Post on 27-Mar-2015
Mental Health Issues & Mental Health Issues & Information SharingInformation Sharing
Professor Peter P. SwireProfessor Peter P. Swire
The Ohio State UniversityThe Ohio State University
NAAG Task Force on School SafetyNAAG Task Force on School Safety
July 5, 2007 July 5, 2007
OverviewOverview My backgroundMy background When does information sharing actually help?When does information sharing actually help? HIPAAHIPAA FERPAFERPA Reasons to do due diligence before assuming Reasons to do due diligence before assuming
that information sharing has net benefitsthat information sharing has net benefits
My BackgroundMy Background
Currently:Currently: Moritz College of Law, Ohio State U.Moritz College of Law, Ohio State U. Senior Fellow, Center for American ProgressSenior Fellow, Center for American Progress Research on privacy, consumer protection, Research on privacy, consumer protection,
computer security & homeland securitycomputer security & homeland security 1999 to early 2001:1999 to early 2001:
Chief Counselor for Privacy, OMBChief Counselor for Privacy, OMB White House coordinator, HIPAA privacy ruleWhite House coordinator, HIPAA privacy rule Led HIPAA/FERPA processLed HIPAA/FERPA process
I. When Will Info Sharing Help?I. When Will Info Sharing Help?
2006 article 2006 article Privacy & Information Sharing in the Privacy & Information Sharing in the War Against TerrorismWar Against Terrorism Due diligence list for proposed info sharingDue diligence list for proposed info sharing Often, undue optimism that good things will Often, undue optimism that good things will
happen with info sharinghappen with info sharing Be careful what you wish for …Be careful what you wish for …
Be Careful What You Wish ForBe Careful What You Wish For
Suppose state AGs received reports on:Suppose state AGs received reports on: Every troubled or depressed youthEvery troubled or depressed youth Every suspicious gun purchaseEvery suspicious gun purchase Every threat by a teen against anotherEvery threat by a teen against another
If State AGs Get the DataIf State AGs Get the Data
If you receive the information, what do you If you receive the information, what do you do with it?do with it? Investigate every lead?Investigate every lead? Is that a good use of resources?Is that a good use of resources? The problem of “false positives” and a quick The problem of “false positives” and a quick
check (that you can afford) won’t be good at check (that you can afford) won’t be good at telling the one in ten thousand that is truly telling the one in ten thousand that is truly dangerousdangerous
If State AGs Get the DataIf State AGs Get the Data
What if you receive the info but do nothing What if you receive the info but do nothing with it?with it? The wasted resources to create an The wasted resources to create an
information sharing system that is not usedinformation sharing system that is not used When the next thing goes wrong, lots of finger When the next thing goes wrong, lots of finger
pointing about why nothing was done to pointing about why nothing was done to prevent the incidentprevent the incident
In short, do info sharing if and only if there In short, do info sharing if and only if there are net benefits, after due diligenceare net benefits, after due diligence
II. HIPAA BasicsII. HIPAA Basics
HIPAA applies only to “covered entities”HIPAA applies only to “covered entities” For your purposes, providers and health For your purposes, providers and health
insurers (as well as their business associates)insurers (as well as their business associates) Others who create or transmit health care Others who create or transmit health care
data are not covereddata are not covered State public health agencies broadly State public health agencies broadly
exemptedexempted But often have state or local laws that are But often have state or local laws that are
stricter, and they may limit sharingstricter, and they may limit sharing
Disclosure from Covered EntitiesDisclosure from Covered Entities
Basic rule – disclosure from covered entities Basic rule – disclosure from covered entities only with patient authorization (an “opt in”)only with patient authorization (an “opt in”)
Some important exceptionsSome important exceptions ““Required by law” – gunshot wounds & other Required by law” – gunshot wounds & other
required reportsrequired reports Disclosure to public health agenciesDisclosure to public health agencies Legal proceedings – a judge can orderLegal proceedings – a judge can order Law enforcement access, usually with an Law enforcement access, usually with an
administrative subpoenaadministrative subpoena
HIPAA & Mental HealthHIPAA & Mental Health
““Psychotherapy notes” are more strictly Psychotherapy notes” are more strictly protectedprotected Follows Jaffee v. Redmond and stronger Follows Jaffee v. Redmond and stronger
privilege for psychotherapy careprivilege for psychotherapy care Many HIPAA exceptions don’t applyMany HIPAA exceptions don’t apply
Not the usual law enforcement accessNot the usual law enforcement access Not the usual judge-order court accessNot the usual judge-order court access Strong idea of “privilege” in order to assure Strong idea of “privilege” in order to assure
patient openness in therapypatient openness in therapy
HIPAA & Mental HealthHIPAA & Mental Health
Sometimes disclosure is permittedSometimes disclosure is permitted Tarasoff situation – “in order to prevent or Tarasoff situation – “in order to prevent or
lessen the risk of a serious or imminent threat lessen the risk of a serious or imminent threat to the health or safety of a person or the to the health or safety of a person or the public”public”
Scope of “psychotherapy notes”, though, Scope of “psychotherapy notes”, though, is limitedis limited Are notes kept separate from a patient’s Are notes kept separate from a patient’s
standard medical filestandard medical file
III. FERPA IssuesIII. FERPA Issues
Family Educational Right to Privacy Act of Family Educational Right to Privacy Act of 1974 (FERPA)1974 (FERPA)
Basic rule is opt-in consent for disclosure Basic rule is opt-in consent for disclosure of “educational records”of “educational records” GradesGrades Disciplinary proceedings, etc.Disciplinary proceedings, etc.
No special rules for mental health under No special rules for mental health under FERPAFERPA
The School Nurse & FERPAThe School Nurse & FERPA
Medical records typically are “educational records” under Medical records typically are “educational records” under FERPA and are disclosed only with parent consentFERPA and are disclosed only with parent consent Student consent once 18 or post-secondaryStudent consent once 18 or post-secondary
NotNot “educational records” when “are made or maintained “educational records” when “are made or maintained by a physician, psychiatrist, psychologist, or other by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the only in connection with the provision of treatment to the student, and are not available to anyone other than student, and are not available to anyone other than persons providing such treatment”persons providing such treatment”
Those records are likely to be covered by HIPAAThose records are likely to be covered by HIPAA
HIPAA & FERPAHIPAA & FERPA
We did not want the school nurse to have to We did not want the school nurse to have to comply with both HIPAA & FERPAcomply with both HIPAA & FERPA
HIPAA says doesn’t count as protected health HIPAA says doesn’t count as protected health information if it is covered by FERPAinformation if it is covered by FERPA
In practice, colleges now often are HIPAA; pre-In practice, colleges now often are HIPAA; pre-college usually are FERPAcollege usually are FERPA
AG Access to School RecordsAG Access to School Records
Both HIPAA & FERPA have basic rule of opt-in Both HIPAA & FERPA have basic rule of opt-in consent for disclosureconsent for disclosure
FERPA allows disclosure pursuant toFERPA allows disclosure pursuant to Court order, orCourt order, or Subpoena with prior notice to the familySubpoena with prior notice to the family
HIPAA, as discussed above, is stricter for HIPAA, as discussed above, is stricter for psychotherapypsychotherapy Otherwise administrative subpoena usually Otherwise administrative subpoena usually
worksworks
ConclusionConclusion Be careful what you wish for when it comes to Be careful what you wish for when it comes to
information sharinginformation sharing Target real needs, and realize downsides of Target real needs, and realize downsides of
false positives, computer security obligations if false positives, computer security obligations if you run a system, and privacy invasionsyou run a system, and privacy invasions
Are other approaches better, such as better Are other approaches better, such as better coordination with campus police?coordination with campus police?
Thank youThank you
Contact InformationContact Information
Phone: (240) 994-4142Phone: (240) 994-4142 Email: Email: peter@peterswire.net Web: Web: www.peterswire.net ““Privacy & Information Sharing in the War Privacy & Information Sharing in the War
Against Terrorism” at Against Terrorism” at http://ssrn.com/abstract=899626