Confidentiality in Your TEAP Program

1. Confidentiality in Your TEAP Program By Diane A. Tennies, Ph.D., LADC Lead TEAP Health Specialist October 20, 2011

2. Learning Objectives • Name the two regulations which protect TEAP-related information for Job Corps students. • Explain when disclosures are permissible and the limited exemptions contained within the regulations. • Define ways to convey necessary information to involved staff without violating the privacy regulations. • Define which staff on a Job Corps center 'need to know' drug and alcohol-related personal health information.

3. Why can’t it just be this simple?

4. Overview • Today will be BASIC – plan is to offer a PART TWO as well • There are ‘take home messages’: • Know your state/local laws • Make process transparent • Include the student in the process • Have a thoughtful process (SOP/COP) • “Because it violates HIPAA” – is not a thoughtful response • Document • Two-fold mission • Comply with rules (aka: protect your license) • Educate staff

5. Question • What are specific ways you ensure confidentially of TEAP information?

6. Relevant History • Early 1970’s Congress believed stigma associated with substance abuse would deter people from seeking treatment • Resulted in 42 CFR Part 2 • Guaranteed strict confidentiality of information for those receiving Alcohol and Drug Prevention and Treatment Services • Intent: Equalize playing field • Insure alcohol and drug (A & D) abuse patients were NOT made more vulnerable because of the existence of treatment records than individuals who had A & D problems but had not sought treatment

7. 42 CRF Part 2 Replaced a Much More Informal System of Confidentiality

8. And then in 1996 came….

9. Standards for Privacy of Individually Identifiable Health Information Final Rule 2000 • Substance abuse programs that are subject to HIPAA must comply with the privacy rule as well. Job Corps is such a program. • (See 42 CFR 2.11 Program definition: An individual or entity (other than a general medical care facility) who holds itself out as providing and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment). • The general rules established by Part 2 and the Privacy Rule regarding uses and disclosures of patient health information are very different. Substance abuse treatment programs must comply with both rules.

11. 42 CFR Part 2 • Anyone really read it? • What in the 26 pages is relevant to Job Corps? • Any information “which could reasonably be used to identify an individual and requires discloser be limited to the information necessary to carry out the purpose of the disclosure”

13. What are allowable disclosures based on 42 CFR Part 2? • Written authorization/consent (minors need to sign as well as guardian) *know state law • Internal communications** • Communication without patient identifying information (TB patient in hospital) • Medical emergency • Only to medical personnel and limited to necessary to address emergency • MUST account for disclosure (to whom; affiliation; by whom; time/date; nature of emergency

14. What are allowable disclosures based on 42 CFR Part 2? (continued) • Crime on program premises/against staff • To law enforcement, limited to circumstances/incident; patient status; name/address/last known whereabouts • Research • Audit and evaluation • Child abuse reporting • Comply with state laws • Part 2 ONLY allows for initial call but no follow up without consent or court order

15. What are allowable disclosures based on 42 CFR Part 2? (continued) • Properly issued court order • May release information with attorney or law enforcement subpoena ONLY with consent • If no consent = no release without court order • Qualified Service Organization/Business Associates (QSOA) agreement • If sign QSOA about storing data properly, etc.

16. 42 CFR Part 2 Factoids • Applies even if person seeking information has it or can obtain through another source • Applies to law enforcement/attorney issued subpoenas • Disclosing presence of patient at facility identified as place where drug and alcohol services provided requires release • Memories/impressions of program staff are considered protected ‘records’ even if not recorded

17. What We Are Not Discussing Today • Right to access/deny access to PHI • Amending/denial of amending • Redisclosure (HIPAA silent/42 CFR requires statement prohibiting redisclosure) • Accounting of disclosures of PHI (6 years worth; applies to court orders/child abuse reporting/crimes/research/health oversight. Must include: date of disclosure; to whom; by whom; why; what).

18. There Are Implications of HIPAA/42 CFR Violations

19. Internal Program Communication • Limited to: Need for information in connection with their duties that arise out of the provision of diagnosis, treatment or referral for treatment (42 CFR 2.12 c 3) • May be acceptable as long as: • Within program • Between program and entity with direct administrative control over program

20. However…. • HIPAA requires you establish written policies to comply with minimum necessary requirement of Privacy Rule • 42 CFR 2.16 requires written procedures to regulate access to records • SO… • Have written policies about when, how and what is disclosed to others, both within and outside of Job Corps

21. So which staff ‘need to know’? • Excellent question • May be culture on center which dates back to earlier ‘versions’ of TEAP. Do they need to be revisited? • What is your center’s culture about confidentiality? • For instance: Used to be Center Director was given nanogram level to make decision about whether an additional 15 days would be allowed to test for a third time

22. Need to Know • Basic considerations: • What is our mission? (Employability) • What is the expected outcome of having this information? • How does having this information meet goal/help student? • What does staff need to know to work with the student?

23. Getting Creative • Identify information from Health and Wellness Center and not from TEAP • Make statements such as “Student in jeopardy of not fulfilling 45-day obligation” • 45-day projection status • Under what circumstances would you share the actual ng. level of drug screen? • Under what circumstances would you share what drug the student tested positive for? • Have authorization signed by student who has failed 2nd screen notifying them that results are made available to others (CSIO, RO)

25. Your Suggestions:

26. Learning Objectives-Revisited • Name the two regulations which protect TEAP-related information for Job Corps students. • 42 CFR Part 2 and HIPAA • Explain when disclosures are permissible and what are the limited exemptions contained within the regulations. • Best practice: Talk with student and get authorization • Have COP/SOP and educate staff/students • Define ways to convey necessary information to involved staff without violating the privacy regulations. • Get creative – why staff need information/what is the culture • Define which staff on a Job Corps center have a 'need to know‘drug and alcohol-related personal health information. • Have SOP/COP for guidance

27. Questions

28. References • 42 CFR Part 2: http://www.samhsa.gov/healthPrivacy/ • HIPAA: http://www.hhs.gov/policies/index.html • http://www.nj.gov/humanservices/das/information/SAMHSA-Pt2-HIPAA.pdf