse or neglect;  (ii) a person who makes a report of alleged or suspected abuse or neglect; or  (iii) any other person who participates in an investigation of reported abuse or neglect or who provides care for the child; and (3) the order is reduced to writing or made on the record in open court.

◦ Texas Finance Code § ◦ Freedom of Information Act ◦ Chapter 522 of Texas Government Code (Texas Public Information Act) 43

45