How to Provide The Mandatory Annual HIV Confidentiality Update: For HIV Service Providers in New York Who Need to Fol

1. How to Provide The Mandatory Annual HIV Confidentiality Update: For HIV Service Providers in New York Who Need to Follow Article 27-F of the NYS Public Health Law

2. Technical difficulties? • Call 212-243-1313 with technical problems during webinar OR • Click on “feedback” icon – right side of toolbar.

3. Who are Your Trainers? Sally Friedman, Esq. Kate Wagner-Goldstein, Esq. Legal Action Center 3

4. Free Legal Services Including – HIV testing & confidentiality Discrimination based on: HIV status Alcohol/drug history Criminal record – Rap sheet review and error correction Certificates of Relief and Good Conduct Job & Housing Discrimination 4

5. Background Why are you here?

6. First, some legal background • The New York State HIV Confidentiality Law – Article 27-F of the Public Health Law –protects the confidentiality of HIV-related information about people who receive services from most health care or social services providers in New York. • Your agency must comply with Article 27-F’s confidentiality requirements.

7. Some legal background (cont.) • Regulations implementing Article 27-F require providers subject to the law to: • establish HIV confidentiality policies and procedures, • require all staff to understand & follow them, • annually review these policies and procedures, and • ensure – and document – that all employees receive initial and annual in-service training on HIV confidentiality.

8. This HIV confidentiality capacity-building initiative: What is it? • The NYS Dept. of Health – AIDS Institute is sponsoring this HIV confidentiality capacity-building initiative • “Dear Colleague” letter (in your hand-outs) explains – • What is expected of your agency, and • How the DOH, AIDS Institute and the Legal Action Center can help you succeed in fulfilling these responsibilities, in-house!

9. This HIV confidentiality capacity-building initiative: What is it? (cont) Goals of initiative: help your agency develop in-house capacity to ensure – • Your HIV Confidentiality Policies and Procedures are in place, up to par, and updated annually, AND • Your staff with responsibility for conducting your organization’s annual staff in-service on HIV Confidentiality are ready and able to accomplish this successfully.

10. This HIV confidentiality capacity-building initiative: Target audience This training is for – • Program directors, managers, and supervisors or staff responsible for – • developing and updating your agency’s HIV confidentiality policies and procedures, or • conducting annual, in-house, staff in-service on HIV confidentiality.

11. By end of training, you should be able to . . . • State the major requirements of the NYS HIV confidentiality law (and HIPAA, if your agency must comply with it, too) • Develop (or update) your agency’s own HIV Confidentiality Policies and Procedures to comply with HIV confidentiality law • and…

12. By end of training, you should be able to. . . (cont.) • Conduct an annual review and update of your agency’s HIV Confidentiality Policies and Procedures • List 3 options for conducting your agency’s HIV confidentiality in-service and • Conduct a simple, straightforward annual staffin-service on HIV confidentiality

13. Hand-outs • This PowerPoint • Another PowerPoint: • Our Annual HIV Confidentiality Update • Model HIV Confidentiality Policies & Procedures for HIV/AIDS Service Providers in New York State – PRINT THIS OUT FOR WEBINAR • HIV Confidentiality Case Studies • More…

14. Hand-outs (cont.) • New York State’s HIV Confidentiality Law and Federal HIPAA: A Summary for HIV/AIDS Providers • Dear Colleague Letter • AI Technical Assistance Bulletin – DOH-5032 • Q&A – DOH-2557 • Technical Assistance Bulletin – HIPAA Compliant Authorization….. (2005) • More…

15. Hand-outs (cont.) • Flow chart • HIPPA Compliance Checklist • HIPAA Information Sheet for HIV Providers-NYS • HIV/AIDS Testing, Confidentiality & Discrimination

16. Hand-outs (cont.) You should have received (cont.): If you didn’t download them, you can get them by clicking on the tab toward the top right of your toolbar that looks like 3 pieces of paper. You’ll see “hand-outs” if you put your mouse over it. 16

17. Questions/discussion? • You can ask questions! • Every 20 minutes or so – question & answer break.

18. Step 1 Your Agency’s Policies & Procedures: How to Create & Implement Them

19. Your policies & procedures– purpose • Your agency is required to put in place policies and procedures to – • Maintain confidentiality of HIV related information, and • Assure that confidential HIV related information is disclosed only when appropriate and in accordance with the Article 27-F and the regulations that govern your agency.

20. Your policies & procedures – preliminary steps • Determine how/when the confidentiality law applies to your agency (Model Policies & Procedures, p.2): • Health and social service provider? • See App. 3 of Model Policies & Procedures • If not – have a contract with the AIDS Institute requiring compliance with Art. 27-F?

21. Your policies & procedures – preliminary steps (cont.) • If not (neither “health or social service provider” or contract with AIDS Institute) – • then only requirement to comply with Art. 27-F is: when receive HIV-related information through written release.

22. Your policies & procedures – preliminary steps (cont.) • Determine which confidentiality regulations apply to your agency. • Which state agency regulates your agency? • Which regulations apply? • Example: DOH regulations – Part 63

23. Your policies & procedures – preliminary steps (cont.) 3. Decide on terminology you will use in your Polices & Procedures. • “Confidential HIV-related information” (Art. 27-F term) or “Personal health information” (“PHI”) (HIPAA term) • “Capacity to consent” 3. Anything else?

24. Your policies & procedures – requirements Required Components • Training & Updating • Internal communications protocols • Protocols to safeguard security of confidential records & information and……

25. Your policies & procedures – requirements(cont.) Required Components (cont.) • Protocols for handling requests by other parties for HIV-related information • Anti-discrimination provisions We’ll discuss these more later…

26. Your policies & procedures – content Suggested components Introduction: • Purpose • Confidentiality policy • Staff responsible • Definitions See Model Policies & Procedures, p. 5

27. Your policies & procedures – content(cont.) Required Components 1. Training & updating: • Policies & procedures to educate all staff on – • New York’s HIV confidentiality law, and • Your agency-specific HIV confidentiality policies and procedures.

28. Your policies & procedures – content(cont.) 1. Training & updating: (cont.) • Policy must require – • Annual review and update of agency’s HIV Confidentiality Policies and Procedures, and • Annual staff in-service on HIV confidentiality, in-house • Designate staff responsible for both.

29. Your policies & procedures – content(cont.) • Training & updating(cont.) • Require initial employee education and annual in-service for staff on HIV confidentiality. • Maintain list of all employees who have received such training. more…….

30. Your policies & procedures – content(cont.) • Training & updating(cont.) • Include volunteers and peers who have access to HIV-related information. • Extent of training will depend on how much access they have and extent of work they do. more…….

31. Your policies & procedures – content(cont.) • Training & updating(cont.) • Obtain/update employee attestations: • Have received this training. • Have read and will abide by agency’s HIV Confidentiality Policies and Procedures. • See sample attestation – App. 4 of Model Policies & Protocols

32. Your policies & procedures – content(cont.) • Training & updating(cont.) • Volunteers and peers should sign attestations too.

33. Your policies & procedures – content(cont.) 1. Training & updating (cont.) • Inform your agency’s contractors providing services in which HIV related information might be disclosed: • That they must follow the confidentiality requirements. More…

34. Your policies & procedures – content(cont.) 1. Training & updating (cont.) • (contractors, cont.) • Advisable to highlight the requirement verbally • Could provide contractor with literature about Article 27-F • Document that you have done so. • Include this in the contract and/or MOU

35. Your policies & procedures – content(cont.) 1. Training & updating(cont.) • OPTIONAL: • Provision – “Educating Clients about HIV Confidentiality Policy & Rights” • See Model Policies & Procedures, p.7

36. Your policies & procedures – content(cont.) 2.Internal communications protocols: • Develop “need to know” protocol & list. (See Model Policies & Procedures, App. 5, p. 32): • Protocol: Limit access to and disclosure of HIV-related information to authorized employees who reasonably need access to perform designated job duties/functions. Specify any limits on access. More…..

37. Your policies & procedures – content(cont.) 2.Internal communications protocols: • Develop “need to know” protocol & list (cont.) • List job titles/functions within those job titles for which employees are authorized to access confidential HIV related information: your “need to know” list.

38. Your policies & procedures – content(cont.) 2. Internal communications protocols (cont.) • Distribute “need to know” list to all employees during employee education sessions. • Require that only those staff who received such education may have access to confidential HIV-related information while performing the authorized functions specified in your “need to know” list.

39. Your policies & procedures – content(cont.) 2. Internal communications protocols (cont.) • For agencies only bound by Art. 27-F because of AIDS Institute contract, • Add provision about internal release form. (Model Policies & Procedures, p. 8

40. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information: • Ensure that records containing confidential HIV related information, including records that are stored electronically, are: • Maintained securely, and • Used only for the purpose intended. • See Model Policies & Protocols, p. 9 more…..

41. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): • Cover “conversations about clients” • Cover how to contact clients at home. • See ideas in Model Policies & Procedures, p. 10 • Let’s do a poll.

42. Your policies & procedures– content 4.Protocols to safeguard security of confidential records & information (cont.): Correct answer –#1. Violates Article 27-F and HIPAA to disclose Jane’s HIV-related information to someone else who answers the phone or on her answering machine unless Jane signed an HIV-specific release. 42

43. Your policies & procedures – content(cont.) 3.Protocols to safeguard security of confidential records & information (cont.): • Cover written, electronic (fax & email) & oral communications. • See ideas in Model Policies & Procedures, p. 10

44. Your policies & procedures – content(cont.) 4.Protocols for handling requests by other parties for confidential HIV-related information. Cover: • When you have a release – or can get one • New DOH releases !! – June 2011. • Provide “notice prohibiting redisclosure” (See App. 6, Model Policies & Procedure) • See Model Policies & Protocols, p. 13

45. Your policies & procedures – content(cont.) 4. Protocols for handling requests by other parties for confidential HIV-related information (cont.). Cover: • Requests when there is no release: • Is there some other authorization under Art. 27-F? (See slides, below.) • Special procedure for subpoenas: • Redact HIV information? • Withhold that part of the record?

46. Your policies & procedures – content(cont.) • Protocols for handling requests by other parties for confidential HIV-related information(cont.) Guidelines could also apply to disclosures your agency needs/decides to make (as opposed to at 3rd party’s request) more…..

47. Your policies & procedures – content(cont.) Disclosures without a release – To outside health care providers: • See Poll. • Decide which type of release to require: general or HIV-specific • See Model Policies & Protocols pp. 13-14

48. Your policies & procedures – content(cont.) Disclosures without a release – To outside health care providers: • Correct answer -- #1 • Disclosures to health care providers permitted if necessary for appropriate care/treatment of patient • Not for infection control • See Model Policies & Protocols pp. 13-14

49. Your policies & procedures – content(cont.) Disclosures without a release(cont.)– Physicians’ disclosures about Minors & Incompetent Adults: Applies only if physicians on staff • See Model Policies & Protocols p. 14

50. Your policies & procedures – content(cont.) Disclosures without a release (cont.)– To “Contacts” (sexual or needle-sharing partners) – if agency is not a mandated case reporter • Provisions will vary depending on whether have physician on staff • See Model Policies & Protocols pp. 15-18