1. Copyright 2006 Rubin Law Firm, LLC Drafting HIPAA Compliant Subpoenas & Discovery Presented by:RACHEL B. RUBIN Kansas Bar Association Annual Meeting June 10, 2006 Rubin Law Firm, LLC 4601 College Blvd., Suite 280 Leawood, KS 66211 (913) 322-8950 rachel@rrubinlaw.com www.rrubinlaw.com

2. Copyright 2006 Rubin Law Firm, LLC Drafting HIPAA Compliant Subpoenas HIPAA privacy regulations protect patient medical information. “Protected Health Information” or “PHI” Definition of PHI:Individually Identifiable Health Information that is transmitted by or maintained in electronic or any other form.

3. Copyright 2006 Rubin Law Firm, LLC PROTECTED HEALTH INFORMATION “Individually Identifiable Health Information” 45 CFR 160.103. Very broad definition: Includes all types of medical information regarding an individual’s past, present or future physical or mental health or condition, the provision of health care, or payment for health care, that identifies the individual.

4. Copyright 2006 Rubin Law Firm, LLC GENERAL RULE UNDER HIPAA: –A Covered Entity CANNOT use or disclose PHI without obtaining a WRITTEN AUTHORIZATION from the patient. –“Covered Entity” includes a health care provider (physician, dentist, hospital, ASC, etc); health plan, or health care clearinghouse (e.g. a hospital/physician billing company).

5. Copyright 2006 Rubin Law Firm, LLC EXCEPTIONS Primary Exception: treatment, payment or healthcare operations. Minimum Necessary Information: Disclose ONLY the minimum necessary to accomplish the intended purpose of the use, disclosure or request.

6. Copyright 2006 Rubin Law Firm, LLC OTHER EXCEPTIONS(45 CFR 164.512) Additional exceptions allow Covered Entity to use or disclose PHI without written patient authorization: Required by law; Public health activities; Victims of abuse, neglect or domestic violence; Health oversight activities (e.g., Board of Healing Arts) Judicial or administrative proceedings; Law Enforcement purposes; Decedents; Organ, eye or tissue donation at death; Research purposes; To avert a serious threat to health or safety; Specialized government functions (e.g. military); Worker’s Compensation

7. Copyright 2006 Rubin Law Firm, LLC Worker’s Compensation Worker’s Comp treatment records may not include all records you want. –General treatment records are (or should be) maintained separately from Worker’s Comp treatment records. –Should request specific authorization to obtain patient’s general treatment records.

8. Copyright 2006 Rubin Law Firm, LLC OTHER EXCEPTIONS (45 CFR 164.512) Always check the regulations--the requirements to meet any of these exceptions are hyper-technical.

9. Copyright 2006 Rubin Law Firm, LLC REQUEST FOR PHI PURSUANT TO SUBPOENA OR COURT ORDER HIPAA requires a Covered Entity to respond differently to a subpoena or discovery request, and an order of a court or administrative tribunal. Distinction between Subpoena (KSA 60-245 & 60-245a) & Court Order

10. Copyright 2006 Rubin Law Firm, LLC PURSUANT TO COURT ORDER Covered Entities MUST DISCLOSE PHI if it receives a court order specifically ordering it to release an individual’s PHI. Covered Entity may only disclose the PHI that is expressly authorized under the court order, and not more. Court order should demonstrate to the Covered Entity that HIPAA was considered & that the patient had opportunity to be heard & object to disclosure.

11. Copyright 2006 Rubin Law Firm, LLC PURSUANT TO SUBPOENA, DISCOVERY OR OTHER LAWFUL PROCESS Under HIPAA, Covered Entities should NOT provide PHI based solely on receipt of a subpoena or discovery request. Additional requirements must be met: 1.Satisfactory assurance from the Requestor that reasonable efforts have been made to ensure that the patient has been given notice of the request; OR 2.Satisfactory assurance from the Requestor that a qualified protective order has been obtained.

12. Copyright 2006 Rubin Law Firm, LLC ALTERNATIVE 1:NOTICE TO PATIENT In addition to subpoena, Requestor must provide Covered Entity with written statement and documentation which demonstrates that: –Good faith attempt to provide written notice to the individual; –Notice included sufficient information to permit individual to raise objection in court; & –Time for individual to raise objections in court has expired & no objections were filed; or all objections have been resolved by court.

13. Copyright 2006 Rubin Law Firm, LLC ALTERNATIVE 2:QUALIFIED PROTECTIVE ORDER Requestor must provide Covered Entity with written statement and documentation which demonstrates that: –The parties to the request for information have agreed to a qualified protective order & have presented it to the court; or –Requestor has sought a qualified protective order from the court.

14. Copyright 2006 Rubin Law Firm, LLC DEFINITION OF “QUALIFIED PROTECTIVE ORDER” 45 CFR 164.512(e)(1)(v) –Prohibits parties from using or disclosing the PHI for any other purpose; –An order of a court or administrative tribunal, or a stipulation by the parties; and –Requires return of PHI to Covered Entity or destruction of PHI, including all copies made, at end of litigation or proceeding.

15. Copyright 2006 Rubin Law Firm, LLC HIPAA Enforcement Office for Civil Rights (Civil); DOJ (Criminal) Potential Civil & Criminal Penalties for Violations of HIPAA –Civil Money Penalties –Criminal sanctions for individuals/entities whose conduct is governed by HIPAA –No private cause of action set forth in statute or regulations

16. Copyright 2006 Rubin Law Firm, LLC Other Applicable Privacy Laws: Alcohol & Drug Abuse Treatment Records (42 U.S.C. 290dd; 42 U.S.C. 290ee, 42 C.F.R. 2.1 et seq.) –Protects identity, diagnosis, prognosis or treatment of patient Participation in Medicare/Medicaid subjects a hospital or facility to this statute

17. Copyright 2006 Rubin Law Firm, LLC Alcohol & Drug Abuse Treatment Records Such records may not be used in any civil, criminal, administrative or legislative proceedings conducted by federal, state or local authority. Disclosures limited to information necessary to carry out purpose of disclosure. Answer to request for disclosure may not reveal patient’s identity or whether they have sought treatment.

18. Copyright 2006 Rubin Law Firm, LLC (See 42 U.S.C. 290dd-2(b) & 42 C.F.R. 2.31(a). Alcohol & Drug Abuse Treatment Records (See 42 U.S.C. 290dd-2(b) & 42 C.F.R. 2.31(a). Disclosure is permitted with prior written consent of patient. Consent must contain certain elements: –Name of program & patient; purpose of disclosure; type of information to be disclosed; signature of patient; expiration date. –Regulations contain model written consent form. (42 CFR 2.31). Similar to HIPAA, but different statutory scheme. Protections continue regardless of individual’s status as patient.

19. Copyright 2006 Rubin Law Firm, LLC (See 42 USC 290dd-2(b) & 42 CFR 2.61) Alcohol & Drug Abuse Treatment Records (See 42 USC 290dd-2(b) & 42 CFR 2.61) Provision in statute for Court Order: –Must show good cause, including need to avert substantial risk of death or serious bodily harm. –Court to weigh public interest & need for disclosure against injury to patient, the physician-patient privilege, & treatment. –Court must impose appropriate safeguards against unauthorized disclosure.

20. Copyright 2006 Rubin Law Firm, LLC (See 42 U.S.C. 290dd-2(b) & 42 C.F.R. 2.31(a). Alcohol & Drug Abuse Treatment Records (See 42 U.S.C. 290dd-2(b) & 42 C.F.R. 2.31(a). No preemption of state law, if state law more restrictive. (42 CFR 2.20). Criminal penalty for violation of statute: –Not more than $500 for 1 st offense; Not more than $5,000 for each subsequent offense. (42 CFR 2.4). –Reports of violations made to U.S. Attorney where violation occurred. –No private cause of action set forth in statute or regulations.

21. Copyright 2006 Rubin Law Firm, LLC Other Applicable Privacy Laws No preemption of state law, so long as state law is more stringent, e.g. state has more protections for patient information. (See 45 CFR 160.201.) HIV/AIDS STATUS UNDER KANSAS LAW: –Confidential; no disclosure –K.S.A. 65-6002 – no disclosure of HIV/AIDS status, upon subpoena or otherwise, unless patient consents in writing –No provision in statute for Court Order to disclose HIV/AIDS status

22. Copyright 2006 Rubin Law Firm, LLC Summary Safest route for Covered Entity is to obtain patient’s written authorization to use or disclose patient’s PHI. Subpoena for PHI by itself will not satisfy requirements under HIPAA; opens door to motion to quash. Subpoena must be accompanied with written statement & supporting documentation that: 1) patient has been notified of request for PHI & has not objected to disclosure, OR 2) protective order has been obtained. Attorney who wants PHI may need to obtain court order to ensure compliance by Covered Entity.

23. Copyright 2006 Rubin Law Firm, LLC Summary Other state and federal privacy laws may also apply; HIPAA is NOT the end of inquiry Common law doctrines of privacy & confidentiality; breach of fiduciary duty; Potential violation of Healing Arts Act for “unprofessional conduct,” even if no private cause of action exists.

24. Copyright 2006 Rubin Law Firm, LLC Summary