Mental Health Issues & Information Sharing

1. Mental Health Issues & Information Sharing Professor Peter P. Swire The Ohio State University NAAG Task Force on School Safety July 5, 2007

2. Overview • My background • When does information sharing actually help? • HIPAA • FERPA • Reasons to do due diligence before assuming that information sharing has net benefits

3. My Background • Currently: • Moritz College of Law, Ohio State U. • Senior Fellow, Center for American Progress • Research on privacy, consumer protection, computer security & homeland security • 1999 to early 2001: • Chief Counselor for Privacy, OMB • White House coordinator, HIPAA privacy rule • Led HIPAA/FERPA process

4. I. When Will Info Sharing Help? • 2006 article Privacy & Information Sharing in the War Against Terrorism • Due diligence list for proposed info sharing • Often, undue optimism that good things will happen with info sharing • Be careful what you wish for …

5. Be Careful What You Wish For • Suppose state AGs received reports on: • Every troubled or depressed youth • Every suspicious gun purchase • Every threat by a teen against another

6. If State AGs Get the Data • If you receive the information, what do you do with it? • Investigate every lead? • Is that a good use of resources? • The problem of “false positives” and a quick check (that you can afford) won’t be good at telling the one in ten thousand that is truly dangerous

7. If State AGs Get the Data • What if you receive the info but do nothing with it? • The wasted resources to create an information sharing system that is not used • When the next thing goes wrong, lots of finger pointing about why nothing was done to prevent the incident • In short, do info sharing if and only if there are net benefits, after due diligence

8. II. HIPAA Basics • HIPAA applies only to “covered entities” • For your purposes, providers and health insurers (as well as their business associates) • Others who create or transmit health care data are not covered • State public health agencies broadly exempted • But often have state or local laws that are stricter, and they may limit sharing

9. Disclosure from Covered Entities • Basic rule – disclosure from covered entities only with patient authorization (an “opt in”) • Some important exceptions • “Required by law” – gunshot wounds & other required reports • Disclosure to public health agencies • Legal proceedings – a judge can order • Law enforcement access, usually with an administrative subpoena

10. HIPAA & Mental Health • “Psychotherapy notes” are more strictly protected • Follows Jaffee v. Redmond and stronger privilege for psychotherapy care • Many HIPAA exceptions don’t apply • Not the usual law enforcement access • Not the usual judge-order court access • Strong idea of “privilege” in order to assure patient openness in therapy

11. HIPAA & Mental Health • Sometimes disclosure is permitted • Tarasoff situation – “in order to prevent or lessen the risk of a serious or imminent threat to the health or safety of a person or the public” • Scope of “psychotherapy notes”, though, is limited • Are notes kept separate from a patient’s standard medical file

12. III. FERPA Issues • Family Educational Right to Privacy Act of 1974 (FERPA) • Basic rule is opt-in consent for disclosure of “educational records” • Grades • Disciplinary proceedings, etc. • No special rules for mental health under FERPA

13. The School Nurse & FERPA • Medical records typically are “educational records” under FERPA and are disclosed only with parent consent • Student consent once 18 or post-secondary • Not “educational records” when “are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment” • Those records are likely to be covered by HIPAA

14. HIPAA & FERPA • We did not want the school nurse to have to comply with both HIPAA & FERPA • HIPAA says doesn’t count as protected health information if it is covered by FERPA • In practice, colleges now often are HIPAA; pre-college usually are FERPA

15. AG Access to School Records • Both HIPAA & FERPA have basic rule of opt-in consent for disclosure • FERPA allows disclosure pursuant to • Court order, or • Subpoena with prior notice to the family • HIPAA, as discussed above, is stricter for psychotherapy • Otherwise administrative subpoena usually works

16. Conclusion • Be careful what you wish for when it comes to information sharing • Target real needs, and realize downsides of false positives, computer security obligations if you run a system, and privacy invasions • Are other approaches better, such as better coordination with campus police? • Thank you

17. Contact Information • Phone: (240) 994-4142 • Email: peter@peterswire.net • Web: www.peterswire.net • “Privacy & Information Sharing in the War Against Terrorism” at http://ssrn.com/abstract=899626