 |
|
Privacy Clarification
November 5, 2003
Issued jointly by CAF and the DHS Privacy Program
Protection of private information is in the spotlight. We see this in our own lives when we visit our doctor, dentist or pharmacy and in the many privacy notices we get from our insurance companies, credit card companies, banks, etc. As employees of the Department of Human Services, we also have an increased awareness of privacy for the people we serve.
I. Use & Disclosure of Alcohol/Drug and Mental Health Client Information; Sharing Across DHS Programs
There has been some confusion about circumstances under which Alcohol and Drug (A&D) and Mental Health (MH) treatment information may be shared across CAF programs. For example, when can Self-Sufficiency disclose A&D and MH information to Child Welfare?
II. Clarification
The laws around use and disclosure of A&D and MH information are not new. These laws existed prior to HIPAA and were not substantially changed by HIPAA.
- A client has the right to authorize use and disclosure of A&D or MH treatment information to “DHS”, or to a specific program within DHS, such as Self-Sufficiency, or to a specific person (name or title).
- A&D and MH treatment information may be disclosed only to the entity (such as DHS), program (such as Self-Sufficiency or Child Welfare) or the person (name or title) and only for the specific purpose listed on the DHS 2099 (authorization form).
- A client has the right to informed consent when filling out the authorization form (DHS 2099). Informed consent means the case manager or other CAF staff has told the client he or she may disclose A&D and MH information to “DHS” as a whole or may limit disclosure to a specific program such as Self-Sufficiency.
- In all circumstances, any use or disclosure should be limited to only that information which is reasonably necessary to fulfill the purpose of the request.
- Exception: For the purposes of mandatory reporting and abuse investigations, A&D and MH treatment information may be disclosed to Child Welfare even if the client has not signed a release authorizing disclosure.
Back to top
III. A&D and Mental Health Privacy Law
The clarification above is found in federal A&D law (42 CFR part 2) and state MH law (ORS 179.505). The answer is not found in HIPAA privacy policies or regulations.
Some elements of A&D federal law (42 CFR part 2) and MH state law (ORS 179.505) regarding use and disclosure of A&D and MH treatment information are stricter than HIPAA. Under HIPAA, the stricter law applies. This means that even if HIPAA would allow broader use and disclosure of A&D/MH information, the stricter A&D and MH law must be followed.
Federal law 42 CFR part 2 prohibits unauthorized use, disclosure and redisclosure of A&D treatment information. State law ORS 179.505 prohibits unauthorized use, disclosure and redisclosure of MH information. These laws:
- Give a client the right to restrict to what entity or person and for what purpose treatment information may be disclosed.
- Require that the client’s right to limit use and disclosure of A&D and MH information be communicated to the client.
- Prohibit redisclosure of A&D and MH treatment information without the specific authorization of the client.
- Allow a client to authorize use and disclosure of information by filling out and signing a release (such as the DHS 2099) that includes the:
- Name of the person or program making the disclosure.
- Name or title of the individual or the organization to which disclosure is to be made.
- Name of the client.
- Purpose of the disclosure, which must be specific.
- How much and what kind of information is to be disclosed.
Reminder: The purpose of the use and disclosure must be specific to the individual or organization to which the information will be disclosed. If the purpose changes, or is no longer applicable to the individual or organization named on the authorization form to receive the information, the client must complete a new authorization before the information may be disclosed.
Back to top
IV. Oregon Administrative Rule and DHS Privacy Policy
- OAR 410-014-0020 (4)(a) states that pursuant to 42 CFR part 2, “DHS may not make further disclosure of. . .alcohol and drug rehabilitation information without the specific written authorization of the individual.”
- OAR 410-014-0020 (4)(b) states that “DHS is subject to the restrictions in ORS 179.505 regarding disclosure of information regarding clients of publicly funded mental health or developmental disability providers.”
- Section (3)(b) of DHS Privacy Policy AS-100-03, Use and Disclosure of Client or Participant Information, states that “internal communication within DHS is permitted without individual authorization. . .” with the exception that “alcohol and drug, mental health and vocational rehabilitation record disclosure may be limited to particular program areas named on the authorization form. If such a limitation is noted on the authorization form, disclosure is limited to the parties named.”
Reminder: The client’s right to limit use and disclosure of A&D and MH information must be communicated to the client.
Back to top
V. Summary
CAF staff must get a client’s authorization before using and disclosing A&D and MH treatment information (see exception above). A client has the right to authorize use and disclosure of this information to all DHS, to a specific program within DHS, or to a particular person.
A client has the right to informed consent when filling out the authorization form (DHS 2099) for use and disclosure of A&D or MH treatment information. This means that the case manager or other CAF staff must tell the client he or she has the right to limit use and disclosure of this information. The purpose of the disclosure must be specific.
If A&D or MH treatment information is used and disclosed more broadly than the client has authorized on the DHS 2099, the person using the information or making the disclosure may be in violation of federal or state law.
DHS staff may submit questions regarding DHS Privacy Policies and completion
of the DHS 2099 authorization form to dhs.privacyhelp@state.or.us.
This email address can be found in the GroupWise address book at PrivacyHelp,
DHS. The DHS Privacy Officer is Jane Alm and the Privacy Program phone number
is 503-945-5780.
Contacts
Back to top
|
|
