General Preemption Rule

Transcription

1 HIPAA and New York State Laws Frances A. Ciardullo, Esq. Fager & Amsler,, LLP The information presented is to provide accurate and authoritative information with regard to HIPAA privacy as it relates to New York State. Every reasonable effort has been made to assure the accuracy of the information within the material being presented. However, the ultimate responsibility lies with the provider of services. The Upstate Medicare Division makes no representation, warranty, or guarantee that this compilation of material is error-free, nor that the use of the material will prevent differences of opinions or disputes and will bear no responsibility or liability for the results or consequences. General Preemption Rule! HIPAA preempts state laws that are contrary to the Privacy Rule.! State laws that are more stringent will not be preempted, will survive! More stringent means that patient has greater privacy protection OR greater rights under state law Federal and State laws! Covered entities must evaluate issues keeping in mind both HIPAA and New York State laws! On some issues, HIPAA defers to state law 1

2 NYS Materials Online DOH preemption analysis: health.state.ny.us/nysdoh/hipaa.hipaa.htm! NYS OMH preemption analysis: omh.state.ny.us/omhweb/hipaa/manual omh.state.ny.us/omhweb/hipaa/hipaaprivacy.pdf! NYS Office for Technology: oft.state.ny.us/hipaa/index/htm/ Access to PHI Patients and others Patient Access under HIPAA! Distinguish access from use or disclosure! Covered entity must permit patient to inspect or obtain copy of PHI within 30 days under (b)(2)! May require written request so long as individual is informed [ (b)(1)]. 2

3 Patient Access NY Law! PHL section 18, must permit inspection within 10 days of a written request! Nursing facilities: residents may inspect all records within 24 hours after oral/written request [10 NYCRR 415.3(c)(iv)].! New York Law provides greater patient rights of access = not preempted No HIPAA Authorization! Hospitals and Physician offices: under both HIPAA and PHL, written request in any form is sufficient for patient to obtain access to his or her own PHI (or PHI for whom they can legally give consent) - need not be HIPAA compliant! Nursing facilities: cannot require written request, oral is sufficient Personal Representatives! HIPAA defers to state law to define who are the personal representatives who have a right of access [ (g)(1)]! New York law recognizes: parents, legal guardians, health care proxies, executors/administrators, committees for incompetent persons! NOT ATTORNEYS-IN-FACT (POA) 3

4 A word about attorneys at law...! In New York, an attorney at law who represents a patient or a patient s estate is a qualified person entitled to access patient information under PHL 18(1)(g), 18(2)(d).! Attorneys are Personal Representatives for that limited purpose! May release copies of PHI to an attorney representing the patient or the patient s estate Parents as Personal Representatives [ (g)(3)]! HIPAA defers to State laws on privacy of minor s medical information and consent to treatment! HIPAA defers to State laws on whether the parent is the personal representative in any given situation HIPAA and Parents! Treat the parent as the personal representative except Consent of parent not required under State law Treatment was court ordered Parent agrees to confidential relationship Abuse/neglect or endangerment 4

5 Parental Access under HIPAA! Permitted when State law requires/permits access! Denied when State law denies access! If state law is silent, provider may exercise professional judgment! Parent cannot access minor s psychotherapy notes New York law...! Minor: Under age 18! No emancipated minor doctrine in NYS Distinguish financial obligations! Minors have right to consent to treatment in limited situations; no parental access! Minors over 12 have some rights to object to release of their PHI; parental access may be denied Reporting Abuse/Neglect! Notify victim (orally) about reports of abuse/neglect UNLESS it will place individual at risk of further harm, Except where the report would be made to the personal representative (i.e. parent) who is responsible for the harm 5

6 Psychotherapy Notes! Defined under HIPAA as process notes personal to therapist! Kept separate from clinical chart! Medical facts not included No right of access! Patient access to notes may be denied without opportunity for review! Consistent with NYS PHL section 18 which excludes personal notes and observations of a health care practitioner from right of access Use and Disclosure 6

7 HIPAA General Rule! A health care provider may not use or disclose PHI without patient authorization, except as required or permitted by the regulations! Use/disclosure is permitted for treatment, payment or health care operations NYS Requirements Confidentiality! Definitions of Professional Misconduct,Education Law 6530(23) [also 8 NYCRR 29.1(8)]: revealing of personally identifiable facts, data or information obtained in a professional capacity without the prior consent of the patient, except as authorized or required by law! SNF: PHL 2803-c(3)(f); 10 NYCRR 415.3(d)(I)(i)(a),(b)! Licensed Home Care Services 766.1! Certified Home Health Agencies 763.2! Hospitals: PHL 2803(1)(g), 10 NYCRR 405.7(13) NYS More Stringent!! New York does NOT permit use or disclosure for TPO without patient consent or authorization! Consent/authorization may be written, oral or implied from all the facts Example: when patient gives informed consent for treatment, also giving implied consent for provider to use information for treatment 7

8 How to comply! Patients should sign an authorization permitting the provider to use and disclose PHI as reasonably necessary for treatment, payment and health care operations See sample NYSDOH Medicaid application form Redisclosure! NYS law: Definition of patient information under PHL 18(1)(e) excludes: information maintained by a practitioner, concerning or relating to the prior examination or treatment of a subject received from another practitioner HIPAA definition! PHI is contained in a designated record set which is created, maintained and defined by the CE! Patient has access to and may authorize release of PHI in the designated record set 8

9 Designated Record Set A group of records maintained by or for a CE which include:! Medical records and billing records! Enrollment, payment claims adjudication and case management record systems maintained by a health plan! Used in whole or in part by CE to make decisions about the individual HHS Q&A:! Designated Record Set could include records of other treatment providers! Authorizes disclosure of complete medical record including portions created by other treatment providers Copying Fees under HIPAA! CE may impose reasonable, cost based fees for providing records to patients/personal representatives! Search and retrieval fees not allowed! Fees cannot impede access rights! Fees for copying and postage under State law presumed reasonable! Does not address other third parties 9

10 10 New York Rule! Maximum of 75 cents per page for patients, legal representatives and pursuant to patient authorization Public Health Law 18(2)(e) Attorney Requests! Citing to Medicare regulation of 12 cents per page (67 FR 70358)! Offer to pay 75 cents for expedited service! What they don t tell you: Medicare regulation refers to hospitals furnishing records to QIOs HIPAA and the NYS Privilege Laws

11 11 Privilege in Legal proceedings! CPLR 4504(a): doctor, dentist, podiatrist, chiropractor, RN, medical corporation, professional service corporation organized to practice medicine, and university faculty practice corporation practicing medicine or dentistry.! CPLR 4507: Psychologists! CPLR 4508: certified social workers Privilege requirements! No disclosure permitted of any information Acquired while attending patient in a professional capacity Information necessary to treatment Limited exceptions in each statute! Federal litigation, does not exist [except psychotherapist, Jaffee v. Redmond,, 518 U.S. 1 (1996)]. No Privilege applies to...! Person under 16 is the victim of a crime CPLR 4504(b)! Mandated reports (e.g., serious knife, gunshot wounds under of the Penal Law)! Child abuse/neglect (Social Services Law 413 and 415, Family Court Act, 1046(a)(vii))! Other statutory exceptions

12 12 Information not privileged under NYS Law! non medical facts, plain to laypersons! Name, address, nearest relative or friend on admission, dates of treatment, payments, one word statement ( good, fair, stable, etc) Waiver of the Privilege! Claims for personal injuries : plaintiff has placed medical condition in controversy : = waiver of physician patient privilege! Always determine what the lawsuit is about!! Divorce = no waiver Contract dispute = no waiver Criminal actions = no waiver HIPAA and Law Enforcement! CE may disclose PHI to law enforcement without patient authorization As required by State law To identify or locate Victims of a crime Decedents Crimes on premises Reporting crimes in emergencies Abuse, neglect, domestic violence

13 13 NYS Rule! There is no general exception to the physician patient privilege for Grand Jury proceedings or criminal investigations. Matter of Grand Jury Investigation in Onondaga County,, 59 N.Y.2d 130 (1983); Matter of Grand Jury Investigation in New York County, 749 N.Y.2d 462 (2002). HIPAA vs. NYS! HIPAA permits disclosure but does not require it! Must determine whether New York State law would permit disclosure Information remains privileged- but look at EXCEPTIONS! Grand Jury subpoenas! NYS Law applies no waiver!! Cannot comply unless court order SO ORDERED! Exceptions: Victim of a crime is under the age of 16 Gunshot wounds, serious knife wounds

14 14 Handling subpoenas! First, decide whether there is a privilege, and/or whether it has been waived If privilege applies, call your attorney!! Second, determine whether procedural requirements have been followed Understanding the Subpoena! How was it served? Upon whom?! Read the caption court, parties and state! When and where is it returnable?! Are records sought?! Who issued (signed) the subpoena?! Does it say So Ordered? Sensitive Information! The following MAY NOT be released even pursuant to a subpoena HIV information (Public Health Law 2785) Records of federally funded alcohol/substance rehabilitation programs (42 CFR Part 2) Records of psychiatric treatment (CPLR 2302(a), Mental Hygiene Law)

15 15 Procedural requirements! Compliance with New York discovery practice and! Compliance with the Health Insurance Portability and Accountability Act Types of Subpoenas! Judicial: may be issued by attorney Ad Testificandum ( Judicial subpoena ) Duces Tecum (Records)! Administrative Examples: OPMC, Office of the Inspector General, Medical Examiner, SSA, Workers Comp! Grand Jury Question the subpoena if...! Not returnable in a court or tribunal (e.g. attorney s office)! Out of state (except Federal courts)! Legal proceeding does not involve a claim for personal injuries (custody, divorce, contract cases, support proceedings)! Grand jury subpoenas! Subpoena is not personally served

16 16 HIPAA Requirements for Subpoenas! Accompanied by an authorization; or! Written satisfactory assurance that reasonable efforts have been made to place the patient on notice of the subpoena in time for an objection; or! Written satisfactory assurances that reasonable efforts have been made to secure a qualified protective order; or! Subpoena is court ordered Recent CPLR amendments eliminate HIPAA issues with respect to most subpoenas Must still review papers to determine if subpoena complies with rules New York Rules (CPLR 3120, 3121)! Effective September 1, 2003! Applies to DISCOVERY subpoenas for medical records! MUST INCLUDE a patient authorization. If no authorization, provider is not required to comply! MUST STATE IN BOLD that records shall not be provided if no authorization

17 17 Changes Effective 1/01/04 Assembly Bill No. 3679! Rule 2303: A copy of any subpoena duces tecum served in a pending action shall also be served on each party who has appeared in the action so that it is received promptly after service on the witness and before the production of books, papers or other things! Does not include non-litigation matters (e.g. post judgment enforcement) Worker s Compensation Subpoenas! HIPAA permits disclosures for purposes of Worker s Compensation laws without patient authorization [45 CFR (l)]! Subpoenas: must follow HIPAA subpoena rules, per policy posted on NYS Worker s Compensation website