Do you ever wonder what you can share? HIPAA Scenarios

1. Melissa Cusey, RN, BSN, Nurse Specialist, Humanitas Dr. Diane Tennies, PhD, LADC, Lead TEAP Health Specialist, Humanitas Do you ever wonder what you can share? HIPAA Scenarios

2. Objectives: • After this presentation, participants will be able to: • Articulate what information can be shared in CIS and will be able to list two types of information that cannot be placed in CIS.  • Identify the difference between knowledge versus access in transmission, storage, and confidentiality of medical, health, and disability-related information. • List three ways to protect personal medical and disability information in the storage of medical records. • Verbalize two ways to transfer medical information that will protect the confidentiality of the medical/disability records. • Describe the additional requirements that 42 CFR Part 2 places on PHI. • Recognize elements of reasonable and appropriate ''need to know” policy.

3. In 1996 came….

4. What is HIPAA? – General Information • The Health Insurance Portability and Accountability Act of 1996 was enacted by Congress and signed by President Clinton. The Act is made up of: • Title I (Portability) of HIPAA protects health insurance coverage for workers and their families when they change or lose their jobs • Title II (Accountability) of HIPAA, known as the Privacy Rule, deals with health information privacy

6. Personally Identifiable Information (PII) • Name • Date of Birth • Social security number • Photo/x-ray/video • Fingerprint/voiceprint • Mother’s maiden name • Address • Phone numbers • Medical record numbers • Legal documents • Medical notes • Email address • Educational records PII = information from which a person’s identity is apparent, or can reasonably be ascertained

7. Handling PII in Job Corps • Among other requirements, Job Corps requires that: • PII must be stored within CDSS • All incidents involving PII must be reported within 1 hour to the Job Corps Technical Assistance Center (TAC) (800) 598-5008, Option 4 • Health and counseling records be secured in a lock file cabinet • Refer to program instructions for more information • 06-08 Computer Applications and PII • 06-13 Reporting Incidents Involving PII • 06-23 Safe Keeping Records • 09-34 Reporting loss of PII

8. The Privacy Rule and the Center Information System (CIS) • Protected Health Information (PHI) should not be put into the CIS unless there is a specific reason that every single staff person needs to know that information • Accommodations should be put into CIS, but a medical diagnosis reference to the IEP should not be included

9. Which of these is correct? Sample Case Note A Sample Case Note B B: Student observed to return from weekend pass under the influence I: Met with student to discuss concerns regarding behavior R: Student denied behavior P: Reviewed with student expectations on center and supports available • B: Student was showing signs of intoxication in class • I: Student was sent to the TEAP specialist for an alcohol screen • R: Student denied that he had been drinking alcohol although blew 0.09 on the breathalyzer • P: Student was enrolled in TEAP  

10. Documenting in CIS • What information should have been left out of scenario A? • Intervention included sending to TEAP for an alcohol screen (This is protected health information (PHI) and should not be entered in CIS) • Student denied that he had been drinking alcohol although registered 0.09 on the breathalyzer (Do not include test results) • Student was enrolled in TEAP (Again this is PHI)

11. Sharing PHI with Center Staff • Often, staff outside of the Health and Wellness Center need to know a student’s diagnosis • A student’s medical information should be focused on behavior or symptoms and not a medical diagnosis • Sometimes it’s okay to share common diagnoses after talking with the student; case-by case basis • Information should only be shared if a particular staff member must know the information to successfully assist students and perform his or her job duties

12. The “Need to Know” • HIPAA does not block the communication of information on a “need to know” basis on center • This is the same for 42 CFR Part 2 (more on this later) • The minimal necessary amount of information about a student’s health or disability may be shared with staff if this information is vital for staff to successfully assist students and to perform their job duties • Information must be shared for the safety and security of students or staff and to protect centers from liability

13. Transmission of Medical Information • Any and all records that are health or disability related, or that contain any of those types of information, must be kept separate from other records about the individual. • If hard copies are transmitted, health or disability information should be placed in a separate file. That file should be placed in a sealed envelope that is clearly marked as containing such information. • Additionally, diagnoses should not be included in significant incident reports (SIRs).

14. Oral Transmission • Keep in mind that the confidentiality of medical, health, and disability-related information must be maintained when the information is being transmitted orally – in other words, when it is being discussed aloud. • This means that you must be sure that all such discussions take place in private locations where unauthorized persons cannot overhear the conversation, either voluntarily or involuntarily.

15. MEDICAL SCENARIOS

16. Receive Information Confidentially: Scenario 1 • Your medical clerk called a non-resident student to inform them of an appointment at the Health Department for follow up on their TB test. The person answering the phone identifies themselves as the wife of the student. • The next day the non-resident student comes into your office very angry that a message was left with his girlfriend with whom he just broke up. The student states he wants to file a formal complaint. • Does the student have a complaint? • If the information could not be left with the student what is the minimum should have been done? • What type of training should be conducted?

17. HIPAA Notice: Scenario 2 • You are the HWM at Second Chances Job Corps Center, during a ROCA you questioned by the Health Assessor on where to find your HIPAA Notice poster. The assessor also commented on the 20 SHRs reviewed, and that none had a HIPAA Notice signed by the students or a note in the chronological record that a copy was sent to the parents of minor students. • What are some changes you can make to assure the HIPAA Notice is addressed? • Why is the HIPAA Notice so important? • Where should the HIPAA Notice be displayed?

18. Complaint: Scenario 3 • A few days later you receive a call from a parent asking if Job Corps has a policy on sharing medical information. The parent mentions to you that their 16-year-old daughter is a student on the center and neither the minor student nor that parent have received information on how health information is shared. • Does Job Corps have a policy on sharing of medical information? • Where would you look to find information on how medical information is shared?

19. Knowledge vs. Access: Scenario 4 • You are a new HWM on a center with a few minor students with chronic medical conditions. You receive a call in at 3:00 AM from the Duty Officer informing you the student needs to go to the Emergency Room, and the hospital is asking for permission to treat. • The Duty Officer asks if they can go into the Health and Wellness Center and get a copy of a release from the SHRs? • What can you do in the future to avoid this call?

20. Access & Disclosure: Scenario 5 • A former student calls and leaves a message requesting a copy of their physical exam, immunization record and dental exam. They request the information be faxed to 213-456-7890. • Who should review the Student Health Record for these items? • What is needed prior to releasing any of the above records? • Under HIPAA can this information be faxed?

21. Privacy Rule: Scenario 6 • John Doe has prescriptions that need to be refilled. You fax the refills to the MedX Pharmacy. The center driver picks them up and when he returns to center gives them to John Doe and mentions to John he used to take Prozac, too. The student is upset and complains to you. • What request can you make to the pharmacy to protect the students PHI. • Make sure all staff receive annual HIPAA Training.

22. HIPAA Authorization: Scenario 7 • Sara Jones is a newly-diagnosed insulin dependent diabetic. You share this information with the Food Services Manager and staff. It has been noticed by staff that Sara eats candy, chips, and cookies most of the time. • Can Sara’s health status be shared without her written permission?

23. Disclosure: Scenario 8 • The military recruiter comes by to visit John Smith weekly. John plans to join the military once he gets his GED. The recruiter comes in to the Health and Wellness Center and asks for copies of John’s student health record. Can you give him a copy?

24. Oral Transmission: Scenario 9 • Shawn, a Job Corps student, is waiting in line in the cafeteria. He overhears two staff members (center nurse & counselor) talking about placing a student named Mike on medical leave for a doctor’s appointment, medical tests, and a refill on medication. • The next day Mike comes to your office and asks how everyone knows about his doctor’s appointment and his leave to go home. • Is this an appropriate place for the nurse and counselor to discuss a student leave? • Who should the student be referred to hear his complaint?

25. Accidental Disclosure: Scenario 10 • A nurse was going on vacation and wanted to brief the Health and Wellness Manager about a new student's visit to the Health and Wellness Center that day. She drafted a quick email and in her haste to leave for vacation, she sent the email to the entire center distribution list. • What should happen next?

26. SHR Request: Scenario 11 • The center physician decides he needs a consult with a local medical specialist about a student that is 19 years old. The medical specialist requests a copy of the student’s medical records. • Is it necessary for you to obtain a signed release by the student before sending a copy to the specialist?

27. HIPAA and Mental Health Information • Most Important: There are stricter requirements for mental health records than for other medical records.  • "Psychotherapy notes” are afforded special privacy protections under this regulation. Ordinarily, a written client consent is required before psychotherapy notes can be disclosed to anyone.  • Psychotherapy notes are excluded from the provision that gives clients the right to see and copy their health information.

28. A Few More MH Points • The regulation allows limited uses/disclosures without consent or authorization in the following circumstances:  • when required for enforcement of the regulations by HHS  • when mandated by law  • when needed for oversight of the provider who created the psychotherapy notes  • when sent to a coroner or medical examiner  • when needed to avert a serious/imminent threat to health or safety • Adhere to the “minimum necessary” standard for use and disclosure of student health information.  Ask yourself, “What if my information  was being discussed likethis?”

29. Disclosure: Scenario 1 A 20-year-old student is referred to CMHC for "acting strange and talking out loud" in vocation class. The CMHC determines there is an acute psychosis happening and makes arrangements for transportation to the ED. As next steps are explained, the studentstates "do not tell my parents" and begins to have an argument with the chair in the room. • Can you contact parents?

30. Disclosure To Parents Of Minor: Scenario 1A As CMHC you have been seeing a 16-year-old student for the past month who has recently stopped taking psychotropic medication. • Can you contact parents?

31. Knowledge vs. Access: Scenario 2 A student with a chronic mental health condition stops taking medication and the CMHC has concerns it may impact their behavior on center. • Can the CMHC share this with Counselors and Residential Living Staff?

32. Disclosure: Scenario 3 Monday morning the CMHC receives a message from the mother of an 18-year-old student who wants to talk about behaviors observed over the weekend pass. You look in the SHR and there is no release to share information with the mother. • Can you call the mother?

33. Now to add another ‘wrinkle’: 42 CFR Part 2

34. Relevant History • Early 1970’s Congress believed stigma associated with Substance Abuse would deter people from seeking treatment • Resulted in 42 CFR Part 2 • Guaranteed stricter confidentiality of information for those receiving Alcohol and Drug Prevention and Treatment Services • Insure Alcohol and Drug abuse patients were NOT made more vulnerable because of the existence of treatment records than individuals who had A & D problems but had not sought treatment

35. Standards for Privacy of Individually Identifiable Health Information, Final Rule 2000 • Substance Abuse programs that are subject to HIPAA must comply with the privacy rule as well • Job Corps is such a program • The general rules established by Part 2 and the Privacy Rule regarding uses and disclosures of patient health information are very different. Substance abuse treatment programs must comply with both rules

36. What are allowable disclosures based on 42 CFR part 2? • Written authorization/Consent (minors need to sign as well as guardian) *know state law • Internal communications** • Crime on program premises/against staff • To law enforcement, limited to circumstances/incident; patient status; name/address/last known whereabouts • Medical Emergency • Only to medical personnel and limited to necessary to address emergency • MUST account for disclosure (to whom; affiliation; by whom; time/date; nature of emergency)

37. What are allowable disclosures based on 42 CFR part 2? (continued) • Research • Audit and Evaluation • Properly Issued Court Order: May release information with attorney or law enforcement subpoena ONLY with consent. If no consent = no release without court order • Child Abuse Reporting • Comply with state laws • Part 2 ONLY allows for initial call but no follow up without consent or court order

38. Internal Program Communication • Limited to: Need for Information in connection with their duties that arise out of the provision of diagnosis, treatment or referral for treatment (42 CFR 2.12 c 3) • May be acceptable as long as: • Within program • Between program and entity with direct administrative control over program

39. HOWEVER…. • HIPAA requires you establish written policies to comply with minimum necessary requirement of Privacy Rule • 42 CFR 2.16 requires written procedures to regulate access to records • So have written policies about when, how and what is disclosed to others, both within and outside of Job Corps

40. So which staff‘need to know’? • May be culture on center which dates back to earlier ‘versions’ of TEAP – do they need to be revisited? • What is your center’s culture about confidentiality? • For instance: Used to be Center Director was given nanogram level to make decision about whether an additional 15 days would be allowed to test for a third time

41. How to Implement • Identify information is from Health and Wellness and not from TEAP • Make Statements such as “Student in jeopardy of not fulfilling their 45-day obligation” • 45-day projection status • Under what circumstances would you share the actual nanogram level of drug screen? • Under what circumstances would you share what drug the student tested positive for? • Have authorization signed by student who has failed 2nd screen notifying them that results are made available to others (CSIO, RO)

42. Info Shared with Staff – Scenario 1 The TEAP specialist emails the weekend restricted list to staff which includes those students awaiting a 45-day follow-up screen. This list is available to a large contingent of the dormitory staff. The list is designed to restrict students from spending the night off center during their 45-day intervention period. • Does this practice fall under a ‘need to know policy’?

43. Info Shared with CSIO: Scenario 2 A student fails their second drug screen and will be a ZT termination. The CSIO has asked that copies of the CDD results be provided for “the file.” Do you release the medical report? Other options?

45. Notification: Scenario 3 A 17-year-old student tests positive. The TEAP Specialist immediately notifies the guardian of the these test results as well as of a recent CMHC consult. • Is this an acceptable policy?

46. Info Shared with Vocational Staff – Scenario 4 The welding instructor has observed concerning behaviors in a student who just entered into this vocation. He has asked you if the student tested positive on entrance. • Do you provide the results? • What would you need to consider?

47. TEAP-Related ‘Take Home’ Messages • Know your state/local laws • Make process transparent • Include the student in the process • Have a thoughtful WRITTEN process (SOP/COP) • “Because it violates HIPAA” – is not a thoughtful response • Document in the SHR

48. Information Notices • Job Corps Program Instruction 05-26—Survey of Computer Systems Containing Personally Identifiable Information (PII) • Job Corps Program Instruction 06-08—Use of Computer Applications Containing Job Corps Students PII • Job Corps Program Instruction 06-13—Reporting Incidents Involving Job Corps Students’ PII • Job Corps Program Instruction 06-23—Guidance on Safekeeping of Forms, Records, and Other Hardcopy Documents Containing PII

49. Resources • Health and Human Services HIPAA website http://www.hhs.gov/ocr/hipaa/ • HIPAA Violations and Enforcement http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/hipaa-violations-enforcement.shtml • 45 CFR § 164.508 • Job Corps Community Website—Health and Wellness—HIPAA • PRH Appendix 601—Student Rights to Privacy and Disclosure of Information • PRH Appendix 607—Transmission, Storage, and Confidentiality of Medical, Health, and Disability-Related Information

50. Questions and Thank You for the Participation