How to Provide The Mandatory Annual HIV Confidentiality Update: For HIV Service Providers in New York Who Need to Fol

1. How to Provide The Mandatory Annual HIV Confidentiality Update: For HIV Service Providers in New York Who Need to Follow Article 27-F of the NYS Public Health Law Revised 3.18.09

2. Background Why are you here?

3. First, some legal background • The New York State HIV Confidentiality Law – Article 27-F of the Public Health Law –protects the confidentiality of HIV-related information about people who receive services from most health care or social services providers in New York. • Your agency must comply with Article 27-F’s confidentiality requirements.

4. Some legal background (cont.) • Regulations implementing Article 27-F require providers subject to the law to: • establish HIV confidentiality policies and procedures, • require all staff to understand & follow them, • annually review these policies and procedures, and • ensure – and document – that all employees receive initial and annual in-service training on HIV confidentiality.

5. This HIV confidentiality capacity-building initiative: What is it? • The NYS Dept. of Health – AIDS Institute is sponsoring this HIV confidentiality capacity-building initiative • “Dear Colleague” letter (in your hand-outs) explains – • What is expected of your agency, and • How the DOH, AIDS Institute and the Legal Action Center can help you succeed in fulfilling these responsibilities, in-house!

6. This HIV confidentiality capacity-building initiative: What is it? (cont) Goals of initiative: help your agency develop in-house capacity to ensure – • Your HIV Confidentiality Policies and Procedures are in place, up to par, and updated annually, AND • Your staff with responsibility for conducting your organization’s annual staff in-service on HIV Confidentiality are ready and able to accomplish this successfully.

7. This HIV confidentiality capacity-building initiative: Target audience This training is for – • Program directors, managers, and supervisors or staff responsible for – • developing and updating your agency’s HIV confidentiality policies and procedures, or • conducting annual, in-house, staff in-service on HIV confidentiality.

8. By end of training, you should be able to . . . • State the major requirements of the NYS HIV confidentiality law (and HIPAA, if your agency must comply with it, too) • Develop (or update) your agency’s own HIV Confidentiality Policies and Procedures to comply with HIV confidentiality law • and…

9. By end of training, you should be able to. . . (cont.) • Conduct an annual review and update of your agency’s HIV Confidentiality Policies and Procedures • Use Legal Action Center’s model policies and procedures, PowerPoint presentation, and other resources to help your staff conduct your annual HIV confidentiality staff in-service • and…

10. By end of training, you should be able to. . . (cont.) • List 3 options for conducting your agency’s staff HIV confidentiality in-service so you can find the best method for your agency, e.g., combining HIV confidentiality with HIPAA training • Conduct a simple, straightforward in-house staffin-service on HIV confidentiality on an annual basis

11. Step 1 Your Agency’s Policies & Procedures: How to Create & Implement Them

12. Your policies & procedures– purpose • Your agency is required to put in place policies and procedures to – • Maintain confidentiality of HIV related information, and • Assure that confidential HIV related information is disclosed only when appropriate and in accordance with the Article 27-F and the regulations that govern your agency.

13. Your policies & procedures – preliminary steps • Determine how/when the confidentiality law applies to your agency (Model Policies & Procedures, p.2): • Health and social service provider? • See App. 3 of Model Policies & Procedures • If not – have a contract with the AIDS Institute requiring compliance with Art. 27-F?

14. Your policies & procedures – preliminary steps (cont.) • If not (neither “health or social service provider” or contract with AIDS Institute) – • then only requirement to comply with Art. 27-F is: when receive HIV-related information through written consent

15. Your policies & procedures – preliminary steps (cont.) • Determine which confidentiality regulations apply to your agency. • Which state agency regulates your agency? • Which regulations apply? • Example: DOH regulations – Part 63

16. Your policies & procedures – preliminary steps 3. Decide on terminology you will use in your Polices & Procedures. • “Confidential HIV-related information” (Art. 27-F term) or “Personal health information” (“PHI”) (HIPAA term) • “Capacity to consent” 3. Anything else?

17. Your policies & procedures – requirements Required Components • Training & Updating • Internal communications protocols • Protocols to safeguard security of confidential records & information and……

18. Your policies & procedures – requirements Required Components (cont.) • Protocols for handling requests by other parties for HIV-related information 5. Anti-discrimination provisions

19. Your policies & procedures – content Suggested components Introduction: • Purpose • Confidentiality policy • Staff responsible • Definitions See Model Policies & Procedures, p. 5

20. Your policies & procedures – content Required Components 1. Training & updating: • Policies & procedures to educate all staff on – • New York’s HIV confidentiality law, and • Your agency-specific HIV confidentiality policies and procedures.

21. Your policies & procedures – content(cont.) 1. Training & updating: (cont.) • Policy must require – • Annual review and update of agency’s HIV Confidentiality Policies and Procedures, and • Annual staff in-service on HIV confidentiality, in-house • Designate staff responsible for both.

22. Your policies & procedures – content(cont.) • Training & updating(cont.) • Require initial employee education and annual in-service for staff on HIV confidentiality. • Maintain list of all employees who have received such training. more…….

23. Your policies & procedures – content(cont.) • Training & updating(cont.) • Include volunteers and peers who have access to HIV-related information. • Extent of training will depend on how much access they have and extent of work they do. more…….

24. Your policies & procedures – content(cont.) • Training & updating(cont.) • Obtain/update employee attestations: • Have received this training. • Have read and will abide by agency’s HIV Confidentiality Policies and Procedures. • See sample attestation – App. 4 of Model Policies & Protocols

25. Your policies & procedures – content(cont.) • Training & updating(cont.) • Volunteers and peers should sign attestations too.

26. Your policies & procedures – content(cont.) 1. Training & updating (cont.) • Inform your agency’s contractors providing services in which HIV related information might be disclosed: • That they must follow the confidentiality requirements. More…

27. Your policies & procedures – content(cont.) 1. Training & updating (cont.) • (contractors, cont.) • Advisable to highlight the requirement verbally • Could provide contractor with literature about Article 27-F • Document that you have done so. • Include this in the contract and/or MOU

28. Your policies & procedures – content(cont.) 1. Training & updating(cont.) • OPTIONAL: • Provision – “Educating Clients about HIV Confidentiality Policy & Rights” • See Model Policies & Procedures, p.7

29. Your policies & procedures – content(cont.) 2.Internal communications protocols: • Develop “need to know” protocol & list. (See Model Policies & Procedures, App. 5, p. 31): • Protocol: Limit access to and disclosure of HIV-related information to authorized employees who reasonably need access to perform designated job duties/functions. Specify any limits on access. More…..

30. Your policies & procedures – content(cont.) 2.Internal communications protocols: • Develop “need to know” protocol & list (cont.) • List job titles/functions within those job titles for which employees are authorized to access confidential HIV related information: your “need to know” list.

31. Your policies & procedures – content(cont.) 2. Internal communications protocols (cont.) • Distribute “need to know” list to all employees during employee education sessions. • Require that only those staff who received such education may have access to confidential HIV-related information while performing the authorized functions specified in your “need to know” list.

32. Your policies & procedures – content(cont.) 2. Internal communications protocols (cont.) • For agencies only bound by Art. 27-F because of AIDS Institute contract, • Add provision about internal consent form. (Model Policies & Procedures, p. 8)

33. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information: • Ensure that records containing confidential HIV related information, including records that are stored electronically, are: • Maintained securely, and • Used only for the purpose intended. • See Model Policies & Protocols, p. 9 more…..

34. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): • Cover “conversations about clients” • Cover written, electronic (fax & email) & oral communications. • See ideas in Model Policies & Procedures, p. 10

35. Your policies & procedures – content(cont.) 4.Protocols for handling requests by other parties for confidential HIV-related information. Cover: • When you have consent – or can get consent • Provide “notice prohibiting redisclosure” (See App. 6, Model Policies & Procedure) • See Model Policies & Protocols, p. 12

36. Your policies & procedures – content(cont.) 4. Protocols for handling requests by other parties for confidential HIV-related information (cont.). Cover: • Requests when there is no consent: • Is there some other authorization under Art. 27-F? (See slides, below.) • Special procedure for subpoenas: • Redact HIV information? • Withhold that part of the record?

37. Your policies & procedures – content(cont.) • Protocols for handling requests by other parties for confidential HIV-related information(cont.) Guidelines could also apply to disclosures your agency needs/decides to make (as opposed to at 3rd party’s request) more…..

38. Your policies & procedures – content(cont.) Disclosures without consent – To outside health care providers: • Decide which type of release to require: general or HIV-specific • See Model Policies & Protocols p. 14

39. Your policies & procedures – content(cont.) Disclosures without consent (cont.)– Physicians’ disclosures about Minors & Incompetent Adults: Applies only if physicians on staff • See Model Policies & Protocols p. 14

40. Your policies & procedures – content(cont.) Disclosures without consent (cont.)– To “Contacts” (sexual or needle-sharing partners) – if agency is not a mandated case reporter • Provisions will vary depending on whether have physician on staff • See Model Policies & Protocols pp. 16-17

41. Your policies & procedures – content(cont.) Disclosures without consent (cont.)– To public health authorities for HIV/AIDS case reporting • Only if agency is mandated HIV case reporter under Public Health Law Sec. 2130 • See Model Policies & Protocols p. 18

42. Your policies & procedures – content(cont.) Disclosures without consent (cont.)– To oversight authorities for program monitoring, evaluation, & review • Only if agency is mandated HIV case reporter under Public Health Law Sec. 2130 • See Model Policies & Protocols p. 19

43. Your policies & procedures – content(cont.) Disclosures without consent (cont.)– Occupational exposure • Only include this provision in certain occupational settings • Ex: medical or dental offices, emergency response functions performed, facilities regulated by various state agencies • See Model Policies & Protocols p. 19

44. Your policies & procedures – content(cont.) Disclosures without consent (cont.)– Disclosures to insurers for health care reimbursement • Only include if your agency is a health care provider/facility seeking reimbursement for health care services from private or public insurers • See Model Policies & Protocols p. 20

45. Your policies & procedures – content(cont.) 5.Anti-discrimination provision: • Policy prohibiting employees, agents, and contractors from discriminating against persons having or suspected of having HIV infection.

46. Your policies & procedures – content(cont.) Optional: Grievance procedures • Not required by Art. 27-F, though highly recommended • HIPAA does require patient complaint process • See Model Policies & Procedures, pp. 20-21

47. Helpful resources for Step 1 Legal Action Center resources: • Model HIV Confidentiality Policies and Procedures for Human Service Providers in New York State • Ongoing Updates on Changes Needed in Your HIV Confidentiality Policies and Procedures (annually, starting in 2009)

48. Helpful resources for Step 1 (cont.) More LAC resources: • Hand-outs for this training • LAC’s website: www.lac.org (click on Training) • Call LAC’s HIV Confidentiality Hotline • 212-243-1313 or 800-223-4044 • Ask for the attorney on call

49. Helpful resources for Step 1 (cont.) • NYS Dept. of Health & AIDS Institute resources: • Hand-outs for this training • DOH/AIDS Institute websites: www.health.state.ny.us – and go from there! • DOH Confidentiality Hotline: 800-962-5065 • Your AIDS Institute contract manager and other staff.

50. Step 2 – Your Annual Review So How Do You Conduct an Annual Policy Review?