PART TWO

1. PART TWO Page 1NC DHHS HIPAA PMO

2. Authorization Page 2NC DHHS HIPAA PMO

3. Authorizations • May be client initiated or component initiated • Client wants PHI disclosed for life insurance application • Social Worker wants to help client apply for disability benefits Page 3NC DHHS HIPAA PMO

4. Authorization - Content Requirements • A description of information to be used or disclosed that identifies the information in a specific and meaningful fashion • Examples • discharge summary • laboratory reports • clinical assessment reports • psychotherapy notes Page 4NC DHHS HIPAA PMO

5. Authorization - Content Requirements • The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure • Examples • Health Information Management Dept Staff at Dorothea Dix Hospital • DPH State Lab personnel • Dr. William Smith, Psychiatrist Page 5NC DHHS HIPAA PMO

6. Authorization - Content Requirements • The name or other specific identification of the person(s), or class of persons, to whom the covered health care component may make the requested use or disclosure • Examples • Attorneys in law firm of Smith and Jones • Johnson Pharmaceuticals - Psychotropic Medication Research Project staff Page 6NC DHHS HIPAA PMO

7. Authorization - Content Requirements • Expiration date or expiration event that relates to the client or the purpose of the use or disclosure • Examples • 90 days from date authorization is signed • 30 days post discharge Page 7NC DHHS HIPAA PMO

8. Authorization - Content Requirements • Statement of client’s right to revoke the authorization at any time and exceptions to the right to revoke and description of how client can revoke the authorization • must be in writing • revocation not effective to extent component has taken action in reliance on authorization • revocation not effective in certain circumstances where insurer has right by law to contest a claim under a policy Authorization Page 8NC DHHS HIPAA PMO

9. Authorization - Content Requirements • Acknowledge information used or disclosed pursuant to the authorization may be subject to re-disclosure by recipient and no longer protected by HIPAA • Signature of client or personal representative and date of the authorization • Description of personal representative’s authority to sign for client (e.g., guardian of person) Page 9NC DHHS HIPAA PMO

10. Authorization - Content Requirements • Electronic signature on authorizations will be acceptable if component adopts electronic signature standards • Authorization must be written in plain language • Can include additional data elements but they cannot be inconsistent with HIPAA requirements Page 10NC DHHS HIPAA PMO

11. Authorization - Content Requirements • Advise patient that he can refuse to sign • Generally, component may not condition treatment, payment and/or enrollment in a health plan, or eligibility for benefits on signing of authorization by client • Exceptions • Research related treatment • Provision of health care solely for purpose of creating PHI for disclosure to third party (e.g., life insurance physical) • Prior to enrollment in health plan if authorization is for eligibility or enrollment determinations • Disclosure is needed to determine payment of claim Page 11NC DHHS HIPAA PMO

12. Authorization - Content Requirements • Additional content requirements when authorization is requested by component for its own use or disclosure • Component WILL NOT condition treatment (except for clinical trials), payment and/or enrollment in a health plan, or eligibility for benefits on signing of authorization by client • A description of purpose for the request • Must provide individuals with the facts they need to make an informed decision whether to allow release of the information Page 12NC DHHS HIPAA PMO

13. Authorization - Content Requirements • Additional content requirements when authorization is requested by component for its own use or disclosure (cont’d) • Statement that client may: • inspect or copy information to be disclosed • refuse to sign the authorization • Statement that covered health care component will receive remuneration (when applicable) • Must provide client with signed copy of authorization Page 13NC DHHS HIPAA PMO

14. Authorization - Content Requirements • Additional content requirements when authorization is requested by component for disclosure by another covered entity • Description of purpose of requested disclosure • Statement that component will not condition treatment, payment or enrollment in health plan or eligibility for benefits on client signing authorization • Unless disclosure necessary to determine payment of claim • Statement that client may refuse to sign authorization • Must provide client with signed copy of authorization Page 14NC DHHS HIPAA PMO

15. Authorization Required • For disclosures of PHI for specified purposes other than TPO that are not otherwise allowed under the regulations • For disclosures to third parties specified by the client • For medical research • For marketing by third party • To use or disclose psychotherapy notes Page 15NC DHHS HIPAA PMO

16. When is an Authorization Invalid? • Expiration date has passed or expiration event has occurred • Not filled out completely with respect to required elements • Revoked by client • Authorization form lacks a required element • Material information in authorization is known by component to be false • Impermissable compound authorization Page 16NC DHHS HIPAA PMO

17. Compound Authorizations • Cannot combine with • Consent documents (e.g., TPO consent; consent for surgery) • Any other documents including any other written legal permissions from the client • Can combine with • Research including treatment • Another authorization for psychotherapy notes Page 17NC DHHS HIPAA PMO

18. Psychotherapy Notes as Defined in the Rules • Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the client’s medical record. Page 18NC DHHS HIPAA PMO

19. Psychotherapy Notes as Defined in the Rules • Excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: • Diagnosis • Functional Status • The treatment plan • Symptoms • Prognosis • Progress-to-date Page 19NC DHHS HIPAA PMO

20. Psychotherapy Notes - Administrative Issues • Most uses or disclosures of psychotherapy notes require an authorization • Covered health care providers • need to be aware of staff maintaining separate psychotherapy notes • evaluate how the psychotherapy notes are being maintained and safeguarded • ensure that MHPs understand the HIPAA requirements relative to psychotherapy notes Page 20NC DHHS HIPAA PMO

21. Authorizations Not Required - Psychotherapy Notes • To carry out TPO in following instances • Use by originator of notes for treatment • Use or disclosure by covered health care component for training purposes for students, trainees or practitioners in mental health • Use or disclosure by covered health care component to defend legal action or other proceeding brought by the client Page 21NC DHHS HIPAA PMO

22. Authorizations Not Required - Psychotherapy Notes • In the following circumstances (not TPO) • HHS Secretary to investigate or determine compliance • Use or disclosure required by law • Oversight activities required by law • Coroners and Medical Examiners • Threat to health or safety of person or public Page 22NC DHHS HIPAA PMO

23. Authorization and Consent- Administrative Issues • Covered health care component must retain signed authorizations and consents for minimum of 6 years from date of creation or date when last in effect, whichever is later • Authorization is valid for specified period of time or until a particular event occurs so 6 years after either one of these conditions is met • Consent is valid until client signs new consent or discontinues services with component so 6 years after either one of these conditions is met • Covered health care component can determine how retained (e.g., paper, electronic) • If consent is part of client’s medical record, retain in accordance with Record Retention and Disposition Schedule Page 23NC DHHS HIPAA PMO

24. Authorization and Consent- Administrative Issues • If a covered health care component has both a signed consent and authorization that relates to disclosure of PHI for TPO, the more restrictive document applies • Transition provisions • Allows providers to rely on authorizations and consents received prior to 4/14/03 for uses and disclosures of health information • Must obtain new HIPAA authorizations and consents for information created or received after 4/14/03 Page 24NC DHHS HIPAA PMO

25. State Law in Relation to Consents and Authorizations • Analysis is underway • Example of issues to be addressed • § 122C-53. Exceptions; client. • (a) A facility may disclose confidential information if the client or his legally responsible person consents in writing to the release of the information to a specified person. This release is valid for a specified length of time and is subject to revocation by the consenting individual. • Comparable to authorization but not consent Page 25NC DHHS HIPAA PMO

26. QUESTIONS? Next: Client Rights Page 26NC DHHS HIPAA PMO

27. Client Rights Page 27NC DHHS HIPAA PMO

28. Client Rights Identified in Notice • HHS has identified specific rights of clients as they relate to their protected health information in the Privacy Regulation. • Although “client rights” are introduced in the rule that requires a notice of privacy practices to be made available to clients, the rights of clients affect nearly all of the privacy rules. Page 28NC DHHS HIPAA PMO

29. Why Is A Notice Needed? • Most clients know and do not object : • Complete health information that is timely and accurate must be collected and maintained by their health care provider • Such information must be made available to the health care provider’s workforce in order to accurately diagnose and treat the client. Page 29NC DHHS HIPAA PMO

30. Information Through Notice • Clients have a right to be informed about all of the other ways their records are used. • Clients may not be aware of the fact that their private health information may also be used for other purposes: • Legal document describing care given • Verification for third-party payment • Tool used in quality improvement initiatives • Document used for research purposes • Information tracking for public health • Provides data for planning Page 30NC DHHS HIPAA PMO

31. Notice of Privacy Practices • Each health care provider and health plan must develop a notice of privacy practices that is posted prominently in the agency and must be generally available at time of service and provided in writing or electronically upon request. • For health plans, the Notice must be given no later than the plan’s compliance date and to new enrollees. Page 31NC DHHS HIPAA PMO

32. Notice of PrivacyPractices (cont) • The Notice must be presented as a separate document from all other forms and documents given to each client. • The Notice must include specific elements as required by HIPAA. • It must name the person to contact for more information or to file a complaint and provide their telephone number. • Whenever the Notice is revised, all clients who received the prior Notice must be given the revised Notice. Page 32NC DHHS HIPAA PMO

33. Elements to Be Included In the Notice of Privacy Practices Page 33NC DHHS HIPAA PMO

34. Required Elements in Notice • HIPAA requires a specific heading in the Notice. It does not leave the wording up to the provider. • Must have the following heading: “This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.” Page 34NC DHHS HIPAA PMO

35. Required Elements in Notice (cont) • The Notice must contain a description, including at least one example, of the types of use and disclosures that the covered health care provider is permitted to make for treatment, payment and other health care operations. • A description of each of the other purposes for which the covered health care provider is permitted or required to use or disclose PHI without the client’s written consent or authorization. • Each of purpose must be described in detail. Page 35NC DHHS HIPAA PMO

36. Required Elements in Notice (cont) • If a covered health care component engages in any of the following, they must be separately and specifically stated in the Notice: • Contacting a client for • Appointment reminders • Treatment follow-up • Other health-related benefits or services • Fund-raising Page 36NC DHHS HIPAA PMO

37. Other Required Elements in Notice (cont) • Statement that the covered health care component is required • By law, to maintain the privacy of individual’s information and provide notice of its legal duties and privacy practices • To abide by the notice currently in effect • To provide individuals with a revised notice should any revisions be necessary. Page 37NC DHHS HIPAA PMO

38. Client Rights Identified Page 38NC DHHS HIPAA PMO

39. Client Rights Golden Rule • We should treat health information about others as we would want others to treat health information about us. • Privacy has always meant that health information must be kept confidential. Page 39NC DHHS HIPAA PMO

40. Client Rights Identified • Client’s right to obtain a paper copy of the Notice from the covered health care provider or plan upon request, even though the client agreed to receive the notice electronically. • The client may be offered the option of receiving the notice electronically but he/she may still want a paper copy and has the right to have that. Page 40NC DHHS HIPAA PMO

41. Client Rights Identified (cont) • Client’s right to access, inspect and copy their protected health information. • Exception for research projects if client is also receiving treatment. • Request for access, inspection and copying should be evaluated by a professional who has the authority to make the determine if requested should be granted or denied. Page 41NC DHHS HIPAA PMO

42. Client Rights Identified (cont) • Client’s Right to amend their protected health information. • If, for example, a client disagrees with a medical opinion and submits a second opinion to be included in the medical record, the client has the right to request that his record be amended. • The covered health carecomponent must act on therequest within 60 days with a one-time 30 day extension. change Page 42NC DHHS HIPAA PMO

43. Client Rights Identified (cont) • Client’s Right torequest restrictions on certain uses and disclosures for the purpose of treatment, payment or health care operations. • Health care providers are not required to agree with request to restrict, but if they do agree then they are bound by such agreement. Page 43NC DHHS HIPAA PMO

44. Client Rights Identified (cont) • Client’s Right to obtain an accounting of disclosures of their protected health information maintained by this covered health care component. • This accounting of disclosures does not include any disclosures for the purpose of treatment, payment or health care operations. • Health care plans are requiredto account for other disclosures they may routinely make to researchers and to health oversight agencies. Page 44NC DHHS HIPAA PMO

45. Client Rights Identified (cont) • Client’s Right to confidential communications by alternative means or at alternative locations. • Should a client be concerned about receiving information about their health treatment or payment at home, they have the right to request that they be contacted only in a specified manner. • Calling only at work • Sending communications to another address This request should be honored if there is any indication that the disclosure of this information could endanger the client. Page 45NC DHHS HIPAA PMO

46. Client Rights Identified (cont) • Client’s Right to a contact person to whom the client may lodge a complaint about a health care provider. • The name and telephone number of such contact person must be included in the Notice of Privacy Practices. • The client may lodge a complaint directly with HHS. Page 46NC DHHS HIPAA PMO

47. Client Rights Exception • When a client requests information in the following categories, the request may be denied without affording the client any appeals rights. • Psychotherapy Notes • Information compiled for civil, criminal, legal actions/proceedings • Information subject to Clinical Laboratory Improvements Amendments (CLIA) • Information obtained from someone other than a health care provider under the promise of confidentiality where access would likely reveal the source of the information Page 47NC DHHS HIPAA PMO

48. Notice of Privacy Practices To Do List • Establish a point of contact by assigning an individual who has ownership of Notice • Decide whether a copy of Notice will go into client record or be maintained in permanent file elsewhere • Develop policies and procedures • Educate and train staff • Post approved notice and make copies available • Implement and monitor Page 48NC DHHS HIPAA PMO

49. Health Care Provider Duties • The Covered Health Care Component has the duty to ensure that clients are able to exercise their rights with respect to the protected health information that they maintain. • Each covered health care component must establish and implement policies and procedures that ensure these rights are exercised. RESPONSIBILITY Page 49NC DHHS HIPAA PMO

50. Facility Directory Page 50NC DHHS HIPAA PMO