Protected Health Information (PHI) which is comprised of two elements:

Transcription

1 September 15, 2013

2 Who Does it apply to? As a healthcare provider of LSUHSC-NO, you are required to follow the requirements of the HIPAA Privacy Rule. CM-53 explains all the requirements LSUHSC-NO healthcare providers must meet. What Information Does it apply to? Protected Health Information (PHI) which is comprised of two elements: Information about the patient (e.g. name) and Information related to the patient s health care (e.g. diagnosis) or payment (e.g. insurance) information

3 Due to the sensitive information received, the HIPAA Privacy Rule has additional requirements regarding the protection of health information obtained through psychotherapy or counseling. This presentation will address the additional requirements the Privacy Rule requires of psychiatrists. As a practicing mental health professional, these requirements affect your daily practice.

4 Right of Access by Patients to Mental Health Professional s Records Exception to Patient Access --Psychotherapy Notes What are psychotherapy notes? Exception to Patient Access -- Information Compiled in Anticipation of Litigation Disclosing Records to Third Parties Authorization Requirement Separate Authorization Requirement for Psychotherapy Notes Re-disclosure of records and psychotherapy notes once released to third party.

5 Responding to Requests for Records Authorization Requirement Court orders/subpoenas Application to Forensic Psychotherapy How HIPAA applies Independent medical evaluations Patient s right to access independent medical evaluations.

6 As a general rule, HIPAA provides that a patient has a right to access and obtain a copy of his/her protected health information.

7 There are two exceptions to the patient s right of access which are relevant to the practice of psychiatry: Psychotherapy Notes, and, Information compiled in reasonable anticipation of or for the use in, a civil, criminal, or administrative action or proceeding.

8 Psychotherapy notes under HIPAA means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record.

9 Psychotherapy notes excludes the following: medication prescription and monitoring; counseling session start and stop times; the modalities and frequencies of treatment results of clinical tests, and, any summary of the following items: - Diagnosis, - functional status, - the treatment plan, - symptoms, - prognosis, and - progress to date.

10 In order to qualify as psychotherapy notes and be an exception to the patient right of access requirement under HIPAA, the healthcare provider: Must create a file separate from the main PHI file The separate file must only contain notes documenting or analyzing the contents of conversation in counseling (sometimes called personal notes or process notes ) and; Should label them clearly as psychotherapy notes

11 Any information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding is an exception to the patient s right of access under HIPAA. For purposes of this exception, an administrative action or proceeding is a hearing, inquiry, investigation, or trial before an administrative agency. - An Administrative Agency is a government body, usually part of the executive branch of government that is charged with implementing particular laws passed by the legislature or Congress.

12 A proceeding of the Medical Malpractice Review Panel IS an Administrative Action or Proceeding, as defined under the HIPAA Privacy Rule. An academic determination of fitness of a student to return to school is a due process hearing, but NOT an administrative hearing as defined under the HIPAA Privacy Rule.

13 In order to disclose patient records to third parties, in most cases, HIPAA requires a patient sign a HIPAA authorization form. The patient must receive a copy of the signed authorization form.

14 To find the LSUHSC-NO HIPAA authorization policy and form go here: See Chancellor s Memorandum 53, Section T. 53/AttachmentB-ToAuthorizationPolicy.pdf

15 An authorization is not valid if the form signed by the subject has any of the following defects: The authorization has been revoked. Any material information in the authorization is known by LSUHSC-NO to be false.

16 The authorization lacks: the signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative s authority to act for the individual. A description of each purpose of the requested use or disclosure. A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. The name or other specific identification of the person(s), or class of persons, to whom LSUHSC-NO may make the requested use or disclosure.

17 The authorization lacks: The name or other specific identification of the person(s) or class of persons authorized to make the requested use or disclosure. An expiration date or expiration event that relates to the individual or the purpose of the use or disclosure. The statement end of the research study, none or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including the creation and maintenance of a research database or research repository.

18 The authorization lacks: The expiration date has passed or the expiration event is know by LSUHSC-NO to have occurred. For example, if the authorization is valid for the duration of the pregnancy. Once the pregnancy has ended, the authorization is no longer valid and disclosures of PHI must not occur, unless a new authorization has been signed by the patient.

19 The HIPAA Privacy Rule requires that if a mental health professional wishes to disclose psychotherapy notes, as defined by HIPAA, to a third party, the patient must sign a separate HIPAA authorization form, which only authorizes the disclosure of the psychotherapy notes.

20 To carry out the following : Use by the originator of the psychotherapy notes for treatment; Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; A use or disclosure: is required by the Secretary of DHHS as required by law for the oversight of the originator of the psychotherapy notes for coroners or medical examiners to avert serious threat to health or safety

21 It is important to keep in mind that while a patient may be denied right of access to their psychotherapy notes, a patient may authorize the release of their psychotherapy notes to a third party, which may be an attorney, another provider, or even a friend. A mental health professional must comply with all authorizations and thus, the third party may give the patient a copy of the psychotherapy notes.

22 It is imperative that in the event psychotherapy notes are released to a healthcare provider, they be labeled and direction provided to keep them separate and apart from the main file pursuant to the HIPAA regulations, in order to continue to fall under the exception of right of access by the patient.

23 To determine whether a signed HIPAA authorization form is required to disclose protected health information in response to a records request: If it is a non-court order, a HIPAA authorization form IS REQUIRED. If it is a court order, then a HIPAA authorization form IS NOT REQUIRED from the patient provided some other conditions are met. Call the LSUHSC-NO Privacy Officer, who will determine if all the conditions are met for release.

24 Court orders: a request or order for documents issued or signed by a judge, magistrate, clerk of court or attorneys, acting as an officer of the court. Subpoenas Subpoena duces tecum Non-court orders: a request by an attorney or other individual for documents. Request for production of documents Request for release of medical records

25 Common Myth: HIPAA does not apply to Forensic Evaluations. HIPAA requires a doctor-patient relationship. Therefore, since a doctor-patient relationship is not present in a forensic medical evaluation, practitioners do not have to follow the requirements of the HIPAA Privacy Rule. HIPAA DOES APPLY TO FORENSIC EVALUATIONS. HIPAA does not require a doctor-patient relationship. HIPAA applies to individually identifiable health information held by payors, clearinghouses, and healthcare providers, regardless of the existence of a doctor-patient relationship. In a forensic evaluation, the evaluator, who is a healthcare provider, receives individually identifiable health information. Therefore, HIPAA applies.

26 IME can occur in some of the following situations: fitness for duty, eligibility to enroll in school, disability benefits, worker s compensation benefits, and social security benefits. An individual has the right to access any report that is created as a result of his/her independent medical evaluation under HIPAA, as with any other medical records, unless an exception applies. A common instance where an individual would not be entitled to access to the report is a court ordered evaluation. The individual is denied access under the information compiled for use in a civil, criminal or administrative proceeding exception, discussed earlier.

27 PENALTIES FOR HIPAA VIOLATIONS There is a tiered system for assessing the level and penalty of each violation: Tier A-violations that are accidental not intentionalfines of $100 per violation up to $25,000 for violations of an identical type per calendar year. Tier B-violations due to reasonable cause and not willful neglect- fines of $1000 per violation up to $50,000 for violations of an identical type per calendar year.

28 PENALTIES (CONT.) Tier C- violations that the hospital corrected, but were due to willful neglect of the policies/procedures-fines $10,000 per violation up to $250,000 for violations of an identical type per calendar year. Tier D- violations due to willful neglect that the hospital did not correct-fines $50,000 per violation up to $1.5 million for violations of an identical type per calendar year.

29 ADDITIONAL PENALTIES Loss of your job or student status. Individuals and health care providers (hospitals, etc.) can also face civil and criminal prosecution, depending on the facts of the case.

30 Responds to HIPAA privacy complaints. Implements policies and procedures. Conducts educational programs. Reviews LSUHSC s privacy program. Is available to answer any privacy questions or concerns.

31 If anyone suspects or knows of mishandling or misuse of patient PHI, a complaint can be made to: The LSUHSC-NO Privacy Officer or the Office of Compliance Programs by: Telephone at: Office: (504) Confidential reporting hotline: (504) , or at: nocompliance@lsuhsc.edu

32 Any Questions? We Are Here to Help! Office of Compliance Programs 433 Bolivar St. Suite 807 New Orleans, LA