HIPAA and 42 C.F.R. Part 2 Confidentiality Terri S. Morrison First Assistant Legal Counsel Colorado Judicial Department HIPAA and 42 C.F.R. Part 2 Confidentiality Best Practices Conference, April 27, 2011

Confidentiality of Alcohol and Drug Abuse Records 42 U.S.C. § 290 dd-2 Confidentiality of Alcohol and Drug Abuse Records

42 U.S.C. §290dd-2 Enacted in the early 1970’s to guarantee confidentiality of information about persons receiving alcohol and drug prevention and treatment services Amended in 1986 to permit mandated reporting of child abuse Amended 1992, consolidated drug and alcohol “substance” abuse

Code of Federal Regulations 42 C.F.R. Part 2 Issued in 1975 revised in 1987 Federal agency primarily responsible for implementing and interpreting Regulations: Dept. of Health and Human Services

Why Privacy Protection? Reduction of stigma Fostering trust Preserving confidentiality Encourage people to seek help Avoid damaging consequences of disclosure

HIPAA, 42 U.S.C. §1320d-1320d-8 Health Insurance Portability and Accountability Act of 1996 45 C.F.R. Parts 160 and 164 Rules enacted in 2003

HIPAA and 42 C.F.R. Part 2 Both prohibit the use and disclosure of records or other patient related information.

Both Regulations. . . “establish standards for maintenance, use and disclosure of health information, including what must be done before a disclosure of confidential information can be made, the manner in which the information may be disclosed, and to whom it may be disclosed.” -- Confidentiality and Communication Legal Action Center 2006

Brief Comparison HIPAA 42 C.F.R. Part 2 Permits but does not mandate disclosure of health information: Permits disclosure for w/out consent for payments Requires patient access to records Prohibits all disclosures except those specifically allowed by the regulations Prohibits disclosure without patient consent Permits patient access to records

Who is Covered? HIPAA 42 C.F.R. PART 2 “Program”- any person or organization that in whole or in part provides alcohol or drug abuse diagnosis, treatment or referral for treatment or prevention; AND “Federally assisted”- receives fed’l funds even if funds do not pay for D/A services “Covered entity”: Health Plans Health care clearinghouses Health care providers who transmit health information in electronic form Courts are NOT

HIPAA requirements for Covered Entity Privacy Official Training Safeguards– admin., tech., physical Complaints Track and document disclosures Disclose minimum information Document policies, procedures and designations

Consent Required, 42 C.F.R. Part 2 Disclosure of treatment records content is only permitted in the manner specified by statute, a general release does not suffice. Without consent, a specific court order is required Order must be for non-criminal purposes, 42 C.F.R. §2.64(a); notice of application to person whose records are sought and opportunity to respond or appear §2.64(b)

Elements of Written Consent Name or designation of program making disclosure Name/title of person to whom disclosure is made Name of the patient/client Purpose of the disclosure How much and what kind of info. to disclose Signature of patient/ minor with parent*

Elements of Consent (cont’d) Date consent signed Statement re: revocation Date, event or condition upon which consent expire (e.g. termination of probation)

Prohibition on Redisclosure 42 C.F.R. §2.32 Written statement that must accompany each disclosure made with the patient’s consent Informs the recipient of the prohibition on redisclosure and specific release requirement Indicates that Federal rules restrict use of information to criminally investigate or prosecute a patient

Disclosure to Criminal Justice System, 42 C.F.R. §2.35 May be made to those who have made participation a condition of the disposition of a criminal proceeding Only to those with a need to monitor progress Signed consent of patient Redisclosure only to carry out official duties

Subpoena & 42 C.F.R. Part 2 A subpoena is insufficient to overcome the privacy protection of 42 C.F.R. Part 2 A court must find good cause for ordering release after finding Other ways not available or not effective Public interest and need outweigh potential injury to the patient See United States v. Oberle, 136 F. 3d 1414, 1420 (10th Cir. 1998) finding no good cause for release

HIPAA and Qualified Protective Order Court order or stipulation by parties that information will not be used other than for litigation purposes and PHI will be returned or destroyed at end of litigation

Death of Patient HIPAA 42 C.F.R. Part 2 Allows disclosure to coroner, medical examiner or funeral director If covered entity believes patient suffered a suspicious death can disclose to law enforcement Requires consent from legal representative or family member If covered entity believes patient suffered a suspicious death can disclose to law enforcement

Exceptions to the general rule 42 C.F.R. Part 2 Written consent Internal communications No identifying information Medical emergency Court order Crime at program Research Audit and evaluation Child abuse

Mandated reporting of child abuse Substance abuse by itself not a condition that must be reported as child abuse or neglect, there must be some reason to suspect actual or imminent harm to a child Release only applies to initial reports– subsequent reports require consent or court order.

Medical and Mental Health Records HIPAA § 27-10-120(1)(f), C.R.S. allows access to MH records only to persons authorized by court order after notice and opportunity for hearing for person who is subject of the record and the custodian of the record §13-90-107(1), C.R.S. governs who may not testify w/out consent—physicians, therapists

Medical and Mental Health Records People v. Reynolds, 578 P.2d 647,649 (Colo. 1978) the privileges afforded by §13-90-107, C.R.S. apply equally in criminal cases where confidential medical and MH information is sought §18-4-412, C.R.S. crime to disclose medical and MH information without authorization, “theft”

Medical and Mental Health Records Johnson v. Trujillo, 977 P.2d 152 (Colo. 1999) the party seeking to overcome the privilege bears the burden of establishing that the privilege has been waived Privacy attaches to medical matters Whalen v. Roe, 429 U.S. 589-600-01(1977); People v. Sisneros, 55 P.3d 797 (Colo. 2002)