Use & Disclosure of PHI for Judicial & Administrative Proceedings

1. Use & Disclosure of PHI for Judicial & Administrative Proceedings Andrea Jahn, JD, Privacy Officer Creighton University Sheila Wrobel, JD, Privacy Officer Nebraska Health System August 21, 2002

2. HIPAA References • 45 CFR §164.512(e): Disclosures and Uses for Judicial and Administrative Proceedings • 45 CFR §164.508: Uses & Disclosures for which an Authorization is Required • 45 CFR §164.508(a)(2)(C): Authorization not required for CE to use/disclose psychotherapy notes when defending against legal action brought by the individual

3. Permitted Disclosures • Authorization • Court order/subpoena • Administrative tribunal order/subpoena • Subpoena/discovery request from a party to the proceeding with satisfactory assurances of: • Reasonable Notice of request to individual that is the subject of the record; or • Qualified protective order.

4. Authorizations • Revised Final regulation published 8/14/02 adopts NPRM proposals • Must be written in plain language • CEs who seek an authorization must provide individual with signed copy • Voluntary consent document will not be valid as an authorization • Retain authorizations for at least six (6) years

5. Authorization Core Elements§164.508(c) (1) Description of information to be used or disclosed; (2) Identification of the persons or class of persons authorized to make the use or disclosure of PHI; (3) Identification of persons or class of persons to whom the CE is authorized to make the use or disclosure;

6. Authorization Core Elements§164.508(c) (4) Description of each purpose of the use or disclosure; (5) Expiration date or event; (6) Individual’s signature and date; (7) If signed by personal representative, a description of his/her authority to act.

7. Other Required Authorization Statements §164.508(c)(2) (1) Statement that individual may revoke authorization in writing; or reference to NPP; (2) Statement that treatment, payment, enrollment or eligibility for benefits may not be conditioned on authorization if prohibited by Rule; (3) Statement about potential for PHI to be re-disclosed by the recipient.

8. Authorizations: Exception • §164.508(a)(2): A CE must obtain an authorization for use/disclosure of psychotherapy notes except: (C): Use/disclosure by the CE to defend itself in a legal action or other proceeding brought by the individual.

9. Satisfactory Assurance of Notice Requirements • Party demonstrates good faith effort to provide individual with written notice • i.e. send notice to last known address • Notice contains sufficient information to permit individual to raise objection to court/administrative tribunal • Time to raise objection has elapsed & • no objections filed; or • objections filed have been resolved.

10. Satisfactory Assurance of Notice • Covered entity not required to explain procedures to object to individual • Notice to object presumed if individual is a party to the proceeding & has put his/her medical condition at issue

11. Satisfactory Assurances of Qualified Protective Order • Qualified Protective Order means: • An order of a court or of an administrative tribunal or a stipulation that: 1. Prohibits parties from using/disclosing PHI outside of litigation/proceeding; and 2. Requires return of PHI to CE or destruction at end of litigation/proceeding.

12. Satisfactory Assurances of Qualified Protective Order (QPO) • Statement & documentation that: • parties to dispute have agreed to a QPO; and • QPO submitted to court; or • individual seeking PHI has requested QPO from the court/tribunal. • Model QPOs encouraged

13. Adequate Assurances • CE itself may, but is not required to take steps to meet adequate assurances requirements • CE free to object to disclosure if adequate assurances not provided • PHI subject to court/administrative tribunal action may be disclosed pursuant to another HIPAA provision

14. Additional Information • Minimum necessary requirements do not apply where disclosure is required by law pursuant to court/administrative tribunal order, but-- • do not disclose more information than requested/ordered!

15. Issue: Uses/Disclosures by CE in Legal Proceedings • Regulations do not address whether, how a CE may use/disclose PHI when filing its own litigation against the individual or another party. • Apparent answer: need court order to obtain permission to disclose PHI in filings.

16. Uses/Disclosures by CE in Legal Proceedings: CE as Plaintiff • HHS Comments: The Privacy Rule permits a covered entity, or a business associate acting on behalf of a covered entity (e.g., a collection agency), to disclose protected health information as necessary to obtain payment for health care, and does not limit to whom such a disclosure may be made. • A collection agency, as a business associate of a covered entity, is permitted to contact persons other than the individual to whom health care is provided as necessary to obtain payment for such services.

17. Uses/Disclosures by CE in Legal Proceedings: CE as Defendant • CE allowed to use/disclose psychotherapy notes in its defense of claim filed by patient. 45 CFR § 164.508(a)(2)(C). • Comments to First Final Rule: “we allow the provider to disclose the notes to his or her lawyer for the purpose of preparing a defense. Any other disclosure related to judicial or administrative proceedings is governed by § 164.512(e).” 65 Fed.Reg. 82653 (Dec. 28, 2000).

18. Uses/Disclosures by CE in Legal Proceedings: CE as Plaintiff • Regulations silent on use/disclosure of other types of PHI in defense of claims brought by patient. • Regulations silent as to whether CE may use/disclose PHI as Plaintiff in non-collections related litigation.