How to Litigate an HIV confidentiality case

1. How to Litigate an HIV confidentiality case

2. Sally Friedman Legal Director Legal Action Center (212) 243-1313 www.lac.org sfriedman@lac.org

3. Today’s topics Part 1: HIV stigma & discrimination Part 2: Substantive HIV confidentiality protections Part 3: How to Litigate an HIV confidentiality case

4. Part 1: Rationale for HIV confidentiality law • Stigma See articles in hand-outs. • Discrimination

5. Part 2 Substantive HIV confidentiality Protections

6. Applicable laws • Article 27-F, NYS Public Health Law • Secs. 2780 et. seq. • HIPAA • Fiduciary duty of confidentiality • Constitutional right to privacy • Privacy Act (federal)

7. Today’s focus: • Article 27-F, NYS Pub. Health Law • HIPAA • Will touch on fiduciary duty of confidentiality

8. What is Article 27-F? • HIV testing • HIV confidentiality • Today’s focus – the confidentiality provisions

9. Article 27-FWho is Bound by the Law? ANY person who receives HIV-related information about a protected individual: • while providing a “health or social service” OR • pursuant to a proper written consent NY governmental agencies that: • provide, supervise or monitor health or social services OR • obtain HIV related info pursuant to Article 27-F

10. Article 27-FDoes NOT apply to: • Protected individuals themselves • Friends, relatives • Courts • Insurers • Federal agencies (military, federal prisons) • Schools (except medical staff) • Employers

11. Article 27-FWhat information is protected? • HIV test • HIV test results, even if negative • HIV infection or HIV related illness or AIDS • HIV related condition • Medication specific to HIV disease • Contact of someone with HIV: • Sexual partner, spouse, needle sharing

12. What is HIPAA? Health Insurance Portability Accountability Act of 1996

13. HIPAAGenerally • Establishes a federal floor of safeguards to protect the privacy of medical records and other “personal health information” • Applies to health information transmitted in any form: electronic, written or oral.

14. HIPAAWho is Covered? Covered Entities Are: • Health Care Providers • Health Plans • Health Care Clearinghouses IF they transmit health information electronically in connection with certain covered transactions – generally concerning billing and eligibility

15. HIPAACovered Transactions • processing claims • payment and remittance • coordination of benefits • claim status • enrollment and disenrollment in a health plan • health plan eligibility • health plan premium payments • referral certification and authorization • first report of injury • health claims attachments

16. HIPAA &Article 27-FWho Must Comply with Both? • Most health care providers in New York State, provided they transmit health information electronically for purposes of billing or reimbursement.

17. When Federal & State Laws Regulate the Same Subject HIPAA pre-empts any “contrary” state law provision except when, among other things: • The state law relates to privacy AND is “more stringent” than the HIPAA provision.

18. HIPAAMore Stringent Test • Provides greater privacy protection for the individual who is the subject of protected information. • Gives an individual greater rights to access or to amend his/her own health records; • Provides more information to an individual regarding a use, disclosure, or rights and remedies; • Provides a narrower scope or duration, or affords increased privacy protections, for express legal permissions for use or disclosure, or reduces the coercive effect of such permissions; • Provides for the retention or reporting of more detailed information in an accounting of disclosures;

19. What is “fiduciary duty of confidentiality?” • Requires fiduciary to maintain confidentiality of HIV (and other) information • Covers: • Health care providers • Pharmacists • Other fiduciaries

20. What is Constitutional right to privacy? • Protects against disclosure of certain intimate information • Protects confidentiality of HIV information. Doe v. City of NY, 15 F.3d 264 (2d Cir. 1994)

21. Constitutional right to privacy: who is covered? • Government employees, officials, and agents acting under color of local, state, or federal law

22. What is Privacy Act? • Prohibits some federal agencies from disclosing private information

23. Article 27-F & HIPAA

24. What’s the Law?The General Rule • HIPAA: A covered entity may not “use or disclose” protected health information which is created or received by a covered entity AND relates to the past, present or future physical or mental health of an individual. • Article 27-F: Health & social service providers AND people who receive HIV related info pursuant to written release may not disclose (or redisclose) any HIV related information about a protected individual. (§ 2782)

25. Article 27-F Protected Persons • Person who has HIV • Person who has had an HIV test • Contacts (spouse, sexual partner or needle-sharing partner)

26. The Main “Exceptions” permitting disclosure • Both HIPAA & Article 27-F have “exceptions” that allow entities to share HIV information. • This training will cover five of them: • Written consent • Internal communications • health care • Partner notification • Court order

27. CONSENT Requirements for written consent:

28. Article 27-FConsent • Voluntary & Revocable at any time • Written • Contain specific elements required by both HIPAA & Art. 27-F • Form must be approved by DOH (see sample) • Will be necessary during litigation.

29. Article 27-FNo Redisclosure • Person receiving information pursuant to consent may not redisclose • Person providing information pursuant to consent must provide notice prohibiting redisclosure (see sample). This needs to happen during litigation!

30. Internal communications Requirements under Art. 27-F and HIPAA:

31. Article 27-FInternal communications Agency staff may share HIV related information IF the staff members: • Are allowed access to client records in ordinary course of business; • Are specifically authorized in the agency’s written “need-to-know” protocol; OR • Have a reasonable need to know or share the information to carry out their authorized duties

32. HIPAAMinimum Necessary Standard • Identify & document members of the workforce who need access • Identify & document the categories of information to which they need access • Identify & document any conditions to their access

33. To Health Care Providers May disclose HIV related information to a health care provider when it is necessary to provide care to: 1. The individual 2. His or her child OR 3. A contact Document the disclosure.

34. To Health Care Providers (cont.) This exception only operates if the disclosure is for the purpose of providing health care to the protected person (or his/her child or contact) – and not for purposes such as: • workers compensation, • Infection control

35. Case Reporting & Partner Notification Physicians & labs who diagnose HIV are required to report every case of HIV infection, HIV related illness and AIDS diagnosis to DOH Report to State DOH State rediscloses contact info to local DOH for partner notification

36. Case Reporting & Partner Notification (cont.) • Physicians report • Known contacts • Domestic violence risk • Whether contacts have been notified

37. Case Reporting & Partner Notification (cont.) • ONLYphysicians and special Dept of Health staff are permitted to notify named partners of HIV infected individual • NO ONE ELSE is permitted to do partner notification

38. Case Reporting & Partner Notification (cont.) • Physicians may notify contact if: • Significant risk of infection • Counsels about need to notify • Does domestic violence screen • Informs patient that – • Intends to notify & must tell DOH • Can choose to have DOH notify • Source person’s name won’t be revealed

39. Court Orders & Subpoenas Subpoenas do NOT authorize disclosure of HIV-related information – even if “so ordered” by court • Need client consent to respond to subpoena • If no consent, may redact HIV information from records if possible

40. Article 27-FCourt Orders Court may order disclosure IF: • Compelling need for adjudication of lawsuit, or • Clear and imminent danger to life or health of persons unknowingly at significant risk, or • Applicant is lawfully entitled and disclosure is consistent with Article 27-F. (NYS Pub. Health Law § 2785)

41. Article 27-FCourt Order Procedure • Notice • Opportunity to be heard • Fictitious name • Confidential proceeding

42. Article 27-FComplaints & Violations • $5,000 civil fine • criminal penalty if willful • private right of action (can sue) • file complaint with DOH: (800) 962-5065

43. HIPAAEnforcement and Complaints • No private right of action • May file a complaint with the Covered Entity and/or Office of Civil Rights of the U.S. Dept. of Health & Human Services within 180 days of the violation • Penalties range from civil fine ($100 per violation to maximum $25,000 per calendar year) to various criminal fines & imprisonment. Rarely – if ever – imposed.

44. Part 2 How to Litigate an Article 27-F Case

45. Establish what client wants • Clients goals often change. Usual range: • acknowledgment that someone hurt them • money BUT don’t forget about effect of lump sum on public benefits • policy change & training: “it shouldn’t happen to anyone else” • It’s largely about stigma & dignity

46. LawsuitsArticle 27-F • Individuals may sue in court for violations of Article 27-F • Damages include: • Emotional harm • Lost wages • Other out-of-pocket losses • Punitive damages

47. LawsuitsHIPAA • Individuals may not bring lawsuits to enforce HIPAA

48. LawsuitsFiduciary duty of confidentiality • May add a claim for breach of common law fiduciary duty of confidentiality

49. Lawsuits • Don’t give client unrealistic expectation of easy money • Downside to lawsuits: • Can take many years • Hard to find free legal counsel • Have to relive the trauma through testimony and continuous contact with attorney • Client’s medical (some) and mental health (most or all) records are discoverable

50. Lawsuits • Downside to lawsuits (cont.): • Adversarial model can make clients even angrier, as “breacher” defends position