ADDRESSING CONFIDENTIALITY AND DISCLOSURE ISSUES: BEHAVIORAL HEALTH PROFESSIONALS IN PRIMARY CARE

1. ADDRESSING CONFIDENTIALITY AND DISCLOSURE ISSUES: BEHAVIORAL HEALTH PROFESSIONALS IN PRIMARY CARE Robert P. Landau, Esq. Roberts, Carroll, Feldstein & Peirce, Inc.

2. RI policy favoring Patient-Centered Medical Home • RI DOH emphasizes that Patient-Centered Medical Home should include a family focus, interdisciplinary care, and the integration of mental health/behavioral health services in the primary care system • RI DOH adopted Joint Principles of the Patient-Centered Medical Home in March 2007 endorsed by American Academy of Family Physicians, American Academy of Pediatrics, American College of Physicians and American Osteopathic Association

3. Issues for integrating behavioral health • When and what to share behavioral health information with PCPs, specialists • Risks/benefits of integrated records • Confidentiality/Disclosure issues

4. hipaa Applies to health care providers and covered entities • Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter 45 CFR Part 160.103

5. hipaa • Privacy Rule applies to "protected health information" (PHI) which includes all "individually identifiable health information" that is transmitted or maintained in any format or medium, whether electronic, paper, or oral • Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity • Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf

6. hipaa “Individually identifiable health information” is information, including demographic data, that relates to: • the individual’s past, present or future physical or mental health or condition, • the provision of health care to the individual, or • the past, present, or future payment for the provision of health care to the individual, • and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual

7. Access to behavioral health information • No patient authorization is required for use and disclosure of PHI to carry out treatment, payment, health care operations (TPO) under HIPAA 45 CFR Part 164.506(a) • Can, but not required to, request patient consent to use or disclose protected health information to carry out TPO 45 CFR Part 164.506(b) • Minimum necessary disclosure standard does not apply to TPO 45 CFR 164.502(b), 164.514(d)

8. Access to behavioral health information • Minimum necessary standard Reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosureor request • Exception for psychotherapy notes 45 CFR Part 164.508(a)(2 • Exception for Drug and Alcohol Abuse Programs 42 CFR Part 2

9. Psychotherapy notes • Notes recorded (in any medium) by health care provider who is mental health professional documenting/analyzing contents of conversation during private counseling session or group, joint, or family counseling session and are separated from the rest of the individual's medical record • Excludes medication prescription/monitoring, counseling session start/stop times, modalities/frequencies of treatment, results of clinical tests, any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, progress to date 45 CFR Part 164.501

10. Psychotherapy notes • Psychotherapy Notes often referred to as process notes Cf. progress notes, medical record or official records • Process notes capture therapist's impressions about patient, contain details of psychotherapy conversation considered to be inappropriate for medical record and are used by provider for future sessions • Often kept separate to limit access, even in an electronic record system, because they contain sensitive information relevant to no one other than treating provider 65 FR 82622, 82623

11. Psychotherapy notes • A commenter recommended allowing use or disclosure of psychotherapy notes by members of an integrated health care facility as well as the originator • HHS Response/final rule makes it clear that any notes that are routinely shared with others, whether as part of the medical record or otherwise, are, by definition, not psychotherapy notes, as defined, i.e., lose protected status • To qualify for definition and increased protection, notes must be created and maintained for use of provider who created them and must not be only source of any information that would be critical for treatment of patient or for getting payment for treatment

12. Psychotherapy notes Summary information, such as the current state of the patient, symptoms, summary of the theme of the psychotherapy session, diagnoses, medications prescribed, side effects, and any other information necessary for treatment or payment, is always placed in the patient’s medical record

13. Psychotherapy notes Authorization always required except for: • Use by originator of psychotherapy notes for treatment • Use by covered entity for certain training situations • Use or disclosure to defend against action by individual • Requests from Secretary of HHS • Disclosures required by law (e.g., mandatory reporting) • Health oversight activities of originator • Disclosures about decedents to coroners and MEs • To prevent or lessen serious and imminent threat to health or safety of a person or the public 45 CFR Part 164.508(a)(2)

14. Psychotherapy notes • Authorization is required to share with other providers, including providers who work for the same entity • Authorization cannot be combined with another authorization (e.g., sharing other kinds of PHI) 45 CFR Part 164.508(c)(3)(2) • No access right or obligation to share psychotherapy notes with the patient or representative, even if disclosing information would not be harmful to patient's physical, mental or emotional health 45 CFR Part 164.524(a)(1)(i)

15. Whether to include psychotherapy notes in integrated chart

16. Psychotherapy notes • Some argue not to create/maintain HIPAA defined psychotherapy notes • Ethical rules, standard of care require appropriate documentation • If notes are prepared, but are commingled, then they are not subject to HIPAA exception and can be shared • But that raises general privacy and documentation issues

17. Emr issues • Easier to satisfy separation requirement • Need firewall to limit access • Breaking the Glass issue • Epic Pop Up Warning • WARNING: Access to Clinical Systems is RESTRICTED. Users may only access the patients with whom they have direct care responsibilities. Access to patient data is subject to audit. Unauthorized access or disclosure of sign-on codes will lead to disciplinary action up to and including termination of employment or your medical staff appointment • Need to know • Electronic audit

18. Substance abuse program records • 42 CFR Part 2 prohibits federally assisted substance abuse treatment programs from disclosing without patient’s consent (elements are not same as HIPAA) information that “would identify a patient as an alcohol or drug abuser” • Does not apply to all healthcare providers that have substance abuse information

19. Substance abuse program records Restrictions on disclosure apply to any information, whether or not recorded, which: • Would identify patient as alcohol or drug abuser either directly, by reference to other publicly available information, or through verification of such an identification by another person; and • Is drug or alcohol abuse information obtained by a federally assisted drug/alcohol abuse program for purpose of treating alcohol or drug abuse, making a diagnosis for that treatment, or making a referral for that treatment 42 CFR Part 2.12(a)

20. Substance abuse program records Under 42 CFR Part 2.11, a program is: a) An individual or entity or identified unit of a general medical facility that “holds itself out itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment,” OR b) Medical personnel or other staff in general medical care facility whose primary function is provision of alcohol or drug abuse diagnosis, treatment or referral for treatment and who are identified as such providers This is meant to exclude providers for whom substance abuse treatment and referrals are incidental to their regular practice

21. Substance abuse program records Does your entity: • Receive federal assistance • Include private-pay clinicians who use a controlled substance (e.g., benzodiazepines, methadone or buprenorphine) for detoxification or maintenance treatment of a substance use disorder • Advertise or characterize your services as substance abuse treatment or referrals • Notify other providers that you are available to receive such referrals • Have providers who primarily treat such cases

22. Substance abuse program records • Unlike HIPAA, no TPO exception for disclosures without authorization • To share without patient consent, need to be program that shares administration with receiving entity; or have Qualified Service Organization Agreement (QSOA)— analogous to BAA • When substance use disorder unit is component of larger behavioral health program/general health program, specific information about patient’s diagnosis, treatment or referral to treatment can be exchanged without patient consent among program personnel/administrative who need to know information

23. Substance abuse program records A QSO is a person or organization that provides services such as: • Data processing, bill collecting, dosage preparation, laboratory analyses • Legal, medical, accounting or other professional services • Services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy

24. Substance abuse program records A QSOA is a written agreement, wherein the QSO acknowledges: • By receiving, storing, processing or otherwise dealing with any patient records from Part 2 program, it is fully bound by the Part 2 regulations • If necessary, will resist in judicial proceedings any efforts to obtain access to patient records, except as permitted by these regulations

25. Substance abuse program records • Part 2 compliant consent is similar to HIPAA, except it must have statement that information cannot be re-disclosed without consent unless permitted by federal law • Thus, if you want multiple parties to receive the information, they must all be named on the consent HIPAA information can be re-disclosed without consent • Information you receive from a Part 2 provider also needs to be segmented because it cannot be re-disclosed

26. Other hipaa exceptions, no authorization needed Uses and disclosures for which an authorization or opportunity to agree or object is not required • Required by law • Public health activities • Disclosures about victims of abuse, neglect or domestic violence • Health oversight activities • Disclosures for judicial and administrative proceedings • Law enforcement purposes 45 CFR Part§ 164.512

27. Other hipaa exceptions, no authorization needed • Decedents • Cadaveric organ, eye or tissue donation purposes • Research purposes • To avert serious threat to health or safety if covered entity, in good faith, believes use or disclosure: (i)(A) Is necessary to prevent or lessen serious and imminent threat to health or safety of person or public; and (B) Is to person or persons reasonably able to prevent or lessen threat, including the target of threat; or (ii) Is necessary for law enforcement authorities to identify or apprehend an individual

28. Other hipaa exceptions, no authorization needed • Specialized government functions • Workers' compensation 45 CFR Part§ 164.512

29. Ri law on confidentiality • Generally cannot release health care records to third parties unless one of 24 exceptions apply where no consent is required RIGL § 5-37.3 • Key exceptions: (5) Between or among qualified personnel and health care providers within the health care system for purposes of coordination of health care services given to the patient and for purposes of education and training within the same health care facility

30. Ri law on confidentiality By health care provider to: • Appropriate law enforcement personnel or to person if health care provider believes that person or his/her family is in danger from patient • Appropriate child protective agencies if patient is minor child or parent/guardian of child and/or health care provider believes, after providing health care services to patient, that child is or has been physically, psychologically or sexually abused and neglected as reportable pursuant to section 40-11-3

31. Ri law on confidentiality • Appropriate law enforcement personnel or division of elderly affairs if the patient is elder person and healthcare provider believes, after providing healthcare services to the patient, that elder person is or has been abused

32. Ri law on confidentiality Need to know basis under RIGL 5-37.3-4 (c) Third parties receiving and retaining patient's confidential health care information must establish at least the following security procedures: (1) Limit authorized access to personally identifiable confidential health care information to person having a "need to know" that information

33. Importance of Documentation One position: Documentation by behavioral health provider in integrated record should be relatively brief and focused on information needed by medical provider: • What is the diagnosis, is it different from what medical provider thought? • What type of treatment will be provided? • Is the patient engaged in treatment? If not, what are obstacles and what should the care team watch out for? • Is treatment helping? If not, what adjustments might be needed? • What, if any, treatment or coordination of care is needed from medical provider?

34. Importance of Documentation Another position • Documentation can be self-serving • The records must contain sufficient information to justify the course of treatment, including, but not limited to: active problem and medication lists; patient histories; examination results; test results; records of drugs prescribed, dispensed, or administered; and reports of consultations and hospitalizations • § 11.4, Rules and Regulations for the Licensure and Discipline of Physicians (R5-37-MD/DO)

35. Importance of Documentation • Remember this is the first thing a Plaintiff attorney reviews to evaluate whether to sue • Accurate and thorough documentation is effective risk management • If something happens to you, do your records facilitate continuity of care? • Will displaying your records to a jury help you win or lose a case?

36. recommendations • It is important to inform a new client about the exceptions to confidentiality at the first session and then have the client sign a document acknowledging those exceptions • As appropriate, the provider should review the exceptions during the sessions • Revise general patient consent and authorization forms to incorporate information about the sharing of behavioral health information among providers and other members of care team. • Explain benefits of coordinated care and information sharing among members of care team

37. recommendations • Keep substance abuse treatment records, when generated by substance abuse treatment facilities and programs that receive federal assistance, separate • Substance abuse treatment information in primary care or other medical settings can be shared like other types of personal health information in medical record • Keep psychotherapy notes separate • Psychotherapy notes rarely need to be shared with rest of team

38. ISSUES UNIQUE TO INTEGRATED BEHAVIORAL HEALTH Relatively few differences between traditional outpatient and primary care based behavioral health • Perhaps incentive to minimize documentation • Need to control/limit access to psychotherapy notes, certain substance abuse records • Requires firewall in EMR if notes are electronic • Management, security and compliance are more difficult • Need clear policies/training on what information to share

39. HYPOTHETICAL,MINOR’S RIGHTS Assume minor is treated by psychologist for drug abuse issues and minor tells you not to tell parent, but parent demands access to information

40. HYPOTHETICAL,MINOR’S RIGHTS In the event a child refuses permission to contact parents to seek parental consent and if, in the judgment of a qualified professional, that contact would not be helpful or would be deleterious to the child who is voluntarily seeking treatment for substance abuse or chemical dependency, then non-invasive, non-custodial treatment services may be provided by a qualified professional without parental consent; provided, during the course of treatment, the qualified professional shall make attempts to obtain permission from the childto obtain parental consent for and parental involvement in the treatment services. RIGL § 14-5-4

41. HYPOTHETICAL, EMERGENCY Client with suicidal ideation is brought by rescue to inpatient psychiatric hospitalwhere client is stabilized, discharged, and referred to integrated primary care facility for follow-up care. • Client does not want his inpatient provider to disclose relevant information to LICSW, in part because of client’s paranoia symptoms • Client later states he is going to kill his mother and then himself, but demands that this be kept confidential because it is privileged

42. DUTY TO PROTECT • In Rhode Island, the social worker licensing statute provides an exception to confidentiality “when there is a clear and present danger to the safety of the patient or client or to other individuals.” The NASW Code of Ethics is incorporated into the statute and regulations as a ground for discipline • In Rhode Island, the psychology licensing statute and regulations incorporate the “ethical principles governing psychologists and the practice of psychology, as adopted by the Board” as a ground for discipline

43. DUTY TO PROTECT Emergency situations (b) No consent for release or transfer of confidential health care information shall be required in the following situations: (1) To a physician, dentist, or other medical personnel who believes, in good faith, that the information is necessary for diagnosis or treatment of that individual in a medical or dental emergency • R.I.G.L. § 5-37.3-4.  Limitations on and permitted disclosures

44. HYPOTHETICAL, HIV A client at an integrated primary care facility is being treated by a LICSW for bipolar disorder and heroin addiction and is HIV+. The social worker learns that client is sexually involved with another client of the facility who does not know about the client’s HIV status. The client promises to practice safe sex and tell the partner about the HIV, but there’s no evidence that the client will follow through. The social worker is unsure about her duty to protect the sexual partner and how to manage of confidential information related to HIV.

45. HYPOTHETICAL, HIV (a) In all cases when an individual's HIV test results are disclosed to a third-party, other than a person involved in the care and treatment of the individual, and except as permitted by § 23-6.3-7 (permitted disclosures re: confidentiality), and permitted by [HIPAA], the person so disclosing shall make reasonable efforts to inform that individual in advance of: (1) The nature and purpose of the disclosure; (2) The date of disclosure; (3) The recipient of the disclosed information. RIGL § 23-6.3-10 [Applies to physicians, CNMs, NPs, Pas]

46. HYPOTHETICAL, HIV (b) Health care providers may inform third-parties with whom an HIV infected patient is in close and continuous exposure related contact, including, but not limited to a spouse and/or partner, if the nature of the contact, in the health care providers opinion, poses aclear and present danger of HIV transmission to the third-party, and if the physician hasreason to believe that the patient, despite the health care provider's strongencouragement, has not and will not inform the third-party that they may have beenexposed to HIV. RIGL § 23-6.3-10

47. HYPOTHETICAL, HIV (a) It is unlawful for any person to disclose to a third-party the results of an individual's HIV test without the prior written consent of that individual, except for: (1) Laboratory/facility that performs HIV tests shall report test results to health care provider who requested test and to director (2) Health care provider shall enter HIV test results in patient's medical record. (3) Notification to Director of DCYF (4) As provided in § 5-37.3, § 40.1-5-26,§§ 23-6.3-10 and 23- 6.3-14 or otherwise permitted bylaw. (5) By health care provider to appropriate persons entitled to be informed about infectious/communicable diseases RIGL § 23-6.3-7

48. Special Confidentiality/Consent Issues Any person of the age of sixteen (16) or over or married may consent to routine emergency medical or surgical care. A minor parent may consent to treatment of his or her child. • R.I.G.L. § 23-4.6-1.  Consent to medical and surgical care

49. Special Confidentiality/Consent Issues Abortion • Unless minor is emancipated, generally need consent of both minor and one parent to perform abortion unless judicial proceeding invoked by minor • R.I.G.L. § 23-4.7-6.  Minors - Parental consent - Judicial proceedings • Emancipation means that minor is free from the custody and control of minor’s parents and the state before minor’s eighteenth birthday. There is no emancipation statute in Rhode Island, however, a Family Court judge may declare in a court order that minor is capable (mature enough) of emancipated status

50. Special Confidentiality/Consent Issues Contraception No Rhode Island statute on point Per Rhode Island Office of the Child Advocate, minor’s right to privacy outweighs parent’s right to consent to contraceptives AAP and AMA advocates encouraging minor to involve parents