How to Create and Update Your Agency’s HIV Confidentiality Policies & Procedures and Ensure Staff Compliance 3.29.12

1. How to Create and Update Your Agency’s HIV Confidentiality Policies & Procedures and Ensure Staff Compliance 3.29.12

2. Technical difficulties? • Call 212-243-1313 with technical problems during webinar OR • Click on “feedback” icon – right side of toolbar.

3. Who is Your Trainer? Sally Friedman, Esq. Legal Action Center 3

4. Free Legal Services Including – HIV testing & confidentiality Discrimination based on: HIV status Alcohol/drug history Criminal record – Rap sheet review and error correction Certificates of Relief and Good Conduct Job & Housing Discrimination 4

5. Background Why are you here?

6. First, some legal background • The New York State HIV Confidentiality Law – Article 27-F of the Public Health Law –protects the confidentiality of HIV-related information about people who receive services from most health care or social services providers in New York. • Your agency must comply with Article 27-F’s confidentiality requirements.

7. Some legal background (cont.) • Regulations implementing Article 27-F require providers subject to the law to: • establish HIV confidentiality policies and procedures, and review/update at least annually • require all staff to understand & follow them, • ensure – and document – that all employees receive initialtraining on HIV confidentiality before they have access to HIV-related information. More….

8. Some legal background (cont.) • Update staff if changes in law or regulations. NOTE: slight change in DOH regulations went into effect March 2012. Staff update only required if there’s a change in the relevant law or regulations. But annual updates make sense to ensure staff compliance.

9. First, some legal background • If your someone in your agency violates the confidentiality law, your agency could be liable. • So you’ll want to get and keep your staff educated about HIV confidentiality requirements.

10. Goals of training Goals of initiative: help your agency develop in-house capacity to ensure – • Your HIV Confidentiality Policies and Procedures are in place, up to par, and updated at least annually, AND • Staff responsible for your organization’s HIV confidentiality training are ready and able to accomplish this successfully.

11. This HIV confidentiality capacity-building initiative: Target audience This training is for – • Program directors, managers, and supervisors or staff responsible for – • developing and updating your agency’s HIV confidentiality policies and procedures, or • educating staff about HIV confidentiality.

12. By end of training, you should be able to . . . • State the major requirements of the NYS HIV confidentiality law (and HIPAA, if your agency must comply with it, too) • Develop (or update) your agency’s own HIV Confidentiality Policies and Procedures to comply with HIV confidentiality law • and…

13. By end of training, you should be able to. . . (cont.) • Conduct annual review and update of your agency’s HIV Confidentiality Policies and Procedures; • Know resources for the initial HIV staff training; • Conduct simple, annual reminders for staff about HIV confidentiality law and policies that should improve compliance.

14. Hand-outs You should have received: If you didn’t download them, you can get them by clicking on the tab toward the top right of your toolbar that looks like 3 pieces of paper. You’ll see “hand-outs” if you put your mouse over it. 14

15. Hand-outs (cont.) • This PowerPoint • Model HIV Confidentiality Policies & Procedures for HIV/AIDS Service Providers in New York State – PRINT THIS OUT FOR WEBINAR • HIV Confidentiality Case Studies • New York State’s HIV Confidentiality Law and Federal HIPAA: A Summary for HIV/AIDS Providers • More…

16. Hand-outs (cont.) • AI Technical Assistance Bulletin – DOH-5032 • Q&A – DOH-2557 • Technical Assistance Bulletin – HIPAA Compliant Authorization….. (2005) • Flow chart • HIPPA Compliance Checklist • HIPAA Information Sheet for HIV Providers-NYS

17. Hand-outs (cont.) STAY TUNED FOR: HIV/AIDS Testing, Confidentiality & Discrimination, 2012 revision coming out in April at http://lac.org/index.php/lac/ hiv_aids_publications

18. Other resources • HIV/AIDS Confidentiality Law Overview Free webinar available 24/7 through AIDS Institute Clinical Education Initiative http://www.ceitraining.org/cme/

19. Questions/discussion? • You can ask questions! • Every 20 minutes or so – question & answer break.

20. Step 1 Your Agency’s Policies & Procedures: How to Create & Implement Them

21. Your policies & procedures– purpose • Your agency is required to put in place policies and procedures to – • Maintain confidentiality of HIV related information, and • Assure that confidential HIV related information is disclosed only when appropriate and in accordance with the Article 27-F and the regulations that govern your agency.

22. Your policies & procedures – preliminary steps • Determine how/when the confidentiality law applies to your agency (Model Policies & Procedures, p.3): • Health and social service provider? • See App. 3 of Model Policies & Procedures • If not – have a contract with the AIDS Institute requiring compliance with Art. 27-F?

23. Your policies & procedures – preliminary steps (cont.) • If not (neither “health or social service provider” or contract with AIDS Institute) – • then only requirement to comply with Art. 27-F is: when receive HIV-related information through written release.

24. Your policies & procedures – preliminary steps (cont.) • Determine which confidentiality regulations apply to your agency. • Which state agency regulates your agency? • Which regulations apply? • Example: DOH regulations – Part 63

25. Your policies & procedures – preliminary steps (cont.) 3. Decide on terminology you will use in your Polices & Procedures. • “Confidential HIV-related information” (Art. 27-F term) or “Personal health information” (“PHI”) (term AI uses in App. F) • “Capacity to consent” 3. Anything else?

26. Your policies & procedures – requirements Required Components • Training & Updating • Internal communications protocols • Protocols to safeguard security of confidential records & information and……

27. Your policies & procedures – requirements(cont.) Required Components (cont.) • Protocols for handling requests by other parties for HIV-related information • Anti-discrimination provisions We’ll discuss these more later…

28. Your policies & procedures – content Suggested components Introduction: • Purpose • Confidentiality policy • Staff responsible • Definitions See Model Policies & Procedures, p. 5

29. Your policies & procedures – content(cont.) Required Components 1. Training & updating: • Policies & procedures to educate all staff on – • New York’s HIV confidentiality law, and • Your agency-specific HIV confidentiality policies and procedures.

30. Your policies & procedures – content(cont.) 1. Training & updating: (cont.) • Policy must require – • Annual review and update of agency’s HIV Confidentiality Policies and Procedures, and • Initial employee orientation and updates when relevant law/reg. changes • Designate staff responsible for both.

31. Your policies & procedures – content(cont.) • Training & updating(cont.) • Maintain list of all employees who have received such training. • Include volunteers and peers who have access to HIV-related information. • Extent of training will depend on how much access they have and extent of work they do.

32. Your policies & procedures – content(cont.) • Training & updating(cont.) • Obtain/update employee attestations: • Have received this training. • Have read and will abide by agency’s HIV Confidentiality Policies and Procedures. • See sample attestation – App. 4 of Model Policies & Protocols

33. Your policies & procedures – content(cont.) • Training & updating(cont.) • Volunteers and peers should sign attestations too.

34. Your policies & procedures – content(cont.) 1. Training & updating (cont.) • Inform your agency’s contractors providing services in which HIV related information might be disclosed: • That they must follow the confidentiality requirements. More…

35. Your policies & procedures – content(cont.) 1. Training & updating (cont.) • (contractors, cont.) • Advisable to highlight the requirement verbally • Could provide contractor with literature about Article 27-F • Document that you have done so. • Include this in the contract and/or MOU

36. Your policies & procedures – content(cont.) 1. Training & updating(cont.) • OPTIONAL: • Provision – “Educating Clients about HIV Confidentiality Policy & Rights” • See Model Policies & Procedures, p.7

37. Your policies & procedures – content(cont.) 2.Internal communications protocols: • Develop “need to know” protocol & list. (See Model Policies & Procedures, App. 5, p. 33): • Protocol: Limit access to and disclosure of HIV-related information to authorized employees who reasonably need access to perform designated job duties/functions. Specify any limits on access. More…..

38. Your policies & procedures – content(cont.) 2.Internal communications protocols: • Develop “need to know” protocol & list (cont.) • List job titles/functions within those job titles for which employees are authorized to access confidential HIV related information: your “need to know” list.

39. Your policies & procedures – content(cont.) 2. Internal communications protocols (cont.) • Distribute “need to know” list to all employees during employee education sessions. • Require that only those staff who received such education may have access to confidential HIV-related information while performing the authorized functions specified in your “need to know” list.

40. Your policies & procedures – content(cont.) 2. Internal communications protocols (cont.) • For agencies only bound by Art. 27-F because of AIDS Institute contract, • Add provision about internal release form. (Model Policies & Procedures, p. 8)

41. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information: • Ensure that records containing confidential HIV related information, including records that are stored electronically, are: • Maintained securely, and • Used only for the purpose intended. • See Model Policies & Protocols, p. 9 more…..

42. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): • Cover “conversations about clients” • Cover how to contact clients at home. • See ideas in Model Policies & Procedures, p. 10

43. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): Case scenario/poll • Jane is a social worker at the Help Center (serves HIV+ clients and others). She calls her client, Tom, at home. Someone else answers and says Tom isn’t home. How can Jane leave a message without violating Article 27-F?

44. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): Possible answers: • Please have Tom call Jane. • Please have Tom call Jane at the Help Center. • Please tell Tom to call Jane about his HASA appointment. • 1 or 2. • None of the above.

45. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): Correct answer: #4: 1 or 2 Disclosing “HASA” appt = disclosure of HIV-related information. Tom would need to sign an HIV-specific release form. OK to mention the “Help Center. Would be different if Jane worked at the “HIV Help Center.”

46. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): • Cover written, electronic (fax & email) & oral communications. • See ideas in Model Policies & Procedures, p. 10

47. Your policies & procedures – content(cont.) 4.Protocols for handling requests by other parties for confidential HIV-related information. Cover: • When you have a release – or can get one • New DOH releases – June 2011. • Provide “notice prohibiting redisclosure” (See App. 6, Model Policies & Procedure) • See Model Policies & Protocols, p. 13

48. Your policies & procedures – content(cont.) 4. Protocols for handling requests by other parties for confidential HIV-related information (cont.). Cover: • Requests when there is no release: • Is there some other authorization under Art. 27-F? (See slides, below.) • Special procedure for subpoenas: • Redact HIV information? • Withhold that part of the record?

49. Your policies & procedures – content(cont.) • Protocols for handling requests by other parties for confidential HIV-related information(cont.) Guidelines could also apply to disclosures your agency needs/decides to make (as opposed to at 3rd party’s request) more…..

50. Your policies & procedures – content(cont.) Disclosures without a release – to health care providers Case scenario/poll • Jan has seen primary care doctor since HIV diagnosis three years ago. • Primary care doctor now plans to refer her to a specialist. Does doctor’s office need HIV release form to disclose Jan’s HIV status to specialist?