1. Confidentiality of MH/DD/SA Records Family Court Conference March 9, 2006 Mark Botts School of Government, UNC

2. Applicable Confidentiality Laws State law governing MH/DD/SA providers—GS 122C Federal law governing health care providers—45 CFR (HIPAA Privacy Rule) Federal law governing substance abuse programs—42 CFR Part 2

3. Each confidentiality law: Defines the providers that it governs Defines the information that it governs Permits providers to disclose information in certain situations Requires providers to disclose information in certain situations

4. Tools for Obtaining Confidential Information Provisions permitting disclosure with the authorization of the patient or the patient’s legal representative Provisions permitting or requiring disclosure in response to a court order Provisions permitting or requiring disclosure in other situations that might sometimes apply to family court cases

5. Patient Authorization A provider must obtain a patient’s written authorization for any disclosure that is not otherwise permitted or required by the applicable privacy law An authorization permits but does not require the covered entity to use or disclose PHI

6. Authorization Must Be Voluntary Provider may not condition the provision of treatment or eligibility for benefits on receiving an authorization Except may condition the provision of health care that is solely for the purpose of creating information for disclosure to a third party on an authorization for such disclosure

7. Authorization Must Be Voluntary An individual may revoke an authorization at any time by putting the revocation in writing except to the extent that the provider has taken action in reliance on the authorization

8. Authorization Form (State MH/DD/SA Law) client's name name of facility releasing the information name of individual(s) to receive information information to be released the purpose for the release length of time consent is valid (1 yr. max.) statement that consent is revocable signature of client/legally responsible person date consent is signed

9. Authorization—HIPAA adds to state law requirements: A description of the provider’s revocation procedure or reference to provider’s “notice of privacy practice” Statement that treatment may not be conditioned on receipt of authorization or statement regarding consequences of refusing to sign where conditioning is permitted Statement about potential for redisclosure

10. Authorization (Federal SA Law) Consent form must contain the same elements as required by state law

11. Who May Consent to Release (not/SA records) Adult client who has not been adjudicated incompetent Guardian of the person or general guardian of an adult client adjudicated incompetent Emancipated minor Legally responsible person for a minor when the minor is being treated pursuant to the LRP’s consent Unemancipated minor who is being treated pursuant to his or her own consent

12. Who May Consent to Release of SA Records Same rules provided in previous slide except that when an unemancipated minor is being treated pursuant to the consent of the minor’s legally responsible person, both the LRP and the minor must sign the consent for disclosure

13. Subpoenas A subpoena, alone, does not permit disclosure of information protected by the state mental health law (GS 122C) or the federal substance abuse records law (42 CFR Part 2) Although the HIPAA privacy rule permits providers to disclose in response to a subpoena, GS 122C and 42 CFR 2 control (where applicable)

14. Court Order GS 122C requires, and HIPAA permits, a provider to disclose in response to a court order No particular procedure, criteria, or findings are required by either law NC privilege statutes: a judge may order disclosure when “necessary to the proper administration of justice”

15. Court Order—SA Records Patient and provider must be given notice and opportunity to respond Judicial review of records must be in camera Court must find “good cause” for disclosure Court must limit disclosure (to essential parts of record and to persons who need the information)

16. Child Protective Services All three confidentiality laws permit disclosure of information while making a report under GS 7B-301 Only GS 122C and HIPAA permit disclosure to DSS that is investigating report or providing protective services Only GS 122C and HIPAA permit disclosure to GAL appointed under GS 7B-601

17. Juvenile Petitions State law requires designated agencies to share with one another, upon request, information in their possession that is relevant to any case in which a petition has been filed alleging that a juvenile is abused, neglected, dependent, undisciplined, or delinquent (GS 7B- 3100, 28 NCAC 01A.0300)

18. Juvenile Petitions—GS 7B- 3100 Disclosures GS 122C-54(h) requires a mental health facility to disclose information as required by other state law Section 164.512(a) of the privacy rule permits providers to disclose protected information as required by law The federal SA law does not permit the disclosure of patient-identifying information pursuant to GS 7B-3100