Rights Responsibilities & Solutions: Avoid Disasters for the Special Needs Population & Comply with the HIPAA

1. Rights Responsibilities & Solutions: Avoid Disasters for the Special Needs Population & Comply with the HIPAA Privacy Rule Linda Sanches, Senior Advisor, HIPAA Privacy Outreach & Training Eileen Hanrahan, Senior Civil Rights Analyst Office for Civil Rights, U.S. Department of Health and Human Services February 5, 2008 National Emergency Management Summit

2. Topics • What does OCR do • HIPAA • HIPAA Privacy Rule basics • Sharing of health information in a disaster • Sharing information for emergency preparedness • Special needs population • Who is the special needs population—functional approach • How the civil rights laws apply to persons with special needs in an emergency • Strategies for addressingtheir needs in an emergency

3. OCR Protects Through Enforcement • Section 504of the Rehabilitation Act of 1973 (disability) • Title II of the Americans with Disabilities Act of 1990 (disability) • Title VI of the Civil Rights Act of 1964 (race, color, & national origin) • Age Discrimination Act of 1975 (age) • Health Insurance Portability and Accountability Act of 1996 (privacy) • Patient Safety and Quality Improvement Act of 2005 (confidentiality)

4. How OCR Protects Civil & Privacy Rights • Resolving Complaints: people who believe that they have been discriminated against or the law otherwise has been violated may file complaints with OCR • Opening compliance reviews: OCR may initiate a civil rights review of a program that receives HHS funds or a Privacy Rule review of any covered entity • Conducting pre-Grant reviews: OCR conducts civil rights reviews of health care providers who are applying to participate in the Medicare Part A program • Offering technical assistance: OCR provides resources, training, and outreach materials

5. What If an OCR Investigation Indicates Noncompliance? • Emphasis on voluntary compliance through corrective action and resolution agreements • Civil Rights Enforcement • Terminate HHS funding • Refer to Department of Justice for enforcement • Privacy Enforcement • Assess civil money penalties

6. Recent Emergency Responses Suggest Privacy Compliance Strategies Are Incomplete • Some paramedics have refused to disclose information to emergency medical providers • Some state and local authorities have been unable to confirm that their requests for information from providers for planning activities are permitted by HIPAA. • Some emergency responders have refused to make disclosures because they mistakenly believe that they are subject to the HIPAA Privacy Rule • Federal “Lessons Learned” reports note frequent misunderstanding.

7. Basic Construct of the HIPAA Privacy Rule • Creates a nationwide baseline of privacy protections for health information • Sets standards • When information can be used or disclosed • How information must be protected • New training, staffing, information management, contracts, policies and procedures • Establishes rights for individuals • Access, correct, control, complain • Enables HHS to enforce these requirements

8. Health plans Health care providers who transmit health information electronically in connection with standard transactions (e.g., billing). Health Care Clearinghouses Health Plans include employer sponsored health plans, health insurance companies, HMOs certain government programs that pay for health care, such as Medicare & Medicaid Providers include most doctors offices, pharmacies, hospitals, clinics, nursing homes, many other health care providers Who is Covered by the Privacy Rule? Covered Entities

9. Individually identifiable health information (other than education, employment records) Transmitted or maintained in any form or medium By covered entities or their business associates Protections do not follow information once released to persons not covered by HIPAA This includes Medical records Conversations the doctor has about care or treatment with nurses and others Information about members in health insurer's computer system Billing information about patients at a health clinic Most other health information held by those who must follow this law What is covered? Protected Health Information

10. The Rule permits sharing • For treatment, payment, and health care operations purposes • To the individual • Pursuant to a valid written authorization • When the individual agrees, or does not object in circumstances that give the individual an opportunity to agree or object • Relevant information to family or friend caregivers; hospital directories • For specific public policy purposes, such as public health or law enforcement purposes—requirements apply to each type When Can Information Be Shared?

11. Yes, for these purpose: Treatment Notification To address imminent danger Facility directories Public health Of course, the HIPAA Privacy Rule does not apply to disclosures if they are made by entities not covered by the Privacy Rule. So the HIPAA Privacy Rule does not restrict the American Red Cross from sharing patient information. Can Health Information Be Shared in a Severe Disaster? http://www.hhs.gov/ocr/hipaa/KATRINAnHIPAA.pdf

12. Permitted Disclosures: Treatment • Sharing information with other providers hospitals, clinics, emergency shelter nurses • Referring patients for treatment linking patients with providers where patients have relocated • Coordinating patient care with others emergency relief workers, others finding health services

13. Permitted Disclosures: Notification As necessary to identify and locate family members, guardians, or anyone else responsible for the individual's care, and notify them of the individual's location, general condition, or death • In emergency, hospital may notify the police, the press, or the public at large as appropriate • May share information with disaster relief organizations that, like the American Red Cross, are authorized by law or by their charters to assist in disaster relief efforts • No need to obtain a patient's permission if doing so would interfere with the organization's ability to respond to the emergency

14. Permitted Disclosures: Others • IMMINENT DANGER: Providers can share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public -- consistent with applicable law, ethical standards. • FACILITY DIRECTORY: Health care facilities maintaining a directory of patients can tell callers (if patient does not opt-out): • Whether an individual is at the facility, • The individual’s location in the facility, and • The individual’s general condition • “he is in the ICU in stable condition”

15. Is the HIPAA Privacy Rule Suspended During a National or Public Health Emergency? • Only applies to certain hospitals, for 72 hours • Only applies re: certain provisions, such as notice distribution, facility directory opt-out. No, although the Secretary may waive imposition of penalties against covered entities that do not comply with certain provisions of the Rule

16. The disclosure is made for public health purposes to an appropriate public health authority An entity that is authorized by law to coordinate disaster relief planning may be a public health authority Many emergency preparedness activities are public health activities (e.g., those that prevent or control disease, injury or disability) Public health authorities must be authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including the conduct of public health interventions. Can Health Care Providers Share Information for Emergency Preparedness Activities?Yes, when

17. Privacy Rule may permit providers to disclose information about their patients for public health preparedness activities. These issues are especially important for providers and planners seeking to effectively serve the special needs population. Understanding the Privacy Rule Enables Appropriate Services for the Special Needs Population

18. Avoid Disasters for the “Special Needs Population” Effective planning, response, and recovery for the special needs population, consistent with Federal civil rights laws

19. Who Is the Special Needs Population? • Many definitions of “special needs population,” “at-risk population,” and “vulnerable population” exist. • In the National Response Framework, the Federal Government has adopted a single function-based definition. • A single definition allows for consistency of intergovernmental planning and exercises to ensure the safety and security of all. • A function-based definition establishes a flexible framework that addresses common needs irrespective of specific diagnosis, statutes or labels. • It provides useful information to emergency planners and responders that mere labeling does not.

20. Definition of Special Needs Population in the National Response Framework Before, during, and after an incident, members of this population may have additional needs in one or more of the following functional areas: Maintaining independence, communication, transportation, supervision, and medical care. Individuals in need of additional response assistance may include those who: • Have disabilities • Live in institutionalized settings • Are elderly • Are children • Are from diverse cultures • Have limited English proficiency or are non-English speaking • Are transportation disadvantaged

21. We Will Focus on Three Populations That Are Protected by Federal Civil Rights Laws • Persons with disabilities • Persons from diverse racial/ethnic origins, including Limited English proficient (LEP) persons

22. Special Needs PopulationFacts and Figures • In 2000, 18% of the population (47 million people) spoke a language other than English at home. • 63% of hospitals treat LEP patients daily or weekly. • Nearly 40 million people have one or more disabilities. • 40% of the population over 65 has one or more disabilities. • In 2000, persons who were African American, Hispanic or Asian comprised nearly a third of the population. This percentage is projected to increase through 2050.

23. The Experience of These Populations in Emergencies • Historically, emergency preparedness activities have lacked sufficient focus on individuals with special needs. • As a result, these populations often: • Did not receive important information about emergencies; • Were not evacuated; • Were unable to access shelters; and • Failed to receive needed services, including medical assistance. • Many Hurricane Katrina “lessons learned” reports noted the importance of including the special needs population in planning, response, and recovery efforts for those efforts to be successful.

24. What Civil Rights Laws Apply to These Populations? • Title VI of the Civil Rights Act of 1964 (Title VI) prohibits discrimination on the basis of race, color, or national origin by recipients of Federal financial assistance. • Section 504 of the Rehabilitation Act of 1973 (Section 504) prohibits discrimination on the basis of disability by recipients of Federal financial assistance. • Title II of the Americans with Disabilities Act of 1990 (ADA) prohibits discrimination on the basis of disability by public entities, whether or not they receive Federal financial assistance.

25. Standards under the Federal Civil Rights LawsDisability Discrimination Section 504 and Title II implementing regulations: • Different treatment on the basis of disability • Actions that have the effect of discriminating on the basis of disability • Program accessibility • Provision of auxiliary aids and services where necessary to afford equal opportunity, unless undue burden or fundamental alteration • Modification of policies, practices, and procedures where necessary to avoid discrimination, unless fundamental alteration • Administration of services in the most integrated setting appropriate

26. Standards under the Federal Civil Rights LawsRace, Color, and National Origin Discrimination Title VI implementing regulation: • Different treatment on the basis of race, color, or national origin • Actions that have the effect of discriminating on the basis of race, color, or national origin • May include the failure to take reasonable steps to provide LEP persons meaningful access to the program

27. How Service Providers Can Effectively Address Functional Needs in an Emergency, Consistent with Federal Civil Rights Laws • Strategic planning • Location and assessment of the special needs population • Communication • Avoidance of separation of individuals from their sources of support or assistance • Integration • Accessibility • Recovery

28. Strategic Planning • Include people with special needs in planning and exercises • Know your partners and collaborate in developing plans • Know what resources are available to you in an emergency • Develop protocols and procedures for providing services and obtaining resources • Communicate your emergency plan to response and community stakeholders • Identify and maintain access to expertise about people with special needs for all staff up and down the line

29. Location and Assessment • Coordinate with state and local emergency management officials • Know the populations - population survey data • Know the functions with which people may need assistance - use of individual intake and assessment tools • Consider using a voluntary registry to identify persons with special needs

30. Communication • Coordinate with community and faith-based organizations • Use multiple, accessible communication mechanisms, such as: • Large print/audio for persons who are blind or have low vision • Interpreter services for deaf/hard of hearing or LEP persons, such as language banks, telephonic interpreter services, bilingual staff, contract or volunteer interpreters • Picture boards • Captioning of televised messages • Translation of written emergency information into other languages • Short, simple communication scripts, repeated frequently

31. Avoidance of Separation from Sources of Support or Assistance • Durable medical equipment (wheelchairs, walkers, scooters, catheters, ostomy supplies, etc.) • Service animals • Caregivers and attendants, family members and companions • Medication, supplies

32. Integration • Avoid isolation of individuals with special needs unless necessary • Avoid misdirecting individuals to higher levels of care than what they need, such as hospitals, acute care facilities, or medical shelters • Provide access to appropriate equipment, medication, personnel or other resource support

33. Accessibility • Transportation • Secure accessible transportation (lift equipped) for the individual and his or her equipment, service animal, or caregiver • Ensure trained personnel to operate the vehicle • Evacuation • Arrange an inspection by emergency management or firefighting officials • Inform affected persons about the plan as early as possible • Employ procedures for 100% accountability

34. Accessibility • Sheltering • Accessible facilities/programs • Alternative sources of power • Bathing and toileting facilities • Beds • Supplies and equipment • Hospitals, congregate care facilities • and sheltering in place

35. Recovery • Accessible housing and transportation • Continuity of health care and human services • Supports for everyday life • Community connections

36. Emergency Preparedness Resources HIPAA Privacy and Civil Rights http://www.hhs.gov/ocr/hipaa/emergencyPPR.html www.hhs.gov/od/emergencypreparedness.html http://mentalhealth.samhsa.gov/publications/allpubs/SMA03- 3828/default.asp