1

Confidentiality in Your TEAP Program

By Diane A. Tennies, Ph.D., LADCLead TEAP Health Specialist

October 20, 2011

2

Learning Objectives Name the two regulations which protect TEAP-related

information for Job Corps students. Explain when disclosures are permissible and the

limited exemptions contained within the regulations. Define ways to convey necessary information to

involved staff without violating the privacy regulations.

Define which staff on a Job Corps center 'need to know' drug and alcohol-related personal health information.

3

Why can’t it just be this simple?

4

Overview Today will be BASIC – plan is to offer a PART TWO as well There are ‘take home messages’:

Know your state/local laws Make process transparent Include the student in the process Have a thoughtful process (SOP/COP) “Because it violates HIPAA” – is not a thoughtful response Document

Two-fold mission Comply with rules (aka: protect your license) Educate staff

5

Question What are specific ways you ensure

confidentially of TEAP information?

6

Relevant History Early 1970’s Congress believed stigma associated

with substance abuse would deter people from seeking treatment

Resulted in 42 CFR Part 2 Guaranteed strict confidentiality of information for

those receiving Alcohol and Drug Prevention and Treatment Services

Intent: Equalize playing field Insure alcohol and drug (A & D) abuse patients were

NOT made more vulnerable because of the existence of treatment records than individuals who had A & D problems but had not sought treatment

7

42 CRF Part 2 Replaced a Much More Informal System of Confidentiality

8

And then in 1996 came….

9

Standards for Privacy of Individually Identifiable Health Information Final Rule 2000

Substance abuse programs that are subject to HIPAA must comply with the privacy rule as well. Job Corps is such a program.

(See 42 CFR 2.11 Program definition: An individual or entity (other than a general medical care facility) who holds itself out as providing and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment).

The general rules established by Part 2 and the Privacy Rule regarding uses and disclosures of patient health information are very different. Substance abuse treatment programs must comply with both rules.

10

11

42 CFR Part 2 Anyone really read it? What in the 26 pages is relevant to Job

Corps? Any information “which could

reasonably be used to identify an individual and requires discloser be limited to the information necessary to carry out the purpose of the disclosure”

12

13

What are allowable disclosures based on 42 CFR Part 2?

Written authorization/consent (minors need to sign as well as guardian) *know state law

Internal communications** Communication without patient identifying

information (TB patient in hospital) Medical emergency

Only to medical personnel and limited to necessary to address emergency

MUST account for disclosure (to whom; affiliation; by whom; time/date; nature of emergency

14

What are allowable disclosures based on 42 CFR Part 2? (continued)

Crime on program premises/against staff To law enforcement, limited to

circumstances/incident; patient status; name/address/last known whereabouts

Research Audit and evaluation Child abuse reporting

Comply with state laws Part 2 ONLY allows for initial call but no follow

up without consent or court order

15

What are allowable disclosures based on 42 CFR Part 2? (continued)

Properly issued court order May release information with attorney or

law enforcement subpoena ONLY with consent

If no consent = no release without court order

Qualified Service Organization/Business Associates (QSOA) agreement If sign QSOA about storing data properly,

etc.

16

42 CFR Part 2 Factoids Applies even if person seeking information

has it or can obtain through another source Applies to law enforcement/attorney issued

subpoenas Disclosing presence of patient at facility

identified as place where drug and alcohol services provided requires release

Memories/impressions of program staff are considered protected ‘records’ even if not recorded

17

What We Are Not Discussing Today Right to access/deny access to PHI Amending/denial of amending Redisclosure (HIPAA silent/42 CFR requires

statement prohibiting redisclosure) Accounting of disclosures of PHI (6 years

worth; applies to court orders/child abuse reporting/crimes/research/health oversight. Must include: date of disclosure; to whom; by whom; why; what).

18

There Are Implications of HIPAA/42 CFR Violations

19

Internal Program Communication Limited to: Need for information in

connection with their duties that arise out of the provision of diagnosis, treatment or referral for treatment (42 CFR 2.12 c 3)

May be acceptable as long as: Within program Between program and entity with direct

administrative control over program

20

However…. HIPAA requires you establish written

policies to comply with minimum necessary requirement of Privacy Rule

42 CFR 2.16 requires written procedures to regulate access to records

SO… Have written policies about when, how

and what is disclosed to others, both within and outside of Job Corps

21

So which staff ‘need to know’? Excellent question May be culture on center which dates back

to earlier ‘versions’ of TEAP. Do they need to be revisited?

What is your center’s culture about confidentiality? For instance: Used to be Center Director was

given nanogram level to make decision about whether an additional 15 days would be allowed to test for a third time

22

Need to Know Basic considerations:

What is our mission? (Employability) What is the expected outcome of having

this information? How does having this information meet

goal/help student?

What does staff need to know to work with the student?

23

Getting Creative Identify information from Health and Wellness Center and not

from TEAP Make statements such as “Student in jeopardy of not fulfilling

45-day obligation” 45-day projection status Under what circumstances would you share the actual ng. level

of drug screen? Under what circumstances would you share what drug the

student tested positive for? Have authorization signed by student who has failed 2nd screen

notifying them that results are made available to others (CSIO, RO)

24

25

Your Suggestions:

26

Learning Objectives-Revisited Name the two regulations which protect TEAP-related information for

Job Corps students. 42 CFR Part 2 and HIPAA

Explain when disclosures are permissible and what are the limited exemptions contained within the regulations. Best practice: Talk with student and get authorization Have COP/SOP and educate staff/students

Define ways to convey necessary information to involved staff without violating the privacy regulations. Get creative – why staff need information/what is the culture

Define which staff on a Job Corps center have a 'need to know‘ drug and alcohol-related personal health information. Have SOP/COP for guidance

27

Questions

28

References 42 CFR Part 2:

http://www.samhsa.gov/healthPrivacy/

HIPAA: http://www.hhs.gov/policies/index.html

http://www.nj.gov/humanservices/das/information/SAMHSA-Pt2-HIPAA.pdf