How to Litigate an HIV Confidentiality Case in New York February 24, 2016

1. How to Litigate an HIV Confidentiality Case in New York February 24, 2016

2. Who is your trainer? Sally Friedman, Esq. Legal Director Legal Action Center

3. Technical Difficulties? Please email Vanessa Severino at vaseverino@lac.org or send her a private chat through the webinar platform.

4. Who is the Legal Action Center? • Non-profit law & policy organization • Anti-discrimination & privacy work • Substance Use Disorders • HIV/AIDS • Criminal Records • Legal services, litigation, policy, technical assistance

5. How to get help? • Great resources on LAC’s website! • www.lac.org • Free publications, webinars, and more • Call with questions about privacy or discrimination – HIV/AIDS, substance use disorders, and/or criminal records. Ask for paralegal or attorney-on-call • (212) 243-1313 • NY individuals and providers/attorneys

6. Help from Legal Action Center • We provide free legal services, including: • Assistance with HIV testing & confidentiality • Assistance with claims of discrimination based on: • HIV status • History of substance use disorder • Criminal record: • Rap sheet review & error correction • Certificates of Relief & Good Conduct • Job & housing discrimination

7. Get Credit for your Attendance! HAVE YOU REGISTERED? • If you haven’t officially registered with the NYS Department of Health AIDS Institute, please do it now: http://www.hivtrainingny.org/ • If you need assistance, contact Vanessa Severino at vaseverino@lac.org

8. Who is this training for? • NY attorneys & advocates representing PLWHAs – including pro bono lawyers (out of state attorneys might find part 3 useful). • Attorneys at health care facilities and other entities required to maintain confidentiality. • Not a basic HIV confidentiality law overview. For that, take free webinar, “HIV/AIDS Confidentiality Law Overview,” available at http://www.hivtrainingny.org/

9. Training objectives By the end of this training, you will be able to: • Counsel clients (potential Plaintiffs) about pros/cons of HIV confidentiality litigation. • As defense counsel, identify common confidentiality concerns of patients/clients. • Identify administrative remedies and litigation strategies for HIV privacy breaches. • State where to access sample forms and further help.

10. Hand-outs • Sample demand letter • Sample Complaint – State court • Sample motion to proceed under pseudonym • Visit www.lac.org (“resources/HIV”) for • HIV/AIDS: Testing, Confidentiality & Discrimination: What You Need to Know About New York Law • Call LAC for more forms (discovery, etc.)

11. Today’s topics Part 1: Substantive HIV confidentiality protections – quick review Part 2: Administrative remedies Part 3: Litigating an HIV confidentiality case

12. Who is in the audience? Poll: Are you: • Attorney • Paralegal • Privacy Officer for Health Care Facility • Other

13. Who is in the audience? Poll: Do you – • Advocate for people with privacy breach claims? • Defend entities accused of privacy breaches? • Both • Neither

14. Part 1 Substantive HIV confidentiality Protections

15. Rationale for HIV confidentiality law Pervasive HIV Stigma (even today!) leads to: • Discrimination • Fear of getting HIV tested • Fear of getting HIV medical care

16. Rationale for HIV confidentiality law HIV privacy = critical element in: NY Campaign to End AIDS by 2020

17. Applicable laws • Art. 27-F, NYS Public Health Law • Secs. 2780 et. seq. (today’s focus) • HIPAA • Fiduciary duty of confidentiality • Constitutional right to privacy • Privacy Act (federal) • Americans with Disabilities Act (employment)

18. Article 27-F Who Must Comply? ANY person who receives HIV-related information about a protected individual: • while providing a “health or social service” OR • pursuant to a proper written consent NY governmental agencies that: • provide, supervise or monitor health or social services OR • obtain HIV related info per Article 27-F

19. Art. 27-F Does NOT apply to: • Protected individuals themselves • Friends, relatives • Courts • Insurers • Federal agencies (military, federal prisons) • Schools (except medical staff) • Employers • Pharmacies But other laws may apply….

20. Constitutional right to privacy • Protects against disclosure of certain intimate information – including HIV information. • Doe v. City of NY, 15 F.3d 264 (2d Cir. 1994) • Applies to gov’t employees, officials, & agents acting under color of local, state, or federal law • Generally must prove “failure to train” per Monell; one bad actor not enough. Do FOIL request.

21. Other HIV confidentiality protections • Privacy Act: Prohibits some federal agencies from disclosing private information. • Fiduciary duty of confidentiality (NY common law): requires fiduciary to maintain confidentiality of HIV (and other) information. • Covers health care providers, pharmacists & others. Important for pharmacy claims (not covered by Art. 27-F). • Professional licensing rules (e.g., pharmacies) • ADA, Title I – employment

22. Art. 27-F What information is protected? • “Confidential HIV related information”: • Had an HIV-related test • HIV test results, even if negative • HIV infection, HIV related illness or AIDS • Any information “which identifies or reasonably could identify an individual as having such conditions, including…contacts.” (e.g., HIV meds) • NY Pub. Health Law 2780.

23. Compare with HIPAA • Federal law -- minimum safeguards to protect “personal health information.” • Applies to health care providers, health plans, & health care clearinghouses who transmit health information electronically in connection with certain covered transactions – generally billing and eligibility.

24. HIPAA & Art 27-F interplay • HIPAA pre-empts “contrary” state law provisions except when, among other things: • The state law is “more stringent” than HIPAA. • “More stringent” includes providing greater privacy protections. • Art. 27-F is usually “more stringent” than HIPAA.

25. Art. 27-F & HIPPA:General Non-Disclosure Rule • HIPAA: A covered entity may not “use or disclose”protected health information which is created or received by a covered entity AND relates to the past, present or future physical or mental health of an individual. • Article 27-F: Health & social service providers AND people who receive HIV related info pursuant to written release may not disclose (or redisclose) any HIV related information about a protected individual. (§ 2782)

26. Art. 27-F – Protected Persons • Person who has HIV • Person who has had an HIV test • Contacts (spouse, sexual partner or needle-sharing partner)

27. “Exceptions” permitting disclosure • HIPAA & Art. 27-F have “exceptions” allowing disclosure of HIV-related information. • This training reviews only five Art. 27-F exceptions (& related HIPAA exceptions): • Written release • Internal communications • Health care • Case reporting & partner notification • Court order

28. Written release • Written – never oral. • Contain elements per HIPAA & Art. 27-F. • Form must be approved by DOH. Can use these: • http://www.health.ny.gov/forms/doh-2557.pdf (HIV only) • http://www.health.ny.gov/forms/doh-5032.pdf (HIV, mental health, substance use). • Will be necessary during litigation.

29. Art. 27-FNo Redisclosure • Person receiving information per consent may not redisclose(no such protection in HIPAA) • Notice prohibiting redisclosure required for every disclosure of HIV information except to: • Protected individual • Health care providers (more later) • Third party reimbursers of health care • Contact/partner notification (more later) • Parents/guardians of minors (by doctors) • You must do this during litigation! Cont….

30. Art. 27-FNo Redisclosure

31. Written release Case study • Sandy is in hospital. Mom is visiting. Sandy has never told her mom that she has HIV. Doesn’t want mom to know. • Nurse enters hospital room, with mom present, and asks Sandy about her “HIV medication.” Mom is shocked. • Sandy did not sign an HIV-specific release for hospital to disclose HIV status to Mom but listed mom as “emergency contact.” • Did nurse violate Art. 27-F?

32. Written release Case study • Yes • No • Need more information.

33. Written release Case study answer • Yes • No disclosures to friends/family permitted under Art. 27-F without HIV-specific release. • True even for emergency contacts and people accompanying patient to doctor or visiting. • Different from HIPAA, which permits incidental disclosures – unless Sandy restricted “restriction on disclosure.”

34. Art. 27-FInternal communications Agency staff may share HIV related information IF the staff members: • Are allowed access to client records in ordinary course of business; • Are specifically authorized in the agency’s written “need-to-know” protocol; OR • Have a reasonable need to know or share the information to carry out their authorized duties.

35. HIPAAMinimum Necessary Standard • Identify & document • members of the workforce who need access, • categories of information to which they need access, and • any conditions to their access.

36. Art. 27-F & HIPAA Internal Communications • Relevant in cases involving electronic health records systems in health care facilities. • Unauthorized access within the facility? What were facility’s protocols?

37. To Health Care Providers Art. 27-F: May disclose HIV related information to a health care provider when necessary to provide care to the individual, his/her child, or contact. Document the disclosure. No prohibition on redisclosure. HIPAA: May disclose personal health information for “treatment.”

38. To Health Care Providers Art. 27-F exception only applies if the disclosure is for the purpose of providing health care to the protected person (or his/her child or contact) – and not for purposes such as: • Workers compensation, • Infection control

39. Case Reporting & Partner Notification • Confidentiality breaches sometimes occur because a health or social service provider wants to “warn” a friend or family member about the HIV status of a client/patient in the same social circle. • NYS has formal process for “partner notification,” consistent with public health goals.

40. Case Reporting & Partner Notification • HIV/AIDS case reporting: • Physicians and others who diagnose HIV, HIV-related illness and AIDS report to State DOH. • State DOH rediscloses contact info to local DOH for partner notification. NY Pub. Health Law 2130

41. Case Reporting & Partner Notification 2. Physician notification. Physicians may notify contact if significant risk of infection, counsels about need to notify, does domestic violence screen, & informs patient that – • Intends to notify & must tell DOH, • Can choose to have DOH notify, & • Source person’s name won’t be revealed.

42. Case Reporting & Partner Notification • ONLYphysicians and special Dept. of Health staff are permitted to notify named partners of HIV infected individual. • NO ONE ELSE is permitted to do partner notification.

43. Court Orders & Subpoenas Case study • Hospital receives court-ordered subpoena for patient’s records. HIV information in record. • Releases full record without checking to see if patient signed HIV-specific release. • Patient did not sign HIV-specific release. Violated Art. 27-F?

44. Court Orders & Subpoenas Case study • Yes. • No. • Need more information.

45. Court Orders & Subpoenas Case study answer: 3. Need more information – but probably • No “exception” for subpoena – even if ordered by a court (see next slide). • Unless the court order satisfied stringent requirements of Art. 27-F (Sec. 2785), or some other exception, the disclosure violated Art. 27-F.

46. Court Orders & Subpoenas Subpoenas do NOT authorize disclosure of HIV-related information under Art. 27-F – even if “so ordered” by court. • Need client’s written release to disclose HIV-related information pursuant to subpoena. • If no release, may redact HIV information from records if possible HIPAA – less stringent, so Art. 27-F applies.

47. Art. 27-FCourt Orders Court may order disclosure IF: • Compelling need for adjudication of lawsuit, or • Clear and imminent danger to life or health of persons unknowingly at significant risk, or • Applicant is lawfully entitled and disclosure is consistent with Art. 27-F. NY Pub. Health Law § 2785. Extra procedural requirements too – including notice (to P and record holder) of opportunity to be heard. Case study didn’t mention notice. More stringent standard than HIPAA court order.

48. Additional HIPAA requirements Notice & Complaint Procedure Covered entity must: • Provide Notice of Privacy Practices, upon request, and post on website (45 C.F.R. §§ 164.520(b), (c); • Have written complaint procedures. (164.530(d), (i)). • Failure to do either can be additional HIPAA violation.

49. Questions?

50. Part 2 Administrative Remedies