PROTECTING PATIENT INFORMATION IN FLORIDA

Transcription

1 PROTECTING PATIENT INFORMATION IN FLORIDA Vanessa A. Reynolds, P.A. Broad and Cassel, Ft. Lauderdale, Florida Florida Board Certified, Health Law; CCB Certified, Healthcare Privacy Compliance Stephen Siegel, Esq. Broad and Cassel, Miami, Florida Florida Board Certified, Health Law Copyright Broad and Cassel October 2014 Page 1

2 The adoption and implementation of the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2010 (collectively referred to as "HIPAA-HITECH"), has raised the bar for ensuring that each person's health information is maintained in a manner that is both private and secure. Subject to certain exceptions, a person's health information generally cannot be shared with third parties without his or her consent. Even then, only the "minimum necessary" amount of that information may be shared. The federal scheme imposes an obligation on "Covered Entities" and "Business Associates" 1 to be proactive and to adopt security measures designed to ensure that the healthcare information in their possession or under their control for any period of time is not "hacked" or otherwise inappropriately disclosed. Two of the concepts that are central to understanding, complying with, and implementing HIPAA-HITECH are "scalability" and "floor." Scalability refers to the recognition that the resources available to a particular Covered Entity or Business Associate may be limited and may impact the measures the Covered Entity or Business Associate can be reasonably expected to adopt. HIPAA-HITECH recognizes that a "one size fits all" approach is unrealistic and unworkable, and allows Covered Entities and Business Associates flexibility in developing and implementing measures to maintain the privacy and security of health information. Scalability does not mean, however, that a Covered Entity or Business Associate is excused from adopting policies and procedures or other HIPAA-HITECH compliant measures, such as encryption, simply because it has limited resources. HIPAA-HITECH is intended to serve as a "floor," that is, the minimum standards every Covered Entity and Business Associate is expected to meet to protect the privacy and security of individuals' healthcare information. Covered Entities and Business Associates are also bound by state laws governing information privacy and security in addition to the federal requirements. Some states, such as Florida, have adopted measures to protect their citizens' health information that are more restrictive and establish higher standards than HIPAA-HITECH. In those cases in which the state law is more restrictive, the state law will control. In other words, Covered Entities and Business Associates must comply with the highest standards established by either the federal or state laws. Florida s requirements for protecting individuals' health information take a two-pronged approach, establishing obligations for specific types of healthcare providers (hospitals, skilled nursing facilities, etc.) and obligations related to specific types of medical records (HIV, substance abuse, mental health, etc.). In many respects, Florida s laws are more restrictive and afford greater protections than HIPAA-HITECH. In other respects, however, Florida s laws are not as restrictive or, in some cases, conflict with, HIPAA-HITECH. In those cases, HIPAA- HITECH s requirements will preempt, or override, Florida law. Our purpose in developing this publication, "PROTECTING PATIENT INFORMATION IN FLORIDA," is to provide our clients, colleagues and other parties involved in Florida's healthcare industry with a resource compiling Florida s laws governing the privacy and security 1 Each as defined by HIPAA-HITECH. Copyright Broad and Cassel October 2014 Page 2

3 of individuals' healthcare information. This publication identifies thirteen Florida statutes that address the obligation to protect individuals' healthcare information. The statutes cover a range of subjects from blood alcohol testing to psychiatric records, and include references to business records that may not be traditionally considered patient health information. Three final points: First, like HIPAA-HITECH, Florida s laws are strict liability statutes; a violation does not require either knowledge or intent on the part of the person or entity violating them, and sanctions can be imposed even for actions taken in good faith. Second, unlike HIPAA-HITECH, the concepts of "scalability" and "floor" are not part of Florida's scheme for protecting the records; strict compliance is required. Finally, "PROTECTING PATIENT INFORMATION IN FLORIDA" is intended to be a companion to the HIPAA-HITECH regulations. The federal and Florida laws must be read together to ensure that patients' private health and other information is maintained in a manner that is both private and secure. Because each situation is unique, we have not attempted to provide guidance as to how an individual's healthcare information should be handled in any particular situations. Rather, we have attempted to include a brief commentary that discusses some aspects of each statute and how compliance with it may implicate the obligation to comply with HIPAA-HITECH. Our hope is that this pamphlet will enable readers to better appreciate the range of records, providers and circumstances under which patient information must be protected. Vanessa A. Reynolds, P.A. Stephen Siegel, Esq. Broad and Cassel Copyright Broad and Cassel October 2014 Page 3

4 Index Subject/Citation Page Blood Alcohol Testing/ , F.S. 5 HIV Testing/ , F.S. 7 Mental Health/ , F.S. 15 Hospitals/Ambulatory Care Centers/ , F.S. 17 Substance Abuse Treatment/ , F.S. 20 Skilled Nursing Facilities/ , F.S. 23 Home Health Agencies/ , F.S. 24 Hospices/ , F.S. 25 Home Medical Equipment Providers/ , F.S. 26 Health Care Practitioners/ , F.S. 27 Psychologists/ , F.S. 32 Healthcare and Other Businesses/ , F.S. 33 Genetic Testing/ About the Authors and the Firm Vanessa A. Reynolds, Esq. 38 Stephen H. Siegel, Esq. 39 Broad and Cassel Broad and Cassel's Health Law Practice Copyright Broad and Cassel October 2014 Page 4

5 In contrast to the rest of the statutes included in this publication, which restrict the ability to disclose an individual's personal medical information, section provides authorization for disclosing that information in limited circumstances. Although this provision predates HIPAA-HITECH, it is consistent with the federal regulation s exception for disclosure to law enforcement agencies. BLOOD ALCOHOL TESTING Tests for alcohol, chemical substances, or controlled substances; implied consent; refusal. * * * * (f)1. The tests determining the weight of alcohol in the defendant s blood or breath shall be administered at the request of a law enforcement officer substantially in accordance with rules of the Department of Law Enforcement. Such rules must specify precisely the test or tests that are approved by the Department of Law Enforcement for reliability of result and ease of administration, and must provide an approved method of administration which must be followed in all such tests given under this section. However, the failure of a law enforcement officer to request the withdrawal of blood does not affect the admissibility of a test of blood withdrawn for medical purposes. 2.a. Only a physician, certified paramedic, registered nurse, licensed practical nurse, other personnel authorized by a hospital to draw blood, or duly licensed clinical laboratory director, supervisor, technologist, or technician, acting at the request of a law enforcement officer, may withdraw blood for the purpose of determining its alcoholic content or the presence of chemical substances or controlled substances therein. However, the failure of a law enforcement officer to request the withdrawal of blood does not affect the admissibility of a test of blood withdrawn for medical purposes. b. Notwithstanding any provision of law pertaining to the confidentiality of hospital records or other medical records, if a health care provider, who is providing medical care in a health care facility to a person injured in a motor vehicle crash, becomes aware, as a result of any blood test performed in the course of that medical treatment, that the person s bloodalcohol level meets or exceeds the blood-alcohol level specified in s (1)(b), the health care provider may notify any law enforcement officer or law enforcement agency. Any such notice must be given within a reasonable time after the health care provider receives the test result. Any such notice shall be used only for the purpose of providing the law enforcement officer with reasonable cause to request the withdrawal of a blood sample pursuant to this section. c. The notice shall consist only of the name of the person being treated, the name of the person who drew the blood, the blood-alcohol level indicated by the test, and the date and time of the administration of the test. d. Nothing contained in s (4), s , or any applicable practice act affects the authority to provide notice under this section, and the health care provider is not considered to have breached any duty owed to the person under s (4), s , or any applicable practice act by providing notice or failing to provide notice. It shall not be a breach of any ethical, moral, or legal duty for a health care provider to provide notice or fail to provide notice. e. A civil, criminal, or administrative action may not be brought against any person or health care provider participating in good faith in the provision of notice or failure to provide notice as provided in this section. Any person or health care provider participating in the provision of notice or failure to provide notice as provided in this section shall be immune from any civil or criminal liability and from any professional disciplinary action with respect to the provision of notice or failure to provide notice under this section. Any such participant Copyright Broad and Cassel October 2014 Page 5

6 has the same immunity with respect to participating in any judicial proceedings resulting from the notice or failure to provide notice. 3. The person tested may, at his or her own expense, have a physician, registered nurse, other personnel authorized by a hospital to draw blood, or duly licensed clinical laboratory director, supervisor, technologist, or technician, or other person of his or her own choosing administer an independent test in addition to the test administered at the direction of the law enforcement officer for the purpose of determining the amount of alcohol in the person s blood or breath or the presence of chemical substances or controlled substances at the time alleged, as shown by chemical analysis of his or her blood or urine, or by chemical or physical test of his or her breath. The failure or inability to obtain an independent test by a person does not preclude the admissibility in evidence of the test taken at the direction of the law enforcement officer. The law enforcement officer shall not interfere with the person s opportunity to obtain the independent test and shall provide the person with timely telephone access to secure the test, but the burden is on the person to arrange and secure the test at the person s own expense. 4. Upon the request of the person tested, full information concerning the results of the test taken at the direction of the law enforcement officer shall be made available to the person or his or her attorney. Full information is limited to the following: a. The type of test administered and the procedures followed. b. The time of the collection of the blood or breath sample analyzed. c. The numerical results of the test indicating the alcohol content of the blood and breath. d. The type and status of any permit issued by the Department of Law Enforcement which was held by the person who performed the test. e. If the test was administered by means of a breath testing instrument, the date of performance of the most recent required inspection of such instrument. Full information does not include manuals, schematics, or software of the instrument used to test the person or any other material that is not in the actual possession of the state. Additionally, full information does not include information in the possession of the manufacturer of the test instrument. 5. A hospital, clinical laboratory, medical clinic, or similar medical institution or physician, certified paramedic, registered nurse, licensed practical nurse, other personnel authorized by a hospital to draw blood, or duly licensed clinical laboratory director, supervisor, technologist, or technician, or other person assisting a law enforcement officer does not incur any civil or criminal liability as a result of the withdrawal or analysis of a blood or urine specimen, or the chemical or physical test of a person s breath pursuant to accepted medical standards when requested by a law enforcement officer, regardless of whether or not the subject resisted administration of the test. (2) The results of any test administered pursuant to this section for the purpose of detecting the presence of any controlled substance shall not be admissible as evidence in a criminal prosecution for the possession of a controlled substance. (3) Notwithstanding any provision of law pertaining to the confidentiality of hospital records or other medical records, information relating to the alcoholic content of the blood or breath or the presence of chemical substances or controlled substances in the blood obtained pursuant to this section shall be released to a court, prosecuting attorney, defense attorney, or law enforcement officer in connection with an alleged violation of s upon request for such information. Copyright Broad and Cassel October 2014 Page 6

7 The strict protection of the confidentiality of a person's HIV status is intended, in part, to encourage people to get tested for what once was a fatal communicable disease. The unauthorized disclosure of an individual's HIV status (positive or negative) may be subject to criminal penalties under both Florida law and HIPAA-HITECH. However, section provides mechanisms for disclosing this information, even in the absence of the individual's consent, under certain circumstances. Potential disclosures must be examined to ensure that they do not violate HIPAA-HITECH. HIV HIV testing. (1) DEFINITIONS. As used in this section: (a) HIV test means a test ordered after July 6, 1988, to determine the presence of the antibody or antigen to human immunodeficiency virus or the presence of human immunodeficiency virus infection. (b) HIV test result means a laboratory report of a human immunodeficiency virus test result entered into a medical record on or after July 6, 1988, or any report or notation in a medical record of a laboratory report of a human immunodeficiency virus test. As used in this section, the term HIV test result does not include test results reported to a health care provider by a patient. (c) Significant exposure means: 1. Exposure to blood or body fluids through needlestick, instruments, or sharps; 2. Exposure of mucous membranes to visible blood or body fluids, to which universal precautions apply according to the National Centers for Disease Control and Prevention, including, without limitations, the following body fluids: a. Blood. b. Semen. c. Vaginal secretions. d. Cerebro-spinal fluid (CSF). e. Synovial fluid. f. Pleural fluid. g. Peritoneal fluid. h. Pericardial fluid. i. Amniotic fluid. j. Laboratory specimens that contain HIV (e.g., suspensions of concentrated virus); or 3. Exposure of skin to visible blood or body fluids, especially when the exposed skin is chapped, abraded, or afflicted with dermatitis or the contact is prolonged or involving an extensive area. (d) Preliminary HIV test means an antibody screening test, such as the enzyme-linked immunosorbent assays (ELISAs) or the Single-Use Diagnostic System (SUDS). (e) Test subject or subject of the test means the person upon whom an HIV test is performed, or the person who has legal authority to make health care decisions for the test subject. (2) HUMAN IMMUNODEFICIENCY VIRUS TESTING; INFORMED CONSENT; RESULTS; COUNSELING; CONFIDENTIALITY. (a) No person in this state shall order a test designed to identify the human immunodeficiency virus, or its antigen or antibody, without first obtaining the informed consent of the person upon whom the test is being performed, except as specified in paragraph (h). Informed consent shall be preceded by an explanation of the right to confidential treatment of information identifying the subject of the test and the results of the test to the extent provided by law. Information shall also be provided on the fact that a positive HIV test result will be reported to the county health department with sufficient Copyright Broad and Cassel October 2014 Page 7

8 information to identify the test subject and on the availability and location of sites at which anonymous testing is performed. As required in paragraph (3)(c), each county health department shall maintain a list of sites at which anonymous testing is performed, including the locations, phone numbers, and hours of operation of the sites. Consent need not be in writing provided there is documentation in the medical record that the test has been explained and the consent has been obtained. (b) Except as provided in paragraph (h), informed consent must be obtained from a legal guardian or other person authorized by law when the person: 1. Is not competent, is incapacitated, or is otherwise unable to make an informed judgment; or 2. Has not reached the age of majority, except as provided in s (c) The person ordering the test or that person s designee shall ensure that all reasonable efforts are made to notify the test subject of his or her test result. Notification of a person with a positive test result shall include information on the availability of appropriate medical and support services, on the importance of notifying partners who may have been exposed, and on preventing transmission of HIV. Notification of a person with a negative test result shall include, as appropriate, information on preventing the transmission of HIV. When testing occurs in a hospital emergency department, detention facility, or other facility and the test subject has been released before being notified of positive test results, informing the county health department for that department to notify the test subject fulfills this responsibility. (d) A positive preliminary test result may not be revealed to any person except in the following situations: 1. Preliminary test results may be released to licensed physicians or the medical or nonmedical personnel subject to the significant exposure for purposes of subparagraphs (h)10., 11., and Preliminary test results may be released to health care providers and to the person tested when decisions about medical care or treatment of, or recommendation to, the person tested and, in the case of an intrapartum or postpartum woman, when care, treatment, or recommendations regarding her newborn, cannot await the results of confirmatory testing. Positive preliminary HIV test results may not be characterized to the patient as a diagnosis of HIV infection. Justification for the use of preliminary test results must be documented in the medical record by the health care provider who ordered the test. 3. The results of rapid testing technologies shall be considered preliminary and may be released in accordance with the manufacturer s instructions as approved by the federal Food and Drug Administration. 4. Corroborating or confirmatory testing must be conducted as followup to a positive preliminary test. Results shall be communicated to the patient according to statute regardless of the outcome. Except as provided in this section, test results are confidential and exempt from the provisions of s (1). (e) Except as provided in this section, the identity of any person upon whom a test has been performed and test results are confidential and exempt from the provisions of s (1). No person who has obtained or has knowledge of a test result pursuant to this section may disclose or be compelled to disclose the identity of any person upon whom a test is performed, or the results of such a test in a manner which permits identification of the subject of the test, except to the following persons: 1. The subject of the test or the subject s legally authorized representative. 2. Any person, including third-party payors, designated in a legally effective release of the test results executed prior to or after the test by the subject of the test or the subject s legally authorized representative. The test subject may in writing authorize the disclosure of the test subject s HIV test results to third party payors, who need not be specifically identified, and to other persons to whom the test subject subsequently issues a general Copyright Broad and Cassel October 2014 Page 8

9 release of medical information. A general release without such prior written authorization is not sufficient to release HIV test results. 3. An authorized agent or employee of a health facility or health care provider if the health facility or health care provider itself is authorized to obtain the test results, the agent or employee participates in the administration or provision of patient care or handles or processes specimens of body fluids or tissues, and the agent or employee has a need to know such information. The department shall adopt a rule defining which persons have a need to know pursuant to this subparagraph. 4. Health care providers consulting between themselves or with health care facilities to determine diagnosis and treatment. For purposes of this subparagraph, health care providers shall include licensed health care professionals employed by or associated with state, county, or municipal detention facilities when such health care professionals are acting exclusively for the purpose of providing diagnoses or treatment of persons in the custody of such facilities. 5. The department, in accordance with rules for reporting and controlling the spread of disease, as otherwise provided by state law. 6. A health facility or health care provider which procures, processes, distributes, or uses: a. A human body part from a deceased person, with respect to medical information regarding that person; or b. Semen provided prior to July 6, 1988, for the purpose of artificial insemination. 7. Health facility staff committees, for the purposes of conducting program monitoring, program evaluation, or service reviews pursuant to chapters 395 and Authorized medical or epidemiological researchers who may not further disclose any identifying characteristics or information. 9. A person allowed access by a court order which is issued in compliance with the following provisions: a. No court of this state shall issue such order unless the court finds that the person seeking the test results has demonstrated a compelling need for the test results which cannot be accommodated by other means. In assessing compelling need, the court shall weigh the need for disclosure against the privacy interest of the test subject and the public interest which may be disserved by disclosure which deters blood, organ, and semen donation and future human immunodeficiency virus-related testing or which may lead to discrimination. This paragraph shall not apply to blood bank donor records. b. Pleadings pertaining to disclosure of test results shall substitute a pseudonym for the true name of the subject of the test. The disclosure to the parties of the subject s true name shall be communicated confidentially in documents not filed with the court. c. Before granting any such order, the court shall provide the individual whose test result is in question with notice and a reasonable opportunity to participate in the proceedings if he or she is not already a party. d. Court proceedings as to disclosure of test results shall be conducted in camera, unless the subject of the test agrees to a hearing in open court or unless the court determines that a public hearing is necessary to the public interest and the proper administration of justice. e. Upon the issuance of an order to disclose test results, the court shall impose appropriate safeguards against unauthorized disclosure which shall specify the persons who may have access to the information, the purposes for which the information shall be used, and appropriate prohibitions on future disclosure. 10. A person allowed access by order of a judge of compensation claims of the Division of Administrative Hearings. A judge of compensation claims shall not issue such order unless he or she finds that the person seeking the test results has demonstrated a compelling need for the test results which cannot be accommodated by other means. 11. Those employees of the department or of child-placing or child-caring agencies or of family foster homes, licensed pursuant to s , who are directly involved in the placement, care, control, or custody of such test subject and who have a need to know such Copyright Broad and Cassel October 2014 Page 9

10 information; adoptive parents of such test subject; or any adult custodian, any adult relative, or any person responsible for the child s welfare, if the test subject was not tested under subparagraph (b)2. and if a reasonable attempt has been made to locate and inform the legal guardian of a test result. The department shall adopt a rule to implement this subparagraph. 12. Those employees of residential facilities or of community-based care programs that care for developmentally disabled persons, pursuant to chapter 393, who are directly involved in the care, control, or custody of such test subject and who have a need to know such information. 13. A health care provider involved in the delivery of a child can note the mother s HIV test results in the child s medical record. 14. Medical personnel or nonmedical personnel who have been subject to a significant exposure during the course of medical practice or in the performance of professional duties, or individuals who are the subject of the significant exposure as provided in subparagraphs (h) The medical examiner shall disclose positive HIV test results to the department in accordance with rules for reporting and controlling the spread of disease. (f) Except as provided in this section, the identity of a person upon whom a test has been performed is confidential and exempt from the provisions of s (1). No person to whom the results of a test have been disclosed may disclose the test results to another person except as authorized by this subsection and by ss and Whenever disclosure is made pursuant to this subsection, it shall be accompanied by a statement in writing which includes the following or substantially similar language: This information has been disclosed to you from records whose confidentiality is protected by state law. State law prohibits you from making any further disclosure of such information without the specific written consent of the person to whom such information pertains, or as otherwise permitted by state law. A general authorization for the release of medical or other information is NOT sufficient for this purpose. An oral disclosure shall be accompanied by oral notice and followed by a written notice within 10 days, except that this notice shall not be required for disclosures made pursuant to subparagraphs (e)3. and 4. (g) Human immunodeficiency virus test results contained in the medical records of a hospital licensed under chapter 395 may be released in accordance with s without being subject to the requirements of subparagraph (e)2., subparagraph (e)9., or paragraph (f); provided the hospital has obtained written informed consent for the HIV test in accordance with provisions of this section. (h) Notwithstanding the provisions of paragraph (a), informed consent is not required: 1. When testing for sexually transmissible diseases is required by state or federal law, or by rule including the following situations: a. HIV testing pursuant to s of persons convicted of prostitution or of procuring another to commit prostitution. b. HIV testing of inmates pursuant to s prior to their release from prison by reason of parole, accumulation of gain-time credits, or expiration of sentence. c. Testing for HIV by a medical examiner in accordance with s d. HIV testing of pregnant women pursuant to s Those exceptions provided for blood, plasma, organs, skin, semen, or other human tissue pursuant to s For the performance of an HIV-related test by licensed medical personnel in bona fide medical emergencies when the test results are necessary for medical diagnostic purposes to provide appropriate emergency care or treatment to the person being tested and the patient is unable to consent, as supported by documentation in the medical record. Notification of test results in accordance with paragraph (c) is required. 4. For the performance of an HIV-related test by licensed medical personnel for medical diagnosis of acute illness where, in the opinion of the attending physician, obtaining Copyright Broad and Cassel October 2014 Page 10

11 informed consent would be detrimental to the patient, as supported by documentation in the medical record, and the test results are necessary for medical diagnostic purposes to provide appropriate care or treatment to the person being tested. Notification of test results in accordance with paragraph (c) is required if it would not be detrimental to the patient. This subparagraph does not authorize the routine testing of patients for HIV infection without informed consent. 5. When HIV testing is performed as part of an autopsy for which consent was obtained pursuant to s For the performance of an HIV test upon a defendant pursuant to the victim s request in a prosecution for any type of sexual battery where a blood sample is taken from the defendant voluntarily, pursuant to court order for any purpose, or pursuant to the provisions of s , s , or s ; however, the results of any HIV test performed shall be disclosed solely to the victim and the defendant, except as provided in ss , , and When an HIV test is mandated by court order. 8. For epidemiological research pursuant to s , for research consistent with institutional review boards created by 45 C.F.R. part 46, or for the performance of an HIVrelated test for the purpose of research, if the testing is performed in a manner by which the identity of the test subject is not known and may not be retrieved by the researcher. 9. When human tissue is collected lawfully without the consent of the donor for corneal removal as authorized by s or enucleation of the eyes as authorized by s For the performance of an HIV test upon an individual who comes into contact with medical personnel in such a way that a significant exposure has occurred during the course of employment or within the scope of practice and where a blood sample is available that was taken from that individual voluntarily by medical personnel for other purposes. The term medical personnel includes a licensed or certified health care professional; an employee of a health care professional or health care facility; employees of a laboratory licensed under chapter 483; personnel of a blood bank or plasma center; a medical student or other student who is receiving training as a health care professional at a health care facility; and a paramedic or emergency medical technician certified by the department to perform life-support procedures under s a. Prior to performance of an HIV test on a voluntarily obtained blood sample, the individual from whom the blood was obtained shall be requested to consent to the performance of the test and to the release of the results. If consent cannot be obtained within the time necessary to perform the HIV test and begin prophylactic treatment of the exposed medical personnel, all information concerning the performance of an HIV test and any HIV test result shall be documented only in the medical personnel s record unless the individual gives written consent to entering this information on the individual s medical record. b. Reasonable attempts to locate the individual and to obtain consent shall be made, and all attempts must be documented. If the individual cannot be found or is incapable of providing consent, an HIV test may be conducted on the available blood sample. If the individual does not voluntarily consent to the performance of an HIV test, the individual shall be informed that an HIV test will be performed, and counseling shall be furnished as provided in this section. However, HIV testing shall be conducted only after appropriate medical personnel under the supervision of a licensed physician documents, in the medical record of the medical personnel, that there has been a significant exposure and that, in accordance with the written protocols based on the National Centers for Disease Control and Prevention guidelines on HIV postexposure prophylaxis and in the physician s medical judgment, the information is medically necessary to determine the course of treatment for the medical personnel. Copyright Broad and Cassel October 2014 Page 11

12 c. Costs of any HIV test of a blood sample performed with or without the consent of the individual, as provided in this subparagraph, shall be borne by the medical personnel or the employer of the medical personnel. However, costs of testing or treatment not directly related to the initial HIV tests or costs of subsequent testing or treatment may not be borne by the medical personnel or the employer of the medical personnel. d. In order to utilize the provisions of this subparagraph, the medical personnel must either be tested for HIV pursuant to this section or provide the results of an HIV test taken within 6 months prior to the significant exposure if such test results are negative. e. A person who receives the results of an HIV test pursuant to this subparagraph shall maintain the confidentiality of the information received and of the persons tested. Such confidential information is exempt from s (1). f. If the source of the exposure will not voluntarily submit to HIV testing and a blood sample is not available, the medical personnel or the employer of such person acting on behalf of the employee may seek a court order directing the source of the exposure to submit to HIV testing. A sworn statement by a physician licensed under chapter 458 or chapter 459 that a significant exposure has occurred and that, in the physician s medical judgment, testing is medically necessary to determine the course of treatment constitutes probable cause for the issuance of an order by the court. The results of the test shall be released to the source of the exposure and to the person who experienced the exposure. 11. For the performance of an HIV test upon an individual who comes into contact with medical personnel in such a way that a significant exposure has occurred during the course of employment or within the scope of practice of the medical personnel while the medical personnel provides emergency medical treatment to the individual; or notwithstanding s , an individual who comes into contact with nonmedical personnel in such a way that a significant exposure has occurred while the nonmedical personnel provides emergency medical assistance during a medical emergency. For the purposes of this subparagraph, a medical emergency means an emergency medical condition outside of a hospital or health care facility that provides physician care. The test may be performed only during the course of treatment for the medical emergency. a. An individual who is capable of providing consent shall be requested to consent to an HIV test prior to the testing. If consent cannot be obtained within the time necessary to perform the HIV test and begin prophylactic treatment of the exposed medical personnel and nonmedical personnel, all information concerning the performance of an HIV test and its result, shall be documented only in the medical personnel s or nonmedical personnel s record unless the individual gives written consent to entering this information on the individual s medical record. b. HIV testing shall be conducted only after appropriate medical personnel under the supervision of a licensed physician documents, in the medical record of the medical personnel or nonmedical personnel, that there has been a significant exposure and that, in accordance with the written protocols based on the National Centers for Disease Control and Prevention guidelines on HIV postexposure prophylaxis and in the physician s medical judgment, the information is medically necessary to determine the course of treatment for the medical personnel or nonmedical personnel. c. Costs of any HIV test performed with or without the consent of the individual, as provided in this subparagraph, shall be borne by the medical personnel or the employer of the medical personnel or nonmedical personnel. However, costs of testing or treatment not directly related to the initial HIV tests or costs of subsequent testing or treatment may not be borne by the medical personnel or the employer of the medical personnel or nonmedical personnel. d. In order to utilize the provisions of this subparagraph, the medical personnel or nonmedical personnel shall be tested for HIV pursuant to this section or shall provide the results of an HIV test taken within 6 months prior to the significant exposure if such test results are negative. Copyright Broad and Cassel October 2014 Page 12

13 e. A person who receives the results of an HIV test pursuant to this subparagraph shall maintain the confidentiality of the information received and of the persons tested. Such confidential information is exempt from s (1). f. If the source of the exposure will not voluntarily submit to HIV testing and a blood sample was not obtained during treatment for the medical emergency, the medical personnel, the employer of the medical personnel acting on behalf of the employee, or the nonmedical personnel may seek a court order directing the source of the exposure to submit to HIV testing. A sworn statement by a physician licensed under chapter 458 or chapter 459 that a significant exposure has occurred and that, in the physician s medical judgment, testing is medically necessary to determine the course of treatment constitutes probable cause for the issuance of an order by the court. The results of the test shall be released to the source of the exposure and to the person who experienced the exposure. 12. For the performance of an HIV test by the medical examiner or attending physician upon an individual who expired or could not be resuscitated while receiving emergency medical assistance or care and who was the source of a significant exposure to medical or nonmedical personnel providing such assistance or care. a. HIV testing may be conducted only after appropriate medical personnel under the supervision of a licensed physician documents in the medical record of the medical personnel or nonmedical personnel that there has been a significant exposure and that, in accordance with the written protocols based on the National Centers for Disease Control and Prevention guidelines on HIV postexposure prophylaxis and in the physician s medical judgment, the information is medically necessary to determine the course of treatment for the medical personnel or nonmedical personnel. b. Costs of any HIV test performed under this subparagraph may not be charged to the deceased or to the family of the deceased person. c. For the provisions of this subparagraph to be applicable, the medical personnel or nonmedical personnel must be tested for HIV under this section or must provide the results of an HIV test taken within 6 months before the significant exposure if such test results are negative. d. A person who receives the results of an HIV test pursuant to this subparagraph shall comply with paragraph (e). 13. For the performance of an HIV-related test medically indicated by licensed medical personnel for medical diagnosis of a hospitalized infant as necessary to provide appropriate care and treatment of the infant when, after a reasonable attempt, a parent cannot be contacted to provide consent. The medical records of the infant shall reflect the reason consent of the parent was not initially obtained. Test results shall be provided to the parent when the parent is located. 14. For the performance of HIV testing conducted to monitor the clinical progress of a patient previously diagnosed to be HIV positive. 15. For the performance of repeated HIV testing conducted to monitor possible conversion from a significant exposure. * * * * (5) PENALTIES. (a) Any violation of this section by a facility or licensed health care provider shall be a ground for disciplinary action contained in the facility s or professional s respective licensing chapter. (b) Any person who violates the confidentiality provisions of this section and s commits a misdemeanor of the first degree, punishable as provided in s or s (c) Any person who obtains information that identifies an individual who has a sexually transmissible disease including human immunodeficiency virus or acquired Copyright Broad and Cassel October 2014 Page 13

14 immunodeficiency syndrome, who knew or should have known the nature of the information and maliciously, or for monetary gain, disseminates this information or otherwise makes this information known to any other person, except by providing it either to a physician or nurse employed by the department or to a law enforcement agency, commits a felony of the third degree, punishable as provided in s or s Copyright Broad and Cassel October 2014 Page 14

15 Records related to the diagnosis and treatment of an individual's psychological condition, and that are maintained separately within a patient s medical record, are afforded a higher level of confidentiality under HIPAA-HITECH. Mental health records are similarly protected under Florida law, regardless of where in the medical record they are maintained. Because Florida s requirements governing the confidentiality of mental health records are more protective than HIPAA-HITECH s, the state statute is not preempted by HIPAA-HITECH. MENTAL HEALTH Clinical records; confidentiality. (1) A clinical record shall be maintained for each patient. The record shall include data pertaining to admission and such other information as may be required under rules of the department. A clinical record is confidential and exempt from the provisions of s (1). Unless waived by express and informed consent, by the patient or the patient s guardian or guardian advocate or, if the patient is deceased, by the patient s personal representative or the family member who stands next in line of intestate succession, the confidential status of the clinical record shall not be lost by either authorized or unauthorized disclosure to any person, organization, or agency. (2) The clinical record shall be released when: (a) The patient or the patient s guardian authorizes the release. The guardian or guardian advocate shall be provided access to the appropriate clinical records of the patient. The patient or the patient s guardian or guardian advocate may authorize the release of information and clinical records to appropriate persons to ensure the continuity of the patient s health care or mental health care. (b) The patient is represented by counsel and the records are needed by the patient s counsel for adequate representation. (c) The court orders such release. In determining whether there is good cause for disclosure, the court shall weigh the need for the information to be disclosed against the possible harm of disclosure to the person to whom such information pertains. (d) The patient is committed to, or is to be returned to, the Department of Corrections from the Department of Children and Family Services, and the Department of Corrections requests such records. These records shall be furnished without charge to the Department of Corrections. (3) Information from the clinical record may be released in the following circumstances: (a) When a patient has declared an intention to harm other persons. When such declaration has been made, the administrator may authorize the release of sufficient information to provide adequate warning to the person threatened with harm by the patient. (b) When the administrator of the facility or secretary of the department deems release to a qualified researcher as defined in administrative rule, an aftercare treatment provider, or an employee or agent of the department is necessary for treatment of the patient, maintenance of adequate records, compilation of treatment data, aftercare planning, or evaluation of programs. For the purpose of determining whether a person meets the criteria for involuntary outpatient placement or for preparing the proposed treatment plan pursuant to s , the clinical record may be released to the state attorney, the public defender or the patient s private legal counsel, the court, and to the appropriate mental health professionals, including the service provider identified in s (6)(b)2., in accordance with state and federal law. (4) Information from clinical records may be used for statistical and research purposes if the information is abstracted in such a way as to protect the identity of individuals. Copyright Broad and Cassel October 2014 Page 15

16 (5) Information from clinical records may be used by the Agency for Health Care Administration, the department, and the Florida advocacy councils for the purpose of monitoring facility activity and complaints concerning facilities. (6) Clinical records relating to a Medicaid recipient shall be furnished to the Medicaid Fraud Control Unit in the Department of Legal Affairs, upon request. (7) Any person, agency, or entity receiving information pursuant to this section shall maintain such information as confidential and exempt from the provisions of s (1). (8) Any facility or private mental health practitioner who acts in good faith in releasing information pursuant to this section is not subject to civil or criminal liability for such release. (9) Nothing in this section is intended to prohibit the parent or next of kin of a person who is held in or treated under a mental health facility or program from requesting and receiving information limited to a summary of that person s treatment plan and current physical and mental condition. Release of such information shall be in accordance with the code of ethics of the profession involved. (10) Patients shall have reasonable access to their clinical records, unless such access is determined by the patient s physician to be harmful to the patient. If the patient s right to inspect his or her clinical record is restricted by the facility, written notice of such restriction shall be given to the patient and the patient s guardian, guardian advocate, attorney, and representative. In addition, the restriction shall be recorded in the clinical record, together with the reasons for it. The restriction of a patient s right to inspect his or her clinical record shall expire after 7 days but may be renewed, after review, for subsequent 7-day periods. (11) Any person who fraudulently alters, defaces, or falsifies the clinical record of any person receiving mental health services in a facility subject to this part, or causes or procures any of these offenses to be committed, commits a misdemeanor of the second degree, punishable as provided in s or s Copyright Broad and Cassel October 2014 Page 16

17 Unlike HIPAA-HITECH, section release of patient records does not provide broad exceptions for the release of patient information for operations and payment purposes by hospitals and ambulatory surgical centers. Nor does it permit some other disclosures without patient consent that are permitted by HIPAA-HITECH. In this respect, Florida law is more stringent than the federal regulations. HOSPITALS/AMBULATORY CARE CENTERS Patient and personnel records; copies; examination. (1) Any licensed facility shall, upon written request, and only after discharge of the patient, furnish, in a timely manner, without delays for legal review, to any person admitted therein for care and treatment or treated thereat, or to any such person s guardian, curator, or personal representative, or in the absence of one of those persons, to the next of kin of a decedent or the parent of a minor, or to anyone designated by such person in writing, a true and correct copy of all patient records, including X rays, and insurance information concerning such person, which records are in the possession of the licensed facility, provided the person requesting such records agrees to pay a charge. The exclusive charge for copies of patient records may include sales tax and actual postage, and, except for nonpaper records that are subject to a charge not to exceed $2, may not exceed $1 per page. A fee of up to $1 may be charged for each year of records requested. These charges shall apply to all records furnished, whether directly from the facility or from a copy service providing these services on behalf of the facility. However, a patient whose records are copied or searched for the purpose of continuing to receive medical care is not required to pay a charge for copying or for the search. The licensed facility shall further allow any such person to examine the original records in its possession, or microforms or other suitable reproductions of the records, upon such reasonable terms as shall be imposed to assure that the records will not be damaged, destroyed, or altered. (2) This section does not apply to records maintained at any licensed facility the primary function of which is to provide psychiatric care to its patients, or to records of treatment for any mental or emotional condition at any other licensed facility which are governed by the provisions of s (3) This section does not apply to records of substance abuse impaired persons, which are governed by s (4) Patient records are confidential and must not be disclosed without the consent of the patient or his or her legal representative, but appropriate disclosure may be made without such consent to: (a) Licensed facility personnel, attending physicians, or other health care practitioners and providers currently involved in the care or treatment of the patient for use only in connection with the treatment of the patient. (b) Licensed facility personnel only for administrative purposes or risk management and quality assurance functions. (c) The agency, for purposes of health care cost containment. (d) In any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice by the party seeking such records to the patient or his or her legal representative. (e) The agency upon subpoena issued pursuant to s , but the records obtained thereby must be used solely for the purpose of the agency and the appropriate professional board in its investigation, prosecution, and appeal of disciplinary proceedings. If the agency requests copies of the records, the facility shall charge no more than its actual copying costs, including reasonable staff time. The records must be sealed and must not be available to the public pursuant to s (1) or any other statute providing access to records, nor may they be available to the public as part of the record of investigation for and prosecution in disciplinary proceedings made available to the public by the agency or Copyright Broad and Cassel October 2014 Page 17

18 the appropriate regulatory board. However, the agency must make available, upon written request by a practitioner against whom probable cause has been found, any such records that form the basis of the determination of probable cause. (f) The Department of Health or its agent, for the purpose of establishing and maintaining a trauma registry and for the purpose of ensuring that hospitals and trauma centers are in compliance with the standards and rules established under ss , , , , , and , and for the purpose of monitoring patient outcome at hospitals and trauma centers that provide trauma care services. (g) The Department of Children and Family Services or its agent, for the purpose of investigations of cases of abuse, neglect, or exploitation of children or vulnerable adults. (h) A local trauma agency or a regional trauma agency that performs quality assurance activities, a panel or committee assembled to assist a local trauma agency, or a regional trauma agency performing quality assurance activities. Patient records obtained under this paragraph are confidential and exempt from s (1) and s. 24(a), Art. I of the State Constitution. (i) Organ procurement organizations, tissue banks, and eye banks required to conduct death records reviews pursuant to s (j) The Medicaid Fraud Control Unit in the Department of Legal Affairs pursuant to s (k) The Department of Financial Services, or an agent, employee, or independent contractor of the department who is auditing for unclaimed property pursuant to chapter 717. (l) A regional poison control center for purposes of treating a poison episode under evaluation, case management of poison cases, or compliance with data collection and reporting requirements of s and the professional organization that certifies poison control centers in accordance with federal law. (5) The Department of Health may examine patient records of a licensed facility, whether held by the facility or the Agency for Health Care Administration, for the purpose of epidemiological investigations. The unauthorized release of information by agents of the department which would identify an individual patient is a misdemeanor of the first degree, punishable as provided in s or s (6) Patient records shall contain information required for completion of birth, death, and fetal death certificates. (7)(a) If the content of any record of patient treatment is provided under this section, the recipient, if other than the patient or the patient s representative, may use such information only for the purpose provided and may not further disclose any information to any other person or entity, unless expressly permitted by the written consent of the patient. A general authorization for the release of medical information is not sufficient for this purpose. The content of such patient treatment record is confidential and exempt from the provisions of s (1) and s. 24(a), Art. I of the State Constitution. (b) Absent a specific written release or authorization permitting utilization of patient information for solicitation or marketing the sale of goods or services, any use of that information for those purposes is prohibited. (8) Patient records at hospitals and ambulatory surgical centers are exempt from disclosure under s (1), except as provided by subsections (1)-(5). Copyright Broad and Cassel October 2014 Page 18

19 Substance abuse treatment records are afforded a heightened level of protection under Florida law. The confidentiality requirements of section are not as restrictive as the federal protections under 42 CFR 2.01, et seq. Unlike the federal regulations, however, Florida s protections apply to all substance abuse treatment providers. SUBSTANCE ABUSE TREATMENT Rights of individuals. Individuals receiving substance abuse services from any service provider are guaranteed protection of the rights specified in this section, unless otherwise expressly provided, and service providers must ensure the protection of such rights. * * * * (7) RIGHT TO CONFIDENTIALITY OF INDIVIDUAL RECORDS. (a) The records of service providers which pertain to the identity, diagnosis, and prognosis of and service provision to any individual are confidential in accordance with this chapter and with applicable federal confidentiality regulations and are exempt from s (1) and s. 24(a), Art. I of the State Constitution. Such records may not be disclosed without the written consent of the individual to whom they pertain except that appropriate disclosure may be made without such consent: 1. To medical personnel in a medical emergency. 2. To service provider personnel if such personnel need to know the information in order to carry out duties relating to the provision of services to an individual. 3. To the secretary of the department or the secretary s designee, for purposes of scientific research, in accordance with federal confidentiality regulations, but only upon agreement in writing that the individual s name and other identifying information will not be disclosed. 4. In the course of review of service provider records by persons who are performing an audit or evaluation on behalf of any federal, state, or local government agency, or thirdparty payor providing financial assistance or reimbursement to the service provider; however, reports produced as a result of such audit or evaluation may not disclose names or other identifying information and must be in accordance with federal confidentiality regulations. 5. Upon court order based on application showing good cause for disclosure. In determining whether there is good cause for disclosure, the court shall examine whether the public interest and the need for disclosure outweigh the potential injury to the individual, to the service provider and the individual, and to the service provider itself. (b) The restrictions on disclosure and use in this section do not apply to communications from provider personnel to law enforcement officers which: 1. Are directly related to an individual s commission of a crime on the premises of the provider or against provider personnel or to a threat to commit such a crime; and 2. Are limited to the circumstances of the incident, including the status of the individual committing or threatening to commit the crime, that individual s name and address, and that individual s last known whereabouts. (c) The restrictions on disclosure and use in this section do not apply to the reporting of incidents of suspected child abuse and neglect to the appropriate state or local authorities as required by law. However, such restrictions continue to apply to the original substance abuse records maintained by the provider, including their disclosure and use for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect. (d) Any answer to a request for a disclosure of individual records which is not permissible under this section or under the appropriate federal regulations must be made in a way that will not affirmatively reveal that an identified individual has been, or is being diagnosed or Copyright Broad and Cassel October 2014 Page 19

20 treated for substance abuse. The regulations do not restrict a disclosure that an identified individual is not and has never received services. (e)1. Since a minor acting alone has the legal capacity to voluntarily apply for and obtain substance abuse treatment, any written consent for disclosure may be given only by the minor. This restriction includes, but is not limited to, any disclosure of identifying information to the parent, legal guardian, or custodian of a minor for the purpose of obtaining financial reimbursement. 2. When the consent of a parent, legal guardian, or custodian is required under this chapter in order for a minor to obtain substance abuse treatment, any written consent for disclosure must be given by both the minor and the parent, legal guardian, or custodian. (f) An order of a court of competent jurisdiction authorizing disclosure and use of confidential information is a unique kind of court order. Its only purpose is to authorize a disclosure or use of identifying information which would otherwise be prohibited by this section. Such an order does not compel disclosure. A subpoena or a similar legal mandate must be issued in order to compel disclosure. This mandate may be entered at the same time as, and accompany, an authorizing court order entered under this section. (g) An order authorizing the disclosure of an individual s records may be applied for by any person having a legally recognized interest in the disclosure which is sought. The application may be filed separately or as part of a pending civil action in which it appears that the individual s records are needed to provide evidence. An application must use a fictitious name, such as John Doe or Jane Doe, to refer to any individual and may not contain or otherwise disclose any identifying information unless the individual is the applicant or has given a written consent to disclosure or the court has ordered the record of the proceeding sealed from public scrutiny. (h) The individual and the person holding the records from whom disclosure is sought must be given adequate notice in a manner which will not disclose identifying information to other persons, and an opportunity to file a written response to the application, or to appear in person, for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order. (i) Any oral argument, review of evidence, or hearing on the application must be held in the judge s chambers or in some manner which ensures that identifying information is not disclosed to anyone other than a party to the proceeding, the individual, or the person holding the record, unless the individual requests an open hearing. The proceeding may include an examination by the judge of the records referred to in the application. (j) A court may authorize the disclosure and use of records for the purpose of conducting a criminal investigation or prosecution of an individual only if the court finds that all of the following criteria are met: 1. The crime involved is extremely serious, such as one which causes or directly threatens loss of life or serious bodily injury, including but not limited to homicide, sexual assault, sexual battery, kidnapping, armed robbery, assault with a deadly weapon, and child abuse and neglect. 2. There is reasonable likelihood that the records will disclose information of substantial value in the investigation or prosecution. 3. Other ways of obtaining the information are not available or would not be effective. 4. The potential injury to the individual, to the physician-individual relationship, and to the ability of the program to provide services to other individuals is outweighed by the public interest and the need for the disclosure. * * * * Copyright Broad and Cassel October 2014 Page 20