Accessible text version

2023 Summit Compliance is Do able HIPAA 42 CFR

This page is the plain-text version of a 34-page PDF, provided for screen readers and easier reading. Open the original PDF.

8.1 2nd ANNUAL OHIO QRT, DEFLECTION, &

OUTREACH TRAINING SUMMIT

LEARNING OBJECTIVES

 Gain an understanding of HIPAA and Part 2  Apply a framework to identify when legal privacy requirements apply  Discuss privacy implications relevant to your deflection work  Explore best practices for documentation that  Protects privacy  Maintains compliance  Supports effectiveness copyright 2022 Silta Strategy LLC 8.3 A little bit about Silta Strategy copyright 2022 Silta Strategy LLC

Consulting, training, technical assistance, legal advice
Policy, law, best practices
Alternatives to arrest, conviction, and punishment
Development, implementation, impact
Risk management, compliance, quality assurance
Privacy 8.4 Deflection Source: Police Treatment and Community Collaborative. (2017). Pre-arrest diversion: Pathways to Community[Brochure]. Author. Retrieved from http://www2.centerforhealthandjustice.org/sites/www2.centerforhealthandjustice.org/files/publications/PTAC- Pathways-Visual.pdf. 8.5

HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996.

Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions. Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.

42 USC §290dd–2. Confidentiality of records (initial effective date July 1, 1944, with SUD protections first added in 1970)

42 CFR Part 2 – The Secretary of HHS shall prescribe regulations to carry out the purposes of this section; SAMHSA Together, known as “Part 2.”

Imposes restrictions upon the disclosure and use of substance use disorder patient records which are maintained in connection with the performance of any part 2 program.

Originating Entities ➢ Covered Entity ➢ Part 2 Program copyright 2022 Silta Strategy LLC 8.9 HIPAA – Covered Entities

Covered Entities

(1) A health plan - provide or pay the cost of medical care. Health plans include health, dental, vision, and prescription drug insurers.

(2) A health care clearinghouse - Entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa.

(3) A health care provider (of any size) who transmits any health information in electronic form in connection with a transaction covered by this subchapter. This includes claims, benefit eligibility inquiries, referral authorization requests, and other transactions for which HHS has established standards under the HIPAA Transactions Rule.

Program - An individual or entity (other than a general medical facility) who holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment.

This includes an identified unit within a general medical facility, or staff in a general medical facility whose primary function falls within this definition.

Conducted in whole or in part, directly or by contract or otherwise, by any department or agency of the United States;
Carried out under a license, certification, registration, or other authorization granted by any department or agency of the United States;
Supported by funds in any form provided by any department or agency of the United States, including financial assistance which does not directly pay for the substance use disorder diagnosis, treatment, or referral for treatment;
Conducted by a state or local government unit which receives federal funds that could be (but are not necessarily) spent for the substance use disorder program; or
Assisted by the IRS through the allowance of income tax deductions for contributions to the program or through the granting of tax exempt status to the program. copyright 2022 Silta Strategy LLC 8.12
Am I a Covered Entity or Part 2 Program?

✓ No (the information I collect is not protected)

Often includes law enforcement officers, data analysts,… ✓ Yes
Includes EMS, treatment providers,… ✓ Hmm, this might take some extra thinking
Social workers, case managers, volunteers, peers,… copyright 2022 Silta Strategy LLC 8.13
Protected Information ➢ Protected Health Information ➢ Patient Record copyright 2022 Silta Strategy LLC 8.14

HIPAA PHI

Protected Health Information (PHI) is all individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral.

Individually identifiable health information is information, including demographic data, that relates to:

 the individual’s past, present or future physical or mental health or condition,  the provision of health care to the individual, or  the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.

copyright 2022 Silta Strategy LLC 8.15 Part 2 Patient Record Records that would identify and contain any information about a patient as having or having had a substance use disorder for the purpose of treating, making a diagnosis for that treatment, or making a referral for that treatment.

Any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient (e.g., diagnosis, treatment and referral for treatment information, billing information, emails, voice mails, and texts). Records generated by non-Part 2 providers based on their own patient encounters are generally not covered by Part 2 protections, even to the extent the records include information about a SUD and its treatment.

copyright 2022 Silta Strategy LLC 8.16 Part 2: Patient and Diagnosis Patient means any individual who has applied for or been given diagnosis, treatment, or referral for treatment for a substance use disorder at a part 2 program. Patient includes any individual who, after arrest on a criminal charge, is identified as an individual with a substance use disorder in order to determine that individual's eligibility to participate in a part 2 program.

This definition includes both current and former patients.

Diagnosis means any reference to an individual's substance use disorder or to a condition which is identified as having been caused by that substance use disorder which is made for the purpose of treatment or referral for treatment.

✓ No: HIPAA doesn’t apply ✓ Yes: I must protect this information protected as a Business Associate (or as otherwise stated)

➢ Do I receive Patient Records from a Part 2 Program?

✓ No: Part 2 doesn’t apply ✓ Yes: I must protect this information as a Qualified Service Organization (or as otherwise stated)

✓ No: HIPAA doesn’t apply ✓ Yes: I need to keep this information protected ➢ Do I have Patient Records?

Disclosures ➢ Deidentified ➢ HIPAA and Part 2 ➢ Minimum Necessary ➢ Redisclosures copyright 2022 Silta Strategy LLC 8.20 Deidentified Information

De-identified information

 neither identifies nor provides a reasonable basis to identify an individual,  including aggregated information.

copyright 2022 Silta Strategy LLC 8.21 Categories of Disclosures HIPAA: Prohibited, Required, Permitted Part 2: Confidentiality Requirements, Permitted copyright 2022 Silta Strategy LLC 8.22 HIPAA Permitted Disclosures Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations:

 To the Individual (unless required for access or accounting of disclosures);  Treatment, Payment, and Health Care Operations;

 Opportunity to Agree or Object;

 Incident to an otherwise permitted use and disclosure;

 Public Interest and Benefit Activities (twelve); and  Limited Data Set for the purposes of research, public health or health care operations.

copyright 2022 Silta Strategy LLC 8.23 Part 2: Disclosure Disclose means to communicate any information identifying a patient as being or having been diagnosed with a substance use disorder, having or having had a substance use disorder, or being or having been referred for treatment of a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person.

copyright 2022 Silta Strategy LLC 8.24 Part 2 Restrictions Restricts the disclosure of SUD treatment records without patient consent, other than as statutorily authorized –  bona fide medical emergency (with subsequent notice)

 scientific research, audit, or program evaluation  appropriate court order.

[Continues to prohibit law enforcement’s use of SUD patient records in criminal prosecutions against patients, absent a court order.] copyright 2022 Silta Strategy LLC 8.25 Part 2: Disclosure of Records Generally, when patient records are transmitted by a part 2 program to a non-part 2 program, the combined record becomes subject to part 2.

➢ Non-part 2 providers may now receive oral disclosures from a part 2 provider, with consent of the patient, for treatment purposes and reduce that disclosure to writing without the disclosed information thereby becoming a part 2 record subjected to the rigors of part 2.

➢ To avoid the application of part 2 requirements to non-part 2 provider records, the Final Rule allows the respective records to be “segregated.”

copyright 2022 Silta Strategy LLC 8.26 Minimum Necessary HIPAA: unless otherwise specified, a covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.

Part 2: any disclosure made under the regulations in this part must be limited to that information which is necessary to carry out the purpose of the disclosure. copyright 2022 Silta Strategy LLC 8.27 Part 2 Prohibition on Redisclosures Each disclosure made with the patient's written consent must be accompanied by one of the following written statements:

 This record which has been disclosed to you is protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of this record unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed in this record or, is otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65; or  42 CFR part 2 prohibits unauthorized disclosure of these records.

Do I share PHI and/or Patient Records?

✓ No - HIPAA and/or Part 2 do not apply ✓ Yes, I share PHI as a Covered Entity or Business Associate

HIPAA restrictions apply ✓ Yes, I share Patient Records as a Part 2 Program or Qualified Service Organization
Part 2 restrictions apply copyright 2022 Silta Strategy LLC 8.30 FRAMEWORK – Protected Disclosures copyright 2022 Silta Strategy LLC 8.31 Documentation – Best Practices ❖ Notice of Privacy Practices with Written Acknowledgment ❖ Authorization/Consent to Share Protected Information
Individual; group; redisclosure
Who signs? Esp. with minors and foster care applications ❖ Revocation of Authorization/Consent - also watch for expirations ❖ Information Mapping; Framework Analysis ❖ Business Associate/Qualified Service Organization Agreement/Contract ❖ Data Sharing (or other) Agreement/MOU/Other?

RESOURCES

Compliance Is Doable! A Framework for Navigating Privacy Regulations in Public Health and Public Safety Partnerships

Journal of Public Health Management and Practice

PROPOSED RULE

Implements statutory amendments from section 3221 of the CARES Act

TIMING

❑ Proposed Rule was published December 2, 2022 ❑ Comments are due within 60 days of publication ❑ The proposed Effective Date of a final rule would be 60 days after publication ❑ The proposed Compliance Date would be 22 months after the effective date.

❑ Entities subject to a final rule would have until the compliance date to establish and implement policies and practices to achieve compliance.

QUESTIONS???

Download the original PDF · Ohio Deflection Association home