1. Mental Health Issues & Information Sharing Professor Peter P. Swire The Ohio State University NAAG Task Force on School Safety July 5, 2007

2. Overview My background My background When does information sharing actually help? When does information sharing actually help? HIPAA HIPAA FERPA FERPA Reasons to do due diligence before assuming that information sharing has net benefits Reasons to do due diligence before assuming that information sharing has net benefits

3. My Background Currently: Currently: Moritz College of Law, Ohio State U. Moritz College of Law, Ohio State U. Senior Fellow, Center for American Progress Senior Fellow, Center for American Progress Research on privacy, consumer protection, computer security & homeland security Research on privacy, consumer protection, computer security & homeland security 1999 to early 2001: 1999 to early 2001: Chief Counselor for Privacy, OMB Chief Counselor for Privacy, OMB White House coordinator, HIPAA privacy rule White House coordinator, HIPAA privacy rule Led HIPAA/FERPA process Led HIPAA/FERPA process

4. I. When Will Info Sharing Help? 2006 article Privacy & Information Sharing in the War Against Terrorism 2006 article Privacy & Information Sharing in the War Against Terrorism Due diligence list for proposed info sharing Due diligence list for proposed info sharing Often, undue optimism that good things will happen with info sharing Often, undue optimism that good things will happen with info sharing Be careful what you wish for … Be careful what you wish for …

5. Be Careful What You Wish For Suppose state AGs received reports on: Suppose state AGs received reports on: Every troubled or depressed youth Every troubled or depressed youth Every suspicious gun purchase Every suspicious gun purchase Every threat by a teen against another Every threat by a teen against another

6. If State AGs Get the Data If you receive the information, what do you do with it? If you receive the information, what do you do with it? Investigate every lead? Investigate every lead? Is that a good use of resources? Is that a good use of resources? The problem of false positives and a quick check (that you can afford) wont be good at telling the one in ten thousand that is truly dangerous The problem of false positives and a quick check (that you can afford) wont be good at telling the one in ten thousand that is truly dangerous

7. If State AGs Get the Data What if you receive the info but do nothing with it? What if you receive the info but do nothing with it? The wasted resources to create an information sharing system that is not used The wasted resources to create an information sharing system that is not used When the next thing goes wrong, lots of finger pointing about why nothing was done to prevent the incident When the next thing goes wrong, lots of finger pointing about why nothing was done to prevent the incident In short, do info sharing if and only if there are net benefits, after due diligence In short, do info sharing if and only if there are net benefits, after due diligence

8. II. HIPAA Basics HIPAA applies only to covered entities HIPAA applies only to covered entities For your purposes, providers and health insurers (as well as their business associates) For your purposes, providers and health insurers (as well as their business associates) Others who create or transmit health care data are not covered Others who create or transmit health care data are not covered State public health agencies broadly exempted State public health agencies broadly exempted But often have state or local laws that are stricter, and they may limit sharing But often have state or local laws that are stricter, and they may limit sharing

9. Disclosure from Covered Entities Basic rule – disclosure from covered entities only with patient authorization (an opt in) Basic rule – disclosure from covered entities only with patient authorization (an opt in) Some important exceptions Some important exceptions Required by law – gunshot wounds & other required reports Required by law – gunshot wounds & other required reports Disclosure to public health agencies Disclosure to public health agencies Legal proceedings – a judge can order Legal proceedings – a judge can order Law enforcement access, usually with an administrative subpoena Law enforcement access, usually with an administrative subpoena

10. HIPAA & Mental Health Psychotherapy notes are more strictly protected Psychotherapy notes are more strictly protected Follows Jaffee v. Redmond and stronger privilege for psychotherapy care Follows Jaffee v. Redmond and stronger privilege for psychotherapy care Many HIPAA exceptions dont apply Many HIPAA exceptions dont apply Not the usual law enforcement access Not the usual law enforcement access Not the usual judge-order court access Not the usual judge-order court access Strong idea of privilege in order to assure patient openness in therapy Strong idea of privilege in order to assure patient openness in therapy

11. HIPAA & Mental Health Sometimes disclosure is permitted Sometimes disclosure is permitted Tarasoff situation – in order to prevent or lessen the risk of a serious or imminent threat to the health or safety of a person or the public Tarasoff situation – in order to prevent or lessen the risk of a serious or imminent threat to the health or safety of a person or the public Scope of psychotherapy notes, though, is limited Scope of psychotherapy notes, though, is limited Are notes kept separate from a patients standard medical file Are notes kept separate from a patients standard medical file

12. III. FERPA Issues Family Educational Right to Privacy Act of 1974 (FERPA) Family Educational Right to Privacy Act of 1974 (FERPA) Basic rule is opt-in consent for disclosure of educational records Basic rule is opt-in consent for disclosure of educational records Grades Grades Disciplinary proceedings, etc. Disciplinary proceedings, etc. No special rules for mental health under FERPA No special rules for mental health under FERPA

13. The School Nurse & FERPA Medical records typically are educational records under FERPA and are disclosed only with parent consent Medical records typically are educational records under FERPA and are disclosed only with parent consent Student consent once 18 or post-secondary Student consent once 18 or post-secondary Not educational records when are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment Not educational records when are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment Those records are likely to be covered by HIPAA Those records are likely to be covered by HIPAA

14. HIPAA & FERPA We did not want the school nurse to have to comply with both HIPAA & FERPA We did not want the school nurse to have to comply with both HIPAA & FERPA HIPAA says doesnt count as protected health information if it is covered by FERPA HIPAA says doesnt count as protected health information if it is covered by FERPA In practice, colleges now often are HIPAA; pre- college usually are FERPA In practice, colleges now often are HIPAA; pre- college usually are FERPA

15. AG Access to School Records Both HIPAA & FERPA have basic rule of opt-in consent for disclosure Both HIPAA & FERPA have basic rule of opt-in consent for disclosure FERPA allows disclosure pursuant to FERPA allows disclosure pursuant to Court order, or Court order, or Subpoena with prior notice to the family Subpoena with prior notice to the family HIPAA, as discussed above, is stricter for psychotherapy HIPAA, as discussed above, is stricter for psychotherapy Otherwise administrative subpoena usually works Otherwise administrative subpoena usually works

16. Conclusion Be careful what you wish for when it comes to information sharing Be careful what you wish for when it comes to information sharing Target real needs, and realize downsides of false positives, computer security obligations if you run a system, and privacy invasions Target real needs, and realize downsides of false positives, computer security obligations if you run a system, and privacy invasions Are other approaches better, such as better coordination with campus police? Are other approaches better, such as better coordination with campus police? Thank you Thank you

17. Contact Information Phone: (240) 994-4142 Phone: (240) 994-4142 Email: peter@peterswire.net Email: peter@peterswire.netpeter@peterswire.net Web: www.peterswire.net Web: www.peterswire.netwww.peterswire.net Privacy & Information Sharing in the War Against Terrorism at http://ssrn.com/abstract=899626 Privacy & Information Sharing in the War Against Terrorism at http://ssrn.com/abstract=899626 http://ssrn.com/abstract=899626