Slide 1 WHO CONTROLS THE RECORD? ETHICS AND HIPAA 22 nd Oklahoma Child Abuse & Neglect Conference Norman, Oklahoma, on September 4, 2014 Dr. Arlene B. Schaefer, Ph.D. Forensic and Clinical Psychology Oklahoma City, Oklahoma dr.abschaefer@gmail.com (405 ) 525-7774 Slide 2 Slide 3 The Four As of Ethical Practice Attire: keep it on at all times when providing services Alcohol and other drugs: use in moderation, and never prior to or during the provision of professional services Associate: join your professional association(s), go to meetings, and consult with others Attorneys: know who their client is; don t do what they ask if it is not you
Slide 4 Monahan, J. (Ed.) (1980). Who is the client? The ethics of psychological intervention in the criminal justice system. Washington, DC: American Psychological Association. To whom is the service provider s loyalty owed, the individual or the institution? Slide 5 Is the individual consumer of services entitled to confidentiality? With whom is information shared? Slide 6 Fisher, M.A. (2009). Replacing Who is the client? with a different ethical question. Professional Psychology: Research and Practice, 40, 1-7. Which individuals and/or agencies have a legitimate interest in the services, and what are the ethical obligations to each?
Slide 7 Importance of informed consent in defining professional s duties to each party Importance of determining who has authority to access/amend/disclose PHI Slide 8 Case #1: A child is referred to you by his married parents, who heard of you through a former patient of yours. You provide treatment for the 7- year-old child, and have regular consultation sessions with the parents conjointly. Slide 9 Case #2: DHS asks you to do a mental health evaluation of the mother of an infant she severely abused, and whose parental rights are being considered for termination.
Slide 10 Case #3: A mental health professional is appointed as the court s expert to do an evaluation of the parents and children in a custody case. The children have a GAL, who recommended that the evaluation be conducted, and by that specific mental health professional. Slide 11 Case #3 (cont d): The maternal grandparents are paying for the services. Because of the contentious nature of the case, the mental health professional will most certainly be called upon to testify. Slide 12 ETHICAL PRINCIPLES Which ethical principles seem to be most relevant when deciding to whom you owe duties in situations involving multiple parties?
Slide 13 PRIVILEGE & CONFIDENTIALITY Privilege Privilege is the legal right of the patient or client to keep certain types of protected communications private The provider may assert privilege, but only on behalf of the client; privilege belongs to the client Slide 14 PRIVILEGE & CONFIDENTIALITY Jaffee v. Redmond, 116 S. Ct. 1923 (1996) In 1996, the U.S. Supreme Court held that communications between a patient and a clinical social worker were protected from discovery in a legal action by the psychotherapistpatient privilege Slide 15 PRIVILEGE & CONFIDENTIALITY Confidentiality Confidentiality is the ethical (and legal) commitment of the profession to maintain the privacy of the client or patient identity, and information disclosed during the provision of mental health and substance abuse services Title 43 O.S. 1-109: Important OK statute
Slide 16 PRIVILEGE & CONFIDENTIALITY Establishes privacy of mental health and substance use treatment information Establishes who may have access, and the concept of minimally necessary information to accomplish purpose of access Covers exceptions to patient access Slide 17 PRIVILEGE & CONFIDENTIALITY Describes the elements needed for a written authorization to be valid Consistent with HIPAA Refer also to Oklahoma State Department of Health authorization form (www.ok.gov/health/ click on Forms, Regulations, Licensing, then on Oklahoma Standard Authorization Form under HIPAA Rules & Forms, then on Authorization Form Slide 18 HIPAA Health Insurance Portability and Accountability Act of 1996: HIPAA Title I: Establishes regulations regarding health insurance, such as protecting workers from losing insurance when they change jobs or having permanent exclusions for preexisting conditions
Slide 19 HIPAA Title II: Establishes policies, procedures and guidelines for maintaining the privacy and security of individually identifiable health information Outlines offenses related to health care and establishes criminal and civil penalties for violations Slide 20 HIPAA HIPAA Privacy Rule Establishes greater privacy protections and patient access to health information Establishes regulations regarding the use and disclosure of Protected Health Information (PHI) Establishes the requirement of minimum necessary information in disclosure Slide 21 HIPAA HIPAA Security Rule Regulations specific to Electronic Protected Health Information (ephi)
Slide 22 HIPAA When HIPAA and state law are in conflict, the one that prevails is the one that grants greater privacy protections or more patient access to records Exception: State law always takes precedence over HIPAA where minors and their personal representatives are concerned Slide 23 Currently, one of the most frequent complaints by consumers to OCR is the failure to be given access to their health records when appropriate HHS attributes this problem to providers who are uncertain about privacy issues, and refuse access that is legally required Cignet Health was fined $4.3 million for refusing patients access to their records Slide 24 Under HIPAA, the HITECH Act, the Omnibus Final Rule, and Oklahoma law (Title 43A, Section 1-109), there are a limited number of reasons to deny a patient access to his or her mental health or substance use records: 1. Psychotherapy notes are not available to patients, but they can be authorized by the patient for disclosure to someone else 2. Information gathered for use in legal proceedings
Slide 25 3. If information was given by someone other than a health care provider under a promise of confidentiality and access would be likely to reveal the source of the information and there may be substantial harm to that person 4. A licensed health care professional has determined that access is reasonably likely to endanger the life or physical safety of the individual or another person Slide 26 If you deny access due to #3 or #4, or because of possible harm if a personal representative is granted access, the patient is entitled to have your denial reviewed by a similarly licensed professional You may select the reviewer The opinion of the reviewer will be binding Slide 27 5. Access may be denied if the information is otherwise privileged or prohibited from disclosure by law For example, if the information is sealed by the Court to protect the privacy of an individual HIPAA exempts trade secrets from access and disclosure
Slide 28 If there are no reasons to deny access, the patient is entitled to the entire designated record set For example, if you received documents from another professional and they are in the patient s chart, those documents must also be provided (unless the redisclosure involves alcohol or drug records) Slide 29 If the patient has agreed in advance, you may provide a summary of the information in the records, and you may charge a reasonable fee for the cost of preparing it You may charge a reasonable fee for copies of the records, if it is agreed to in advance You have 30 days to provide a copy, or 60 days if the records are stored off-site Slide 30 When a client completes a HIPAAcompliant authorization for the disclosure of their records, the provider does not have the right to refuse, nor to decide what part of the record will be disclosed A provider does not have the right to state that it is not his/her policy to do so to refuse is a violation of the HIPAA Privacy Rule
Slide 31 If you believe it is not in the patient s best interests to have his/her records disclosed, you should meet with the individual and discuss the issue; ultimately, it is the patient s decision, not the provider s When in doubt, obtain consultation from a mental health professional or a lawyer Slide 32 If the primary client is an agency, then the contractual relationship with the agency will specify whether the person being seen for mental health or substance use services may have access to the records from the provider Slide 33 When multiple adult clients are seen for group or conjoint counseling services, who may have access and who may authorize the disclosure of records? Does the payor make a difference in determining who has access and the right to authorize disclosure?
Slide 34 MINORS RECORDS Do parents, as the personal representatives of their children, have the right to access their children s records? HIPAA defines a personal representative as a person who has been designated by a consumer or by law as authorized to make health care decisions on behalf of the consumer Slide 35 MINORS RECORDS Three situations in which parent is not treated as personal representative under HIPAA: 1. When State law does not require parental consent for services and the minor consents instead of the parent Title 63 Section 2602: Oklahoma law giving minors right of self-consent under certain conditions Slide 36 MINORS RECORDS 2. When the court has given authority to someone other than the parent to make health care decisions about the minor (e.g., the court itself, the minor, a guardian) 3. If the parent agrees to a confidential relationship between the minor and the health care provider (binding so far the states will decide in litigation)
Slide 37 MINORS RECORDS If the parent is not the personal representative for one of those 3 reasons, and State law is silent on the topic, then a licensed professional may use professional judgment re: access A provider may elect not to treat a parent as a personal representative if the parent has or may expose the child to domestic violence, abuse, or neglect, or it is otherwise not in the child s best interests Slide 38 MINORS RECORDS These issues regarding the privacy of minors health care represent the only instance in which HIPAA defers to State law In every other situation, if there is conflict between State law and HIPAA, the one that prevails is the one granting greater privacy of PHI or ephi, or more liberal patient access to their PHI or ephi Slide 39 MINORS RECORDS Oklahoma is one of a few States having a statute governing parental access to a minor s records Title 43 Section 109.6: Gives the noncustodial parent access to the same information as the custodial parent, but that access is not absolute; access can be restricted by the court if not in the best interests of the child
Slide 40 MINORS RECORDS In Iowa, the Supreme Court ruled that a joint legal custodian did not have an absolute right to her children s mental health records She had a history of abusing the children The children and the treating social worker were opposed It would create harm to the therapy It would not be in the children s best interests Slide 41