HIV Privacy in Practice How to Create and Update
MJ
Published · 88 slides · 0 views
1 / 1
Description
HIV Privacy in Practice How to Create and Update Your Agencys Confidentiality Policies and Ensure Staff Compliance Housekeeping Recommended: Have a copy of the Model HIV Confidentiality Policies Procedures handy during the training
Related Topics
Share
Embed code
Download this presentation From Below
"HIV Privacy in Practice How to Create and Update" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
01
HIV Privacy in Practice How to Create and Update Your Agency’s Confidentiality Policies
and Ensure Staff Compliance<br>
and Ensure Staff Compliance<br>
02
Housekeeping Recommended: Have a copy of the Model HIV Confidentiality Policies & Procedures handy during the training
Available here (and see link in chat): MODEL POLICIES & PROCEDURES
Training will point to relevant pages (example: ☛ P.2 of Model Policies & Procedures)<br>
Available here (and see link in chat): MODEL POLICIES & PROCEDURES
Training will point to relevant pages (example: ☛ P.2 of Model Policies & Procedures)<br>
03
Trainers Amber Black
Staff Attorney for Health Privacy Jackie Seitz
Senior Staff Attorney for Health Privacy<br>
Staff Attorney for Health Privacy Jackie Seitz
Senior Staff Attorney for Health Privacy<br>
04
This training is for . . . New York-based agencies providing services to PLWHA
Specifically staff responsible for:
Developing and updating your agency’s HIV confidentiality policies and procedures; or
Educating and training staff about your HIV confidentiality policies.<br>
Specifically staff responsible for:
Developing and updating your agency’s HIV confidentiality policies and procedures; or
Educating and training staff about your HIV confidentiality policies.<br>
05
Training Objectives<br>
06
Introduction and Overview<br>
07
HIV privacy matters Stigma and discrimination persist against people living with HIV
HIV privacy is a racial justice issue and a health equity issue
Persistent racial disparities in new HIV diagnoses and rates of viral suppression:
Non-Hispanic Black people account for 14.4% of NY pop but 45.7% of new HIV diagnoses (2020)
Source: AIDS Institute Call to Action letter 2022<br>
HIV privacy is a racial justice issue and a health equity issue
Persistent racial disparities in new HIV diagnoses and rates of viral suppression:
Non-Hispanic Black people account for 14.4% of NY pop but 45.7% of new HIV diagnoses (2020)
Source: AIDS Institute Call to Action letter 2022<br>
08
Landscape of HIV privacy protections Today’s focus: Article 27-F of the NY Public Health Law, which protects “confidential HIV-related information”
But see also:
Constitutional right of privacy (federal and state)
Federal privacy laws (HIPAA, Privacy Act, more)
State privacy laws (Public Health Law § 18, more)
And privacy laws for SUD treatment, mental health treatment, more
Many professions also have an ethical duty to maintain confidentiality (social workers, nurses, doctors, counselors)<br>
But see also:
Constitutional right of privacy (federal and state)
Federal privacy laws (HIPAA, Privacy Act, more)
State privacy laws (Public Health Law § 18, more)
And privacy laws for SUD treatment, mental health treatment, more
Many professions also have an ethical duty to maintain confidentiality (social workers, nurses, doctors, counselors)<br>
09
But isn’t HIPAA everything? No. HIPAA is a federal health privacy law but does not preempt “more stringent” state laws.
Covered agencies must follow whichever applicable standard is most protective of patient privacy.
Key point: HIPAA compliance is not sufficient to meet Article 27-F’s privacy requirements for HIV-related information.<br>
Covered agencies must follow whichever applicable standard is most protective of patient privacy.
Key point: HIPAA compliance is not sufficient to meet Article 27-F’s privacy requirements for HIV-related information.<br>
10
HIPAA vs. Art. 27-F Case study<br>
11
Case study Amaya is admitted to the hospital for gallbladder removal. After surgery, her partner comes to visit and brings Amaya a light lunch.
The surgeon enters the room and greets both Amaya and her partner. He says, “The surgery went well, but we have some concerns because of your HIV medications.”
The clinic is covered by both HIPAA and Article 27-F.
Can the doctor discuss Amaya’s HIV status in her partner’s presence without Amaya’s written consent? HIPAA vs. Art. 27-F<br>
The surgeon enters the room and greets both Amaya and her partner. He says, “The surgery went well, but we have some concerns because of your HIV medications.”
The clinic is covered by both HIPAA and Article 27-F.
Can the doctor discuss Amaya’s HIV status in her partner’s presence without Amaya’s written consent? HIPAA vs. Art. 27-F<br>
12
Case study No: the doctor must obtain Amaya’s written consent before communicating any information that could reasonably disclose HIV-related information to her partner.
The Article 27-F requirement applies because it is more protective of patient privacy, i.e., “more stringent,” than HIPAA. HIPAA vs. Art. 27-F<br>
The Article 27-F requirement applies because it is more protective of patient privacy, i.e., “more stringent,” than HIPAA. HIPAA vs. Art. 27-F<br>
13
Brief refresher: Article 27-F State law protecting privacy of “HIV-related information”
Also covers HIV testing
Provides heightened confidentiality protections for information about an individual’s HIV testing, status, and treatment
Applies to health and social service providers, plus agencies that receive funding from AIDS Institute<br>
Also covers HIV testing
Provides heightened confidentiality protections for information about an individual’s HIV testing, status, and treatment
Applies to health and social service providers, plus agencies that receive funding from AIDS Institute<br>
14
Why do you need HIV Confidentiality P&P? Required by state and federal law
For HIPAA covered entities, OCR may investigate and fine agencies for failing to have P&P in place, even if no evidence of actual breach
Helps staff understand and comply with requirements in Article 27-F, plus changes in HIV testing and treatment practices<br>
For HIPAA covered entities, OCR may investigate and fine agencies for failing to have P&P in place, even if no evidence of actual breach
Helps staff understand and comply with requirements in Article 27-F, plus changes in HIV testing and treatment practices<br>
15
HIV privacy matters: in practice Many examples of concrete harm to individuals following breach of HIV confidentiality
Example: records with HIV info faxed to employer instead of doctor
Example: HIV prescription information mailed to individual’s shared residence, with HIV information visible on envelope
Example: HIV info impermissibly shared with individual’s family or friend
Taking confidentiality seriously reflects agency’s commitment to individuals’ rights<br>
Example: records with HIV info faxed to employer instead of doctor
Example: HIV prescription information mailed to individual’s shared residence, with HIV information visible on envelope
Example: HIV info impermissibly shared with individual’s family or friend
Taking confidentiality seriously reflects agency’s commitment to individuals’ rights<br>
16
Recent changes in New York P&P should reflect current law plus agency’s current practices
Two major changes to HIV testing and treatment law several years ago: oral advisement and minors’ rights to consent to HIV care
Ongoing policy changes re: partner notification and coordinated care
COVID-19 related changes and increase in remote work
2019 SHIELD Act (“Stop Hacks and Improve Electronic Data Security Act”), new data breach notification law for companies based in NY<br>
Two major changes to HIV testing and treatment law several years ago: oral advisement and minors’ rights to consent to HIV care
Ongoing policy changes re: partner notification and coordinated care
COVID-19 related changes and increase in remote work
2019 SHIELD Act (“Stop Hacks and Improve Electronic Data Security Act”), new data breach notification law for companies based in NY<br>
17
Case Study Which of the following statements is true:
A. Minors may consent to their own HIV test but need parental consent for HIV prevention (including PrEP) or treatment.
B. Minors who are 13+ may consent to their own HIV prevention or treatment, if they have capacity.
C. Minors may consent to their own HIV prevention or treatment, if they have capacity. HIV Treatment for Minors<br>
A. Minors may consent to their own HIV test but need parental consent for HIV prevention (including PrEP) or treatment.
B. Minors who are 13+ may consent to their own HIV prevention or treatment, if they have capacity.
C. Minors may consent to their own HIV prevention or treatment, if they have capacity. HIV Treatment for Minors<br>
18
Case Study C. Minors may consent to their own HIV prevention care or treatment, so long as they have capacity.
For more information, sign up our Minors’ Health Rights webinar.
Effective date: April 2017. Previously, minors could only consent to HIV testing, but not prevention or treatment. HIV Treatment for Minors<br>
For more information, sign up our Minors’ Health Rights webinar.
Effective date: April 2017. Previously, minors could only consent to HIV testing, but not prevention or treatment. HIV Treatment for Minors<br>
19
Recent federal change: Info Blocking Rule Lots of confusion among healthcare providers about Information Blocking Rule and heightened privacy protections for HIV information in New York<br>
20
Recent federal change: Info Blocking Rule NYS healthcare providers still required by state law to:
Provide post-test counseling for positive HIV test results, PHL § 2781(5)
See Privacy Exception to Information Blocking Rule
Obtain patient consent before sharing HIV info with proxies on patient portal, PHL § 2782
See Infeasibility Exception to Information Blocking Rule<br>
Provide post-test counseling for positive HIV test results, PHL § 2781(5)
See Privacy Exception to Information Blocking Rule
Obtain patient consent before sharing HIV info with proxies on patient portal, PHL § 2782
See Infeasibility Exception to Information Blocking Rule<br>
21
Introduction and overview Summary of key points<br>
22
How to
Create and Update Your Agency’s HIV Privacy Policies & Procedures<br>
Create and Update Your Agency’s HIV Privacy Policies & Procedures<br>
23
Preliminary step: How does Art. 27-F apply? ☛ P.2<br>
24
Required provisions SUGGESTED PROVISIONS: Statement of purpose, confidentiality policy, staff responsible ☛ P. 4<br>
25
#1. Training & Updating Staff Required elements of training policy:
Initial employee orientation on HIV privacy and agency-specific P&P
Online module: “HIV/AIDS Confidentiality Law Overview”
Supplement with agency-specific information
Updates whenever law or regulations change
Annual review by designated staff to determine whether changes to law
Recommended (but not required): annual refresher training
☛ P.5 of Model Policies & Procedures<br>
Initial employee orientation on HIV privacy and agency-specific P&P
Online module: “HIV/AIDS Confidentiality Law Overview”
Supplement with agency-specific information
Updates whenever law or regulations change
Annual review by designated staff to determine whether changes to law
Recommended (but not required): annual refresher training
☛ P.5 of Model Policies & Procedures<br>
26
#1. Training & Updating Staff Implementation Maintain list of all employees who received initial training and updates
Make sure to include volunteers, peers, etc., who have access to HIV-related information
Obtain attestations from all staff, volunteers, peers, etc.
☛ Appendix 4 – Sample Attestation<br>
Make sure to include volunteers, peers, etc., who have access to HIV-related information
Obtain attestations from all staff, volunteers, peers, etc.
☛ Appendix 4 – Sample Attestation<br>
27
#1. Training & Updating Staff What about contractors? Not required to provide training to contractors
Agency must advise contractors of the privacy protections for any HIV information received from your agency
Agency may be liable if contractor breaches Art.27-F – educate them!
Recommended: highlight requirement verbally, provide contractor with written materials, and include Art. 27-F compliance in the contract/MOU
P&P should describe process for advising contractors and specify how advisal will be documented. ☛ P. 6<br>
Agency must advise contractors of the privacy protections for any HIV information received from your agency
Agency may be liable if contractor breaches Art.27-F – educate them!
Recommended: highlight requirement verbally, provide contractor with written materials, and include Art. 27-F compliance in the contract/MOU
P&P should describe process for advising contractors and specify how advisal will be documented. ☛ P. 6<br>
28
#1. Training & Updating Staff What about clients? Recommended (but not required):
P&P may also describe how your agency will educate clients about the HIV confidentiality policy, including how information will be shared and for what purposes.
Ex. “During the intake process, staff will verbally inform clients of our HIV confidentiality policy, explain how information will be shared and protected, and offer each client a written summary of the confidentiality policy.”
☛ P. 6<br>
P&P may also describe how your agency will educate clients about the HIV confidentiality policy, including how information will be shared and for what purposes.
Ex. “During the intake process, staff will verbally inform clients of our HIV confidentiality policy, explain how information will be shared and protected, and offer each client a written summary of the confidentiality policy.”
☛ P. 6<br>
29
Required provisions<br>
30
Art. 27-F Refresher: Internal Communications Agency staff may share a client’s confidential HIV-related information with other agency staff if:
Recipient allowed access to records in ordinary course of business
Recipient reasonably needs access to perform designated job duties
Recipient authorized by Agency’s “need-to-know” protocol
PHL §§ 2782(1)(c); 2782(6)(b).<br>
Recipient allowed access to records in ordinary course of business
Recipient reasonably needs access to perform designated job duties
Recipient authorized by Agency’s “need-to-know” protocol
PHL §§ 2782(1)(c); 2782(6)(b).<br>
31
#2. Internal Communications Protocol “Need-to-know” protocol should limit internal communications to employees who:
Reasonably need access to perform designated job duties;
Have received HIV confidentiality training; and
Appear on the “Need-to-Know” list (see next slide)
“Need-to-know” list should identify employees by job title or position
Include non-employees if appropriate (e.g., volunteers, peers, interns)
*Practice tip: distribute the “need-to-know” list to all employees during initial training and updates
☛ P.7 and Appendix 5<br>
Reasonably need access to perform designated job duties;
Have received HIV confidentiality training; and
Appear on the “Need-to-Know” list (see next slide)
“Need-to-know” list should identify employees by job title or position
Include non-employees if appropriate (e.g., volunteers, peers, interns)
*Practice tip: distribute the “need-to-know” list to all employees during initial training and updates
☛ P.7 and Appendix 5<br>
32
Need-to-Know List examples
Case Managers (including Housing Case Managers, Outreach Case Managers, and SSI/SSDI Case Managers) with direct or supervisory responsibilities for client work and need to access confidential HIV-related information.
Administrative Assistants and Director of Administration with responsibilities associated with client work, including data entry and client communication responsibilities.
President, Vice President, and Director of Operations when administrative or supervisory duties require knowing clients’ confidential HIV-related information. #2. Internal Communications Protocol<br>
Case Managers (including Housing Case Managers, Outreach Case Managers, and SSI/SSDI Case Managers) with direct or supervisory responsibilities for client work and need to access confidential HIV-related information.
Administrative Assistants and Director of Administration with responsibilities associated with client work, including data entry and client communication responsibilities.
President, Vice President, and Director of Operations when administrative or supervisory duties require knowing clients’ confidential HIV-related information. #2. Internal Communications Protocol<br>
33
Required provisions<br>
34
#3. Security Protocols Three basic elements of security:
Securely maintained
Used only for the purpose intended
Securely communicated
Regulations only refer to protocols to make sure information is “maintained securely and used for the purpose intended,” but this will implicate security of transmitted information
☛ P.7<br>
Securely maintained
Used only for the purpose intended
Securely communicated
Regulations only refer to protocols to make sure information is “maintained securely and used for the purpose intended,” but this will implicate security of transmitted information
☛ P.7<br>
35
#3. Security Protocols P&P should specify:
Where to store written and electronic records
Who has access
Practical measures to avoid unauthorized access
EHR pop-ups to verify authority
Periodic audits to flag suspicious or unauthorized access
Confidential information can be “flagged” or segmented within chart
☛ P.8
This is an area where HIPAA has very specific requirements and may be more stringent; make sure policies comply with Security Rule if you are a covered entity.<br>
Where to store written and electronic records
Who has access
Practical measures to avoid unauthorized access
EHR pop-ups to verify authority
Periodic audits to flag suspicious or unauthorized access
Confidential information can be “flagged” or segmented within chart
☛ P.8
This is an area where HIPAA has very specific requirements and may be more stringent; make sure policies comply with Security Rule if you are a covered entity.<br>
36
#3. Security Protocols Remote access protocols Make sure your remote access protocols are up-to-date and reflect your agency’s current practices related to COVID-19
P&P should address security requirements for equipment and connections
Once protocols are updated, make sure staff are trained to follow them!
☛ P. 10<br>
P&P should address security requirements for equipment and connections
Once protocols are updated, make sure staff are trained to follow them!
☛ P. 10<br>
37
#3. Security Protocols “Low tech” security P&P should also address:
Conversations about clients, ☛ P.8
Conversations with clients in front of friends and family, ☛ P.13
Contacting clients at home, ☛ P.9
Mailing confidential HIV-related information, ☛ P.9
Working from home with family / roommates, ☛ P.10
*Practice tip: take these very seriously! In LAC’s experience, these types of privacy breaches are very common, frequently misunderstood by providers, and can cause serious harm to individuals.<br>
Conversations about clients, ☛ P.8
Conversations with clients in front of friends and family, ☛ P.13
Contacting clients at home, ☛ P.9
Mailing confidential HIV-related information, ☛ P.9
Working from home with family / roommates, ☛ P.10
*Practice tip: take these very seriously! In LAC’s experience, these types of privacy breaches are very common, frequently misunderstood by providers, and can cause serious harm to individuals.<br>
38
#3. Security Protocols<br>
39
Case study Rhoda is a social worker at Local Help Center, which serves clients living with HIV.
Rhoda calls her client, Lu, on their cell phone, but it goes straight to voicemail.
How can Rhoda leave a message without violating Art. 27-F? Contacting clients<br>
Rhoda calls her client, Lu, on their cell phone, but it goes straight to voicemail.
How can Rhoda leave a message without violating Art. 27-F? Contacting clients<br>
40
Case study This is Rhoda calling for Lu. Please call me back.
This is Rhoda from the Local Help Center calling for Lu. Please call me back.
This is Rhoda calling for Lu about your HASA appointment. Please call me back.
Either A or B, but not C.
None of the above Contacting clients<br>
This is Rhoda from the Local Help Center calling for Lu. Please call me back.
This is Rhoda calling for Lu about your HASA appointment. Please call me back.
Either A or B, but not C.
None of the above Contacting clients<br>
41
Case study D: Either A (“This is Rhoda calling for Lu, please call me back”) or B (“This is Rhoda from the Local Help Center calling for Lu, please call me back”).
Option C (“This is Rhoda calling for Lu about your HASA appointment”) discloses confidential HIV-related information; only permissible if Lu had signed release allowing Rhoda to leave confidential voicemail at that number.
Note: If Rhoda worked at Local *HIV* Help Center, then option B would also be impermissible. Contacting clients<br>
Option C (“This is Rhoda calling for Lu about your HASA appointment”) discloses confidential HIV-related information; only permissible if Lu had signed release allowing Rhoda to leave confidential voicemail at that number.
Note: If Rhoda worked at Local *HIV* Help Center, then option B would also be impermissible. Contacting clients<br>
42
More OCR Enforcement Actions Hospital Implements New Minimum Necessary Policies for Telephone Messages
Violation: staff left a telephone message with the daughter of a patient that detailed both her medical condition and treatment plan.
Resolution: employees received specific direction about what information could be left in a message.
Private Practice Implements Safeguards for Waiting Rooms
Violation: staff discussed HIV testing procedures with a patient in the waiting room; computer screens displaying patient information were easily visible to patients.
Resolution: agency updated P&P and trained all staff on new administrative safeguards.
Physician Revises Faxing Procedures to Safeguard PHI
Violation: staff mistakenly faxed patient’s HIV information to the patient’s employer instead of the patient’s new doctor.
Resolution: agency updated fax cover letter and trained staff.
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/all-cases/index.html<br>
Violation: staff left a telephone message with the daughter of a patient that detailed both her medical condition and treatment plan.
Resolution: employees received specific direction about what information could be left in a message.
Private Practice Implements Safeguards for Waiting Rooms
Violation: staff discussed HIV testing procedures with a patient in the waiting room; computer screens displaying patient information were easily visible to patients.
Resolution: agency updated P&P and trained all staff on new administrative safeguards.
Physician Revises Faxing Procedures to Safeguard PHI
Violation: staff mistakenly faxed patient’s HIV information to the patient’s employer instead of the patient’s new doctor.
Resolution: agency updated fax cover letter and trained staff.
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/all-cases/index.html<br>
43
Required provisions<br>
44
#4. Disclosures to Third Parties P&P must include protocols for handling 3rd-party requests for information by third parties
Include a procedure for determining whether the requested record contains HIV-related information
Designate a staff person to determine when and how to disclose HIV-related information
Is there a signed consent form authorizing the disclosure?
If not, do one of the limited exceptions apply?
☛ P.11<br>
Include a procedure for determining whether the requested record contains HIV-related information
Designate a staff person to determine when and how to disclose HIV-related information
Is there a signed consent form authorizing the disclosure?
If not, do one of the limited exceptions apply?
☛ P.11<br>
45
#4. Disclosures to Third Parties Disclosures with consent P&P should set forth processes for
Determining whether there is a signed release form
Seeking a release (if none on file)
Include information about where to locate consent forms; see examples from DOH
If necessary, assessing capacity to consent
Providing the notice prohibiting re-disclosure
Include information about where to locate notice prohibiting redisclosure ☛ Appendix 6
☛ P.13<br>
Determining whether there is a signed release form
Seeking a release (if none on file)
Include information about where to locate consent forms; see examples from DOH
If necessary, assessing capacity to consent
Providing the notice prohibiting re-disclosure
Include information about where to locate notice prohibiting redisclosure ☛ Appendix 6
☛ P.13<br>
46
#4. Disclosures to Third Parties Disclosures without consent<br>
47
#4. Disclosures to Third Parties Outside healthcare provider HIV-related information may be disclosed without a release to an outside healthcare provider or facility when necessary for that healthcare provider to provide appropriate care to the protected individual
“Appropriate care” does not include “infection control”
Agencies may require a written release anyway in non-emergency situations
DOH recommends that CBOs always obtain consent before disclosing HIV-related information in non-emergency situations
☛P.15<br>
“Appropriate care” does not include “infection control”
Agencies may require a written release anyway in non-emergency situations
DOH recommends that CBOs always obtain consent before disclosing HIV-related information in non-emergency situations
☛P.15<br>
48
#4. Disclosures to Third Parties Partner notification DOH: the most effective way clinical providers can support clients avoiding transmitting HIV to partners is to help them maintain undetectable viral load.
P&P should explain:
How staff can use DOH’s Partner Services to assist with any appropriate partner notification, as well as re-engaging the client in care, if necessary.
That DOH recommends that physicians work with Partner Services.
Under what circumstances (if any) physicians may conduct the notification.
☛ P. 16<br>
P&P should explain:
How staff can use DOH’s Partner Services to assist with any appropriate partner notification, as well as re-engaging the client in care, if necessary.
That DOH recommends that physicians work with Partner Services.
Under what circumstances (if any) physicians may conduct the notification.
☛ P. 16<br>
49
#4. Disclosures to Third Parties DOH Case Reporting Agencies that are mandated HIV/AIDS case reporters:
P&P should address which staff are mandated reporters, and how to make reports. ☛ P. 19
P&P should also address recent changes in law (2014, 2017), permitting DOH to:
Use information for “linkage, retention in care, and care coordination”
Share information with healthcare providers and care coordination entities<br>
P&P should address which staff are mandated reporters, and how to make reports. ☛ P. 19
P&P should also address recent changes in law (2014, 2017), permitting DOH to:
Use information for “linkage, retention in care, and care coordination”
Share information with healthcare providers and care coordination entities<br>
50
#4. Disclosures to Third Parties Other If the patient has not authorized the disclosure of confidential HIV-related information, and none of the Article 27-F exceptions apply …
P&P should include procedures for how to disclose records while redacting, omitting, or segmenting the confidential HIV-related information
Paper records: redact or omit (with disclaimer)
Electronic records: segment<br>
P&P should include procedures for how to disclose records while redacting, omitting, or segmenting the confidential HIV-related information
Paper records: redact or omit (with disclaimer)
Electronic records: segment<br>
51
CASE STUDY Nell’s primary care doctor plans to refer her to a specialist.
Does the doctor’s office need Nell’s written release to disclose her HIV status to the specialist? Outside healthcare providers<br>
Does the doctor’s office need Nell’s written release to disclose her HIV status to the specialist? Outside healthcare providers<br>
52
CASE STUDY Yes
No
It depends Outside healthcare providers<br>
No
It depends Outside healthcare providers<br>
53
CASE STUDY Answer: No; no written release necessary.
Nell’s primary care doctor may disclose HIV-related info – without release – to outside healthcare provider/facility because necessary to provide appropriate care or treatment to Nell. Outside healthcare providers<br>
Nell’s primary care doctor may disclose HIV-related info – without release – to outside healthcare provider/facility because necessary to provide appropriate care or treatment to Nell. Outside healthcare providers<br>
54
CASE STUDY However! Many agencies require a written release from patients as a matter of best practice, unless there is an emergency.
Using written releases is a good way of making sure patients know who is involved in care and receiving information about their HIV status
DOH specifically recommends that CBOs ask for releases as a matter of best practice. Outside healthcare providers, cont.<br>
Using written releases is a good way of making sure patients know who is involved in care and receiving information about their HIV status
DOH specifically recommends that CBOs ask for releases as a matter of best practice. Outside healthcare providers, cont.<br>
55
Case study Denali Health Home is concerned about client Nanda. Nanda had been receiving services regularly for four years but has not made it to any of her appointments for more than six months. Calls and letters to Nanda are unanswered.
Can the medical office ask the DOH for information about Nanda? Care coordination<br>
Can the medical office ask the DOH for information about Nanda? Care coordination<br>
56
Case study Yes
No
It depends Care coordination<br>
No
It depends Care coordination<br>
57
Case study Answer: Yes. Health homes ("care coordination entities") may submit a request for information from either NYC or NYS’s HIV health surveillance systems for the purpose of promoting retention in HIV care. They must provide written documentation of their affiliation with the patient. The DOH could provide information about Nanda’s care status, relocation, or if she died, date of death.
Also true if Denali Health Home were an individual medical office. In that case, they would not need to provide written documentation of their affiliation with Nanda. Care coordination<br>
Also true if Denali Health Home were an individual medical office. In that case, they would not need to provide written documentation of their affiliation with Nanda. Care coordination<br>
58
Case study Oak Terrace Service Center received a subpoena for Silas's records, which contain confidential HIV-related information
A judge signed the subpoena.
There is no release on file and Oak Terrace can’t get in touch with Silas.
May Oak Terrace Service Center disclose Silas’s HIV-related information? Subpoenas<br>
A judge signed the subpoena.
There is no release on file and Oak Terrace can’t get in touch with Silas.
May Oak Terrace Service Center disclose Silas’s HIV-related information? Subpoenas<br>
59
Case study Yes
No
It depends Subpoenas<br>
No
It depends Subpoenas<br>
60
Case study Answer: No, because Art. 27-F requires a special court order to disclose HIV-related information.
A subpoena is not sufficient to authorize a disclosure unless Silas signed a release
BUT: Don’t ignore subpoenas!
If possible, redact/withhold HIV info and explain that confidentiality law prohibits disclosure.
“These records have been redacted to remove confidential information protected by state and/or federal privacy law, which prohibits the disclosure of such information without appropriate authorization (i.e., a written release of information) or pursuant to a special court order authorizing the disclosure. See Subpart E of 45 CFR Part 164; Subpart E of 42 CFR Part 2; Section 2785 of New York State Public Health Law; Section 33.13 of the New York State Mental Hygiene Law.”
☛ P. 12 Subpoenas<br>
A subpoena is not sufficient to authorize a disclosure unless Silas signed a release
BUT: Don’t ignore subpoenas!
If possible, redact/withhold HIV info and explain that confidentiality law prohibits disclosure.
“These records have been redacted to remove confidential information protected by state and/or federal privacy law, which prohibits the disclosure of such information without appropriate authorization (i.e., a written release of information) or pursuant to a special court order authorizing the disclosure. See Subpart E of 45 CFR Part 164; Subpart E of 42 CFR Part 2; Section 2785 of New York State Public Health Law; Section 33.13 of the New York State Mental Hygiene Law.”
☛ P. 12 Subpoenas<br>
61
Required provisions<br>
62
#5. Anti-Discrimination Required: Policy prohibiting employees, agents, and contractors from discriminating against persons having or suspected of having HIV infection. ☛ P. 22
Optional: Grievance procedures for HIV discrimination. ☛ P. 23<br>
Optional: Grievance procedures for HIV discrimination. ☛ P. 23<br>
63
Creating and Updating HIV Privacy Policies & Procedures Summary of key points<br>
64
How to Conduct an Annual Policy Review<br>
65
Steps for reviewing your P&P<br>
66
Identify gaps or needed additions Assess agency’s experience over previous year
Have there been any client complaints?
Has there been any legal or regulatory action against the agency?
Ask for input from new and experienced staff
Where do you have questions?
What issues have arisen? Review legal landscape Consult AIDS Institute
Need help? Ask Legal Action Center, privacyta@lac.org<br>
Have there been any client complaints?
Has there been any legal or regulatory action against the agency?
Ask for input from new and experienced staff
Where do you have questions?
What issues have arisen? Review legal landscape Consult AIDS Institute
Need help? Ask Legal Action Center, privacyta@lac.org<br>
67
Internal assessment Review internal documents:
Employee attestation forms
Other ways that agency documents compliance with Art. 27-F confidentiality requirements
Review need-to-know list and designated staff list<br>
Employee attestation forms
Other ways that agency documents compliance with Art. 27-F confidentiality requirements
Review need-to-know list and designated staff list<br>
68
How to Train Agency Staff<br>
69
Initial Staff Training Before gaining access to HIV-related info, staff must receive initial HIV confidentiality training, including:
Overview of Art. 27-F, Online module, “HIV/AIDS Confidentiality Law Overview”
Overview of agency-specific policies and procedures
Recommended practices: highlight key provisions, provide agency-specific case studies, convene discussion with all new staff and some experienced staff<br>
Overview of Art. 27-F, Online module, “HIV/AIDS Confidentiality Law Overview”
Overview of agency-specific policies and procedures
Recommended practices: highlight key provisions, provide agency-specific case studies, convene discussion with all new staff and some experienced staff<br>
70
Online Module https://ceitraining.org/hiv_law_scorm/<br>
71
Ongoing Staff Trainings DOH requires an update to staff whenever there are changes to law or regulation.
Seek input from staff on their questions about agency P&P or the law, and then tailor staff update accordingly
Tip: Perform annual update even if law has not changed as a general refresher
Identify best way to update staff – 4 basic options (next slides)<br>
Seek input from staff on their questions about agency P&P or the law, and then tailor staff update accordingly
Tip: Perform annual update even if law has not changed as a general refresher
Identify best way to update staff – 4 basic options (next slides)<br>
72
Staff Updates Option 1
E-mail Highlight key components of agency’s P&P and attach
Note any changes in P&P or law
Note any issues or changes that have arisen in past year<br>
E-mail Highlight key components of agency’s P&P and attach
Note any changes in P&P or law
Note any issues or changes that have arisen in past year<br>
73
Staff Updates Option 2
E-mail & Discuss Send e-mail from option 1, and
Convene in-person/virtual meeting
Review P&P and any changes
Leave plenty of time for Q&A<br>
E-mail & Discuss Send e-mail from option 1, and
Convene in-person/virtual meeting
Review P&P and any changes
Leave plenty of time for Q&A<br>
74
Staff Updates Option 3
Case Studies Send an e-mail and hold an in-person/virtual meeting (options 1 & 2), and
Use case studies and activities
Create your own case studies based on real agency experiences, or use case studies in online module, this webinar, other LAC resources
Ask staff for their examples<br>
Case Studies Send an e-mail and hold an in-person/virtual meeting (options 1 & 2), and
Use case studies and activities
Create your own case studies based on real agency experiences, or use case studies in online module, this webinar, other LAC resources
Ask staff for their examples<br>
75
Staff Updates Option 4
Thorough Review Do options 1, 2, and 3, and
Ask staff to take all (or select) portions of online module, “HIV/AIDS Confidentiality Law Overview”
Offer staff additional resources and materials<br>
Thorough Review Do options 1, 2, and 3, and
Ask staff to take all (or select) portions of online module, “HIV/AIDS Confidentiality Law Overview”
Offer staff additional resources and materials<br>
76
Conducting Annual Policy Review Summary of key points<br>
77
Next Steps and Additional Resources<br>
78
Resources LAC’s Model HIV Confidentiality Policies and Procedures
LAC’s free handbook: HIV/AIDS Testing, Confidentiality and Discrimination (2012 edition) with 2018 supplement
Online module, “HIV/AIDS Confidentiality Law Overview”
AIDS Institute guidance and consent form DOH 5032
AIDS Institute guidance and consent form DOH 2557
Article 27-F flowchart<br>
LAC’s free handbook: HIV/AIDS Testing, Confidentiality and Discrimination (2012 edition) with 2018 supplement
Online module, “HIV/AIDS Confidentiality Law Overview”
AIDS Institute guidance and consent form DOH 5032
AIDS Institute guidance and consent form DOH 2557
Article 27-F flowchart<br>
79
POLL: What do you need? Model HIV confidentiality policies tailored for healthcare providers
More information about the Information Blocking Rule and putting HIV information on patient portals
Case studies for training staff
Other (chat in your ideas)
All of the above<br>
More information about the Information Blocking Rule and putting HIV information on patient portals
Case studies for training staff
Other (chat in your ideas)
All of the above<br>
80
You can do it! Questions about the law or how to implement the privacy requirements? Reach out to Legal Action Center – lawyers are available to provide free technical assistance and help. Legal Action Center
(212) 243-1313 or privacyta@lac.org
www.lac.org<br>
(212) 243-1313 or privacyta@lac.org
www.lac.org<br>
81
Additional LAC Trainings Employment Rights of People Living with HIV, Viral Hepatitis and Substance Use Disorders
Overcoming Employment Barriers for People with Criminal Records
Minors’ Health Rights: Access to Confidential Healthcare<br>
Overcoming Employment Barriers for People with Criminal Records
Minors’ Health Rights: Access to Confidential Healthcare<br>
82
More LAC Resources Free Legal Services in NY HIV and employment discrimination
HIV and medical forms – to disclose or not to disclose?
Health privacy
Substance use and discrimination
Criminal record issues
Rap Sheet Review and error correction
Certificates of Relief and Good Conduct
Job and housing discrimination<br>
HIV and medical forms – to disclose or not to disclose?
Health privacy
Substance use and discrimination
Criminal record issues
Rap Sheet Review and error correction
Certificates of Relief and Good Conduct
Job and housing discrimination<br>
83
Don’t Forget to Register! If you haven’t officially registered with the NYS Department of Health AIDS Institute, http://www.hivtrainingny.org/, please do it now!
Get credit for your attendance!
Contact Alisha Scott at ascott@lac.org if you have any questions.<br>
Get credit for your attendance!
Contact Alisha Scott at ascott@lac.org if you have any questions.<br>
84
Thank you! This concludes the webinar.
Thank you.
And thanks to the AIDS Institute, New York State Department of Health.<br>
Thank you.
And thanks to the AIDS Institute, New York State Department of Health.<br>