Client Advocacy: What to do When Your Client’s HIV Confidentiality or Testing Rights Have Been Violated 6-12-12

1. Client Advocacy: What to do When Your Client’s HIV Confidentiality or Testing Rights Have Been Violated 6-12-12

2. Who’s the Legal Action Center? • Anti-Discrimination & Privacy Work: • People with criminal records, alcohol/drug histories, and/or HIV/AIDS • Legal services & litigation • Advice to providers • Trainings • Policy advocacy & research

3. Free Legal Services Including – HIV testing & confidentiality rights Discrimination based on: HIV status Alcohol/drug history Criminal record – Rap sheet review and error correction Certificates of Relief and Good Conduct Job & Housing Discrimination 3

4. How to get help? • Call the Legal Action Center • 212-243-1313 • 800-223-4044 (toll-free) • Clients: • Ask for “paralegal on call” • Providers: • Ask for “attorney on call” • Monday – Friday, 1 to 5 pm

5. This training has 3 parts: • Part 1: Review of the Basics: • Fundamentals of New York’s HIV Testing and Confidentiality Law • Assumes you’ve received overview before • Part 2: Client Advocacy: HIV Confidentiality or Testing Rights Violated by a Different Agency • Part 3: Client Advocacy: HIV Confidentiality or Testing Rights Violated by Your Agency

6. Hand-outs • PowerPoint • Flow chart on NYS HIV confidentiality law • HIV/AIDS Testing, Confidentiality & Discrimination: What You Need to Know About New York Law • Two DOH “Technical Assistance” bulletins on release forms – DOH 2557 & 5032 • DOH materials on Art. 27F changes • Sample Complaint narratives All are also at: http://lac.org/index.php/lac/149#advocacy

7. Other resources – confidentiality & testing • Art. 27-F amendments of 2010: http://www.health.ny.gov/diseases/aids/ testing/ • Forms and guidances on NYS DOH AIDS Institute website: http://www.health.ny.gov/diseases/aids/ • HIV/AIDS Confidentiality Law Overview. Free webinar: www.ceitraining.org/cme/

8. Part 1: Review of HIV Confidentiality & Testing Basics

9. Review of the Basics HIV Confidentiality

10. Relevant Laws • Major Laws governing confidentiality of health information – and HIV related information: • Federal Law: HIPAA (Health Insurance Portability & Accountability Act) • New York Law: NYS Public Health Law, Article 27-F

11. HIPAA – What is it? • Federal law that establishes minimum safeguards to protect the privacy of medical records and other “protected health information” (“PHI”). • Applies to protected health information no matter how it is shared: electronic, written or oral form.

12. HIPAA: Who is covered? Covered Entities Are: • Health Care Providers • Health Plans • Health Care Clearinghouses IF they transmit protected health information electronically in order to process payment or make eligibility determinations.

13. Article 27-F – What is it? New York State law that governs: • HIV testing • HIV confidentiality • HIV reporting • HIV partner notification • Also note related provisions about HIV case reporting in Pub. Health Law §§ 2130-2139

14. Article 27-F - Who is covered? • ANY person or agency who receives HIV-related information about a protected individual: • while providing a covered “health or social service” Examples: health care professionals and health facilities, foster care agencies, school nurses, OR

15. Article 27-F Who is covered (cont.)? 2.Anyone who receives HIV-related information pursuant to a proper written release. This means – • if you obtain a client’s HIV information pursuant to his or her signed HIV release form, you must follow Article 27-F. • if you disclose a client’s HIV information pursuant to an HIV release form, the person/agency receiving it must follow Article 27-F too. OR

16. Article 27-F Who is covered (cont.)? • ANY New York state or local governmental agency that: • provides, supervises or monitors health or social services. Examples: DOH, OASAS, OTDA, DOCS, HRA, DSS

17. Article 27-F Does NOT apply to: • Protected individuals themselves • Friends, relatives • Courts • Insurers • Pharmacies • Federal agencies (military, federal prisons) • Schools (except medical staff) • Employers

18. Article 27-F Does NOT apply to(cont.): BUT other laws may protect confidentiality. Examples: • U.S. Constitutional right to privacy – applies to government • Americans with Disabilities Act – applies to employers • Privacy Act – applies to federal government

19. HIPAA & Article 27-F:Who must comply with both? • Most health care providers in New York State, assuming they transmit health information electronically for purposes of billing or reimbursement.

20. What happens if both HIPAA & Art. 27-F apply? • HIPAA pre-empts “contrary” state law except if state law is “more stringent” than HIPAA – meaning it provides greater privacy protection or gives individuals more rights. • Article 27-F is usually more protective (“stringent”), so usually you must follow Article 27-F.

21. General Confidentiality Rule • HIPAA & Art. 27-F generally both prohibit the disclosure of some health information about an individual. • HIPAA: covers nearly all “protected health information.” • Article 27-F: covers only “HIV-related information.”

22. Article 27-F:The general rule • NO DISCLOSURE: A provider may not disclose any – • HIV-related information obtained while providing health or social service or through a release.

23. Article 27-F:The general rule (cont.) “HIV-related information” includes – • Had an HIV test (whether positive or negative) • Has HIV infection, HIV related illness or AIDS • Has been treated/is being treated for HIV • Takes medication specific to HIV disease • Is a “contact” of someone with HIV (spouse, sexual or needle-sharing partner)

24. Article 27-F: HIV Related Information includes: Case study: In the Waiting Room

25. Article 27-F:The general rule (cont.) Case Study – waiting room • John & other patients sitting in clinic waiting room. • Clinician enters: “John, please come for your HIV test results.” Did clinician disclose protected HIV-related information? • Yes • No

26. Article 27-F: HIV Related Information includes(cont): Correct Answer: #1 – Yes. “HIV-related information” includes: • Had HIV test – even if results not disclosed.

27. “Exceptions” to the General Rule: When Disclosure is Permitted Despite general non-disclosure rule: • Both HIPAA & Article 27-F have “exceptions” that permit sharing HIV information. • Main Article 27-F “exceptions” are outlined in Article 27-F flow chart (see slide below, and hand-out).

29. Main Article 27-F exceptions permitting disclosure Exceptions covered by this presentation: • Written Release • Internal communications • Disclosures to health care providers Note: Follow Article 27-F rules governing these exceptions, since they are “more stringent” – Article 27-F provides greater protections than HIPAA.

30. Exception #1: Written Release • Any and all confidential HIV related information can be disclosed with (proper) written release. • Use NYS DOH-approved release (complies with Article 27-F & HIPAA) or • Form that’s consistent with it. • DOH forms are in hand-outs(more on that later) • In writing. No oral release! • Voluntary.

31. Written Release (cont.) • Signature – Do not ask client to sign blank or partially completed form. • Who signs form? “Protected individual” if has “capacity to consent”: • Understand & appreciate nature & consequences of proposed disclosure and 2. Make an informed decision.

32. Written Release (cont.) - Approved Release Forms • Authorization for Release of Health Information and Confidential HIV Related Information – DOH 2557 (in handouts) & DOH 2775ES (Spanish – on DOH website), rev’d 2/11 • Authorization for Release of Health Information (Including Alcohol/Drug Treatment and Mental Health Information) and Confidential HIV/AIDS Related Information – DOH 5032 (in handouts) & 5032es (Spanish – on DOH website), rev’d 4/11

33. Written Release (cont.) -Helpful DOH Guidances on Release Forms • DOH wrote “Technical Assistance Bulletins” with FAQs • In Hand-outs • Forms & bulletins available at http://www.health.state.ny.us/diseases/aids/forms/ informedconsent.htm

34. Written Release (cont.) - No Redisclosure • Remember: Person receiving HIV-related information pursuant to release may not redisclose • Person providing HIV-related information pursuant to consent usually must provide notice prohibiting redisclosure • Sample Notice Prohibiting Redisclosure is in hand-outs

35. Written Release (cont.) - No Redisclosure (cont.) • For confidential drug/alcohol patient-identifying information, a Notice Prohibiting Redisclosure is also required • Sample forms: OASAS website • www.oasas.state.ny.us/mis/forms

36. Article 27-FWritten Release Case study: Oral release

37. Article 27-FRelease – Case Study Case study • Sam works at case management program. • Helping client get HIV housing through a City agency. • Sam calls client: “OK to disclose your HIV status to the City agency today? You can sign a release when you come in next week.” Is Sam complying with Article 27-F?

38. Article 27-FRelease – Case study(cont.) Possible Answers: • Yes • No

39. Article 27-FRelease – Case study(cont.) Correct Answer: #2 – No • Oral authorization to release information never sufficient under Art. 27-F. • Specific HIV release form required before disclosure.

40. Article 27-FRelease – Case studies(cont.) Case study: email/fax Could Sam have faxed or emailed client a form to sign and send back by fax or email? • Yes, if agency policies permit it. • No – never.

41. Article 27-FRelease – Case studies(cont.) Correct Answer – #1 Yes, if… Legally, faxed or scanned copy of release form is permitted. Agencies may set own policies. If permit emailing/faxing HIV information, set protocols to avoid accidental breach of confidentiality. 41

42. Exception #2:Internal Communications The rule: agency staff may share HIV related information IF: • Authorized to access HIV-related information in agency’s written “need-to-know” protocol; and • Have reasonable need to know/share the information to carry out authorized duties.

43. Exception #2:Internal Communications (cont.) Need-to-know list: • Job titles • Job functions • Justify why staff on list have reasonable “need to know” to be able to perform their job duties

44. Exception #2:Internal Communications (cont.) • HIPAA has similar concept: • Must make reasonable efforts to limit information to the “minimum necessary” to accomplish the intended purpose

45. Exception #3: Disclosures to Health Care Providers Case scenario • Referral to medical specialist

46. Exception #3: Disclosures to Health Care Providers Case Study – Referral to Specialist Jan has seen primary care doctor since HIV diagnosis three years ago. Primary care doctor now plans to refer her to a specialist. Does doctor’s office need HIV release form to disclose Jan’s HIV status to specialist? 46

47. Exception #3: Disclosures to Health Care Providers Possible answers: 1. Yes 2. No

48. Exception #3: Disclosures to Health Care Providers Correct answer: #2 – No. May disclose HIV related information to a health care provider when it is necessary to provide appropriate care or treatment to: 1. The individual 2. His or her child OR 3. A contact (spouse, sex or needle-sharing partner).

49. Exception #3: Disclosures to Health Care Providers (cont.) Answer (cont.). Here – Knowing Jan’s HIV status is necessary for specialist to give her appropriate care. Some agency policies require written release anyway – consider it good practice. DOH advises CBOs to always seek release for HIV disclosures to health care providers. Find out your agency’s policy. Disclosure never permitted for infection control. 49

50. Exception #3: Disclosures to Health Care Providers (cont.) • Document the disclosure. • Do not need notice prohibiting redisclosure.