Confidentiality and the HIV positive client

1. Confidentiality and the HIV positive client Allison J. Rice Supervising Attorney Duke AIDS Legal Project September 18, 2008

2. Confidentiality: What’s at stake? • There are Positive & Negative effects of disclosure of HIV status • Goal: To the extent possible, the person with HIV should decide who gets information • Reality: There are limits to the patient’s right to control information about HIV

3. Potential Consequences of Disclosure • Rejection, embarrassment, ostracism, harm to relationships, social isolation, emotional rejection, threats to personal safety • Same as above for client’s children • Discrimination – job, housing, public services, insurance, education, etc. • One person tells another – further breaches of confidentiality & above consequences • Potential loss of custody of child

4. Potential Benefits of Disclosure • Better access to services, health care • Emotional & social support • Possible job accommodation • Public health benefits (Compliance with control measures, improved health)

5. Sources of Law • North Carolina Rules of Professional Conduct, 1.6 • HIPPA (Health Insurance Privacy & Portability Act) (Privacy Rules: 45 CFR Part 164) • Americans with Disabilities Act, 42 U.S.C. § 12101 et seq. • North Carolina laws • Control Measures, 10 NCAC 41A • Confidentiality law, NCGS §130A-143 • Medical malpractice • N.C. “Common” Law (“Torts”) • N.C. Criminal Law

6. Lawyer’s Obligation of Confidentiality • Rule 1.6 Confidentiality of Information • (a) A lawyer shall not reveal information acquired during the professional relationship with a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by paragraph (b).

7. Heightened confidentiality • Go beyond standard client confidentiality procedures • Practices to protect confidentiality of HIV information • Never assume client’s friends/family know about HIV • Even if client has given the name of someone as a witness, don’t assume the witness knows about the HIV. ALWAYS ask the client • Disability third party witness; potential standby guardian • Be careful with any paperwork in your office that references HIV status • Don’t refer to HIV in correspondence unless authorized by client (explicitly or impliedly) • Be extra careful in discussing HIV with other staff members • Train staff about HIV stigma, procedures to protect confidentiality,

8. Exceptions to Confidentiality • (b) A lawyer may reveal information protected from disclosure by paragraph (a) to the extent the lawyer reasonably believes necessary:(1) to comply with the Rules of Professional Conduct, the law or court order;(2) to prevent the commission of a crime by the client;(3) to prevent reasonably certain death or bodily harm; (4) to prevent, mitigate, or rectify the consequences of a client's criminal or fraudulent act in the commission of which the lawyer's services were used;

9. So, what about this? • You are representing a client in a disability case. The client has a partner with whom he’s living. You ask the client about having the partner as a witness at the hearing and the client reveals that he hasn’t told his partner about his HIV. • What do you do?

10. Comments to MRCP 1.6 • [6] . . . Paragraph (b)(2) recognizes that a lawyer should be allowed to make a disclosure to avoid sacrificing the interests of the potential victim in favor of preserving the client's confidences when the client's purpose is wrongful. • Similarly, paragraph (b)(3) recognizes the overriding value of life and physical integrity and permits disclosure reasonably necessary to prevent reasonably certain death or substantial bodily harm. • Such harm is reasonably certain to occur if it will be suffered imminently or if there is a present and substantial threat that a person will suffer such harm at a later date if the lawyer fails to take action necessary to eliminate the threat.

11. Control Measures - HIV • 10A NCAC 41A.0202: (1)Infected persons shall: a) Refrain from sexual intercourse unless condoms are used….. ***** e) Notify future sexual intercourse partners of the infection;

12. NCGS § 130A-25 • “A person who violates a provision of this Chapter or the rules adopted by the Commission or a local board of health shall be guilty of a misdemeanor.”

13. Unavoidable Disclosures

14. North Carolina Public Health Law • Public Health Laws – Gen Statutes Ch 130A, Administrative Code: 10A NCAC 41A • Confidential Testing • Testing requires informed consent • Names-based reporting to the State Public Health Department (name address, demographics) • Public health investigation and contact tracing • Mandatory notification of spouse and partners • Mandatory control measures for infected persons • The name-based system and contact tracing contribute to fear and reluctance to test

15. Failure to disclose to partners: • Failure to abide by control measures is misdemeanor punishable by up to 2 years in prison, NCGS § 130A-26 • Potential for other criminal charges for unprotected sex, spitting, etc. • Example: In a court-martial, an HIV+ Army Private pled guilty to assault and other charges based on having unprotected sex with a 17-year-old. (November 2007)

16. When HIV information can legally be sought and considered • Life insurance: • Insurer can ask. Applicant must answer truthfully. Mostly likely will be denied if HIV+ • Individual health insurance: • Plan can refuse to cover or have high premiums • (but not employee group health insurance) • Group insurance – can’t refuse coverage

17. Employer Medical Inquiries • ADA: 42 U.S.C. § 12112(d) • 29 CFR §§ 1630.13, 1630.14 • EEOC Enforcement Guidance • Health information can only be requested • after job offer • if required of all employees in the class • If business necessity • If employee is asking for a “reasonable accommodation” • Information obtained: 29 CFR 1630.14(d)(1) • “shall be collected and maintained on separate forms and in separate medical files and treated as a confidential medical record”

18. Privacy Protections

19. Confidentiality Law in NC • “All information and records, whether publicly or privately maintained, that identify a person who has AIDS virus infection . . . Shall be strictly confidential. The information shall not be released except under the following circumstances…” • NCGS §130A-143

20. Penalty for violation of NC law • Misdemeanor (NCGS §130A-25) • “A person who violates a provision of this Chapter….shall be guilty of a misdemeanor.” • Enforcement problems • District Attorney must agree to prosecute • To my knowledge, this misdemeanor has never been prosecuted in NC

21. HIV in Schools: • No requirement to tell school or day care about HIV, but doctor must inform local health director if child poses significant risk of transmission (e.g. open sores, biting) (10A NCAC 41A.0202 (3)) • If school is informed, information should only be shared on a “need to know” basis.

22. Federal Laws – HIPPA • Who is covered by HIPPA? • Health care providers (doctors, nurses, other employees) that transmit info electronically • Some Ryan White grantees may be covered – e.g. if you submit to Medicaid • Health insurance plan • Any person or organization that provides or pays cost of medical care, including Medicare, Medicaid, HMO, PPO • Health care clearinghouse • Organizations that process data or transactions • “Business Associates” of covered entities also have to agree to keep information private

23. What does HIPPA do? • Limits disclosure of “individually identifiable health information” • Includes info in paper, electronic, or oral form • Includes information that was created or received from another source • Relates to physical or mental health, condition, or payment for health care • Identifies a person, or can be used to identify a person • Allows certain disclosures without patient’s consent: • Among health care providers • To health insurance companies for claims documentation • Public health • Research uses

24. Key Requirements • Allows uses or disclosures of health information incidental to providing medical care • As long as: • Only “minimum disclosure” necessary • “Reasonable safeguards” are in place to protect information • Definition of “reasonable safeguard” leaves wide open what is reasonable – not clear whether this rule will have any teeth

25. What complies with standards? • Providers can leave phone messages on answering machine or with family members • But use professional judgment to assure that such disclosures are in best interest of individual and that information is limited • Can mail appointment or prescription refill reminders to patient’s homes • But: if patient has requested communication in confidential manner (eg alternative means or location) request must be accommodated “if reasonable”

26. HIPPA Compliance • Can use patient sign-in sheets or call out names of patients in waiting rooms • But must have reasonable safeguards • No medical info displayed that’s not necessary for the purpose of signing in. • Can place patient charts on exam room door • As long as reasonable and appropriate measurers to safeguard information, e.g., limiting access to certain areas, placing chart in box with front cover facing wall. • Can put patient’s name on door of hospital room

27. HIPPA Compliance • Offices don’t have to be soundproof • Consider privacy vs patient care, financial burden • Reasonable: • Pharmacies – ask waiting customers to stand back a few feet from counter used for patient counseling • Curtains, screens, dividers may be reasonable • Providers can talk to one another – eg at nursing station, in semi-private hospital room, • Reasonable precautions: • Lowered voices, talking apart from others.

28. Enforcement of HIPPA • Complaint to provider/health plan • Complaint to the Office of Civil Rights, Department of Health & Human Services • http://www.hhs.gov/ocr/hipaa/ • Complaint form in materials and available over internet (and at end of these materials) • Must be made within 180 days of learning of violation (unless good cause shown) • Penalties = fines of up to $100 per incident (paid to government, not to patient) up to $25,000 per person per year per violation.

29. Tort remedies • If health care provider discloses, could sue for medical malpractice • Other Torts • No tort for invasion of privacy by public disclosure of private facts. • There is a privacy tort for intrusion into seclusion • Available tort theories: negligent or intentional infliction of extreme emotional distress

30. Obstacles to Legal Recourse • Further invasion of privacy through filing lawsuit or making complaint • Fear of alienating important resources, e.g. health care or service provider, DSS, etc. • Availability of lawyers • Time & cost of legal help, especially lawsuit. • Inadequacy of remedies – • have to have severe harm, which can be documented • difficulties of proving case – her word against his word • Can’t put the cat back in the bag

31. To tell or not to tell: What we advise clients • Short answer: From a legal standpoint, when in doubt, don’t tell • there are some protections for misuse of info re HIV+ status, or discrimination against person with HIV, but • protections are few, weak, and probably will take a lawyer to enforce – if they can be enforced at all. • Enforcement likely to result in further disclosure

32. Summary: Protecting Privacy • Clients must understand customs and practices of medical personnel re privacy – • Adjust expectations; request special confidentiality measures re HIV • limit disclosure to absolutely those necessary – trusted friends, relatives, providers, public health officials, legal requirements • don’t disclose to employer unless seeking accommodation under ADA or legally required (e.g. health care workers doing exposure prone procedures), or part of legal medical inquiry by employer • make timely complaints under HIPPA, ADA, when violations occur

33. What lawyers can do for HIV+ clients • Challenge those in charge of agency/facility privacy policies to go beyond HIPPA requirements in safeguarding sensitive medical information such as HIV+ status. • Help clients understand the risks of disclosure and counsel to make the right disclosures in a safe way • For disclosures by health care providers: • HIPPA complaint & letter to health care provider • Seek discipline for employees involved • Policy changes • Training for staff • Disclosures in employment: • If appropriate, EEOC complaint • Consider tort theories if serious injuries • Others - Stern letter from lawyer to person disclosing • Reference criminal statute, tort law

34. Contact Information • Allison RiceSupervising AttorneyDuke AIDS Legal Assistance ProjectBox 90360Durham, NC 27708(919) 613-7169rice@law.duke.edu