How to Create and Update Your Agency’s HIV Confidentiality Policies & Procedures and Ensure Staff...

How to Create and Update Your Agency’s HIV Confidentiality Policies & Procedures and Ensure Staff Compliance

6.25.14

2

Technical difficulties?

Call 212-243-1313 with technical problems during webinar OR

Click on “chat” icon – bottom left of your screen

3

Who is Your Trainer?

Sally Friedman, Esq.

Legal Action Center

Who is the Legal Action Center? Non-profit law & policy organization

Anti-discrimination & privacy work Substance Use Disorders HIV/AIDS Criminal Records

Legal services, litigation, policy, technical assistance

Legal A

ction C

ente

r

4

How to get help?

Website has many resources! www.lac.org Free publications, free webinars and more

Call with questions about privacy or discrimination relating to HIV/AIDS, substance use disorders, and/or criminal records – (212) 243-1313

Refer clients (see services on next slide)5

Legal A

ction C

ente

r

6

Free Legal ServicesIncluding – HIV testing & confidentiality

Discrimination based on: HIV status Alcohol/drug history Criminal record –

Rap sheet review and error correction Certificates of Relief and Good Conduct Job & Housing Discrimination

Visit LAC on Facebook:

https://www.facebook.com/pages/Legal-Action-Center/117162234980967

And

Twitter: https://twitter.com/lac_news

8

Background

Why are you here?

9

First, some legal background

The New York State HIV Confidentiality Law – Article 27-F of the Public Health Law – protects the confidentiality of HIV-related information about people who receive services from most health care or social services providers in New York.

Your agency must comply with Article 27-F’s confidentiality requirements.

10

Some legal background (cont.)

Regulations implementing Article 27-F require providers subject to the law to: establish HIV confidentiality policies and

procedures, and review/update at least annually

require all staff to understand & follow them, ensure – and document – that all employees

receive initial training on HIV confidentiality before they have access to HIV-related information.

More….

11

Some legal background (cont.)

Update staff if changes in law or regulations. Per 2012 change in DOH regulations, staff

update only required if change in relevant law or regulations. But annual updates make sense to ensure staff compliance.

April 1, 2014: slight change in the law (more on that later) -- so updates are required.

12

First, some legal background

If your someone in your agency violates the confidentiality law, your agency could be liable.

So you’ll want to get and keep your staff educated about HIV confidentiality requirements.

13

Goals of training

Goals of initiative: help your agency develop in-house capacity to ensure –

Your HIV Confidentiality Policies and Procedures are in place, up to par, and updated at least annually, AND

Staff responsible for your organization’s HIV confidentiality training are ready and able to accomplish this successfully.

14

This HIV confidentiality capacity-building initiative: Target audience

This training is for –

Program directors, managers, and supervisors or staff responsible for –

developing and updating your agency’s HIV confidentiality policies and procedures, or

educating staff about HIV confidentiality.

15

By end of training, you should be able to . . .

State the major requirements of the NYS HIV confidentiality law (and HIPAA, if your agency must comply with it, too)

Develop (or update) your agency’s own HIV Confidentiality Policies and Procedures to comply with HIV confidentiality law

and…

16

By end of training, you should be able to. . . (cont.)

Conduct annual review and update of your agency’s HIV Confidentiality Policies and Procedures;

Know resources for the initial HIV staff training;

Conduct simple, annual reminders for staff about HIV confidentiality law and policies that should improve compliance.

17

This training is NOT about

HIV testing

But note change in law as of April 1, 2014:

No longer need written informed consent for HIV test except in correctional facilities.

See DOH hand-outs for more information.

18

Hand-outs

You should have received:

If you didn’t download them, get them by clicking on second icon from the left in the bottom left corner of screen. Looks like a computer monitor.

Also on www.lac.org – click on “trainings” – “training materials” – “HIV.” Many are also in “free publications” – “HIV.”

19

Hand-outs (cont.)

This PowerPoint Model HIV Confidentiality Policies &

Procedures for HIV/AIDS Service Providers in New York State – PRINT THIS OUT FOR WEBINAR

DOH Dear Colleague Letter 5/2/14 NYS HIV Testing Law Update May 2014 AI Technical Assistance Bulletin – DOH-5032

More…

20

Hand-outs (cont.)

Q&A – DOH-2557Technical Assistance Bulletin – HIPAA Compliant Authorization….. (2005)Flow chartHIPPA Compliance ChecklistHIPAA Info Sheet for HIV Providers-NYSHIV Confidentiality Case Studies

21

Hand-outs (cont.)

HIV/AIDS Testing, Confidentiality & Discrimination (2012 revision) with 2014 supplement – must have!

New York State’s HIV Confidentiality Law and Federal HIPAA: A Summary for HIV/AIDS Providers

Other resources

HIV/AIDS Confidentiality Law Overview

Free webinar available 24/7 through AIDS Institute Clinical Education Initiative:

http://www.ceitraining.org/resources/audio-video.cfm

22

23

Step 1

Your Agency’s Policies & Procedures:

How to Create & Implement Them

24

Your policies & procedures – purpose

Your agency is required to put in place policies and procedures to –

Maintain confidentiality of HIV related information, and

Assure that confidential HIV related information is disclosed only when appropriate and in accordance with the Article 27-F and the regulations that govern your agency.

25

Your policies & procedures – preliminary steps

1. Determine how/when the confidentiality law applies to your agency (Model Policies & Procedures, p.3):

Health and social service provider? See App. 3 of Model Policies & Procedures

If not – have a contract with the AIDS Institute requiring compliance with Art. 27-F?

26

Your policies & procedures – preliminary steps (cont.)

If not (neither “health or social service provider” or contract with AIDS Institute) –

then only requirement to comply with Art. 27-F is: when receive HIV-related information through written release.

27


2. Determine which confidentiality regulations apply to your agency.

1. Which state agency regulates your agency?2. Which regulations apply?

1. Example: DOH regulations – Part 63

28


3. Decide on terminology you will use in your Polices & Procedures.

1. “Confidential HIV-related information” (Art. 27-F term) or “Personal health information” (“PHI”) (term AI uses in App. F)

2. “Capacity to consent”

3. Anything else?

29

Your policies & procedures – requirements

Required Components

1. Training & Updating2. Internal communications protocols3. Protocols to safeguard security of

confidential records & information

and……

30

Your policies & procedures – requirements (cont.)

Required Components (cont.)

4. Protocols for handling requests by other parties for HIV-related information

5. Anti-discrimination provisions

We’ll discuss these more later…

31

Your policies & procedures – content

Suggested components

Introduction:1. Purpose2. Confidentiality policy3. Staff responsible4. Definitions

See Model Policies & Procedures, p. 5

32

Your policies & procedures – content (cont.)

Required Components

1. Training & updating:

Policies & procedures to educate all staff on –

New York’s HIV confidentiality law, and

Your agency-specific HIV confidentiality policies and procedures.

33


1. Training & updating: (cont.)

Policy must require – Annual review and update of agenc

y ’s HIV Confidentiality Policies and Procedures, and

Initial employee orientation and updates when relevant law/reg. changes

Designate staff responsible for both.

34


1. Training & updating (cont.)

Maintain list of all employees who have received such training.

Include volunteers and peers who have access to HIV-related information.

Extent of training will depend on how much access they have and extent of work they do.

35



Obtain/update employee attestations: Have received this training. Have read and will abide by agency’s

HIV Confidentiality Policies and Procedures. See sample attestation – App. 4 of Model

Policies & Protocols

36



Volunteers and peers should sign attestations too.

37



Inform your agency’s contractors providing services in which HIV related information might be disclosed:

That they must follow the confidentiality requirements.

More…

38



(contractors, cont.)

Advisable to highlight the requirement verbally

Could provide contractor with literature about Article 27-F

Document that you have done so. Include this in the contract and/or MOU

39


1. Training & updating(cont.)

OPTIONAL: Provision – “Educating Clients about HIV

Confidentiality Policy & Rights”

See Model Policies & Procedures, p.7

40


2. Internal communications protocols:

Develop “need to know” protocol & list. (See Model Policies & Procedures, App. 5, p. 33):

Protocol: Limit access to and disclosure of HIV-related information to authorized employees who reasonably need access to perform designated job duties/functions. Specify any limits on access.

More…..

41


2. Internal communications protocols:

Develop “need to know” protocol & list (cont.)

List job titles/functions within those job titles for which employees are authorized to access confidential HIV related information: your “need to know” list.

42


2. Internal communications protocols (cont.)

Distribute “need to know” list to all employees during employee education sessions.

Require that only those staff who received such education may have access to confidential HIV-related information while performing the authorized functions specified in your “need to know” list.

43


2. Internal communications protocols (cont.)

For agencies only bound by Art. 27-F because of AIDS Institute contract,

Add provision about internal release form. (Model Policies & Procedures, p. 8)

44


3. Protocols to safeguard security of confidential records & information:

Ensure that records containing confidential HIV related information, including records that are stored electronically, are:

Maintained securely, and Used only for the purpose intended.

See Model Policies & Protocols, p. 9

more…..

45


3. Protocols to safeguard security of confidential records & information (cont.):

Cover “conversations about clients”

See ideas in Model Policies & Procedures, p. 10

Cover how to contact clients at home. (see next slide)

46



Case scenario/poll

Jane is a social worker at the Help Center (serves HIV+ clients and others). She calls her client, Tom, at home. Someone else answers and says Tom isn’t home.

How can Jane leave a message without violating Article 27-F?

47



Possible answers:

1. Please have Tom call Jane.2. Please have Tom call Jane at the Help Center.3. Please tell Tom to call Jane about his HASA

appointment. 4. 1 or 2. 5. None of the above.

48



Correct answer: #4: 1 or 2Disclosing “HASA” appt = disclosure of HIV-related information. Tom would need to sign an HIV-specific release form.

OK to mention the “Help Center. Would be different if Jane worked at the “HIV Help Center.”

49



Cover written, electronic (fax & email) & oral communications, including through mobile devices and remote access.

See ideas in Model Policies & Procedures, pp. 10-11.

50


4. Protocols for handling requests by other parties for confidential HIV-related information. Cover:

When you have a release – or can get one

DOH releases – June 2011.

Provide “notice prohibiting redisclosure” (See App. 6, Model Policies & Procedure)

See Model Policies & Protocols, p. 13

51


4. Protocols for handling requests by other parties for confidential HIV-related information (cont.). Cover:

Requests when there is no release: Is there some other authorization under Art. 27-

F? (See slides, below.)

Special procedure for subpoenas: Redact HIV information? Withhold that part of the record?

52


4. Protocols for handling requests by other parties for confidential HIV-related information (cont.)

Guidelines could also apply to disclosures your agency needs/decides to make (as opposed to at 3rd party’s request)

more…..

53


Disclosures without a release – to health care providers Case scenario/poll

Jan has seen primary care doctor since HIV diagnosis three years ago.

Primary care doctor now plans to refer her to a specialist.

Does doctor’s office need HIV release form to disclose Jan’s HIV status to specialist?

54


Disclosures without a release – to health care providers

Possible answers:

1. Yes2. No

Disclosures to Health Care Providers (cont.)

Correct Answer: No May disclose HIV related information – without

release – to outside health care provider/facility when necessary for that health care provider/facility to know the HIV information in order to provide appropriate care or treatment to:

1. The protected individual, or2. His or her child, or3. His or her contact (spouse, sex

or needle-sharing partner).

5555

Disclosures to Health Care Providers (cont.)

Answer (cont.). Here –

Knowing Jan’s HIV status is necessary for specialist to give her appropriate care.

Some agency policies require a written release anyway in non-emergency situations because they consider it good practice.

DOH recommends that CBOs ask for a release. See Model Policies & Protocols p. 15

5656

57


Disclosures without a release (cont.)–

Physicians’ disclosures about Minors & Incompetent Adults:

Applies only if physicians on staff

See Model Policies & Protocols pp. 15-16

58



To “Contacts” (sexual or needle-sharing partners) – if agency is not a mandated case reporter

Provisions will vary depending on whether have physician on staff


59



To public health authorities for HIV/AIDS case reporting

Only if agency is mandated HIV case reporter under Public Health Law Sec. 2130 See Model Policies & Protocols p. 19

continued….

60



CHANGE IN LAW as of 4/1/14:

DOH may use the information for “linkage and

retention in care” and redisclose (NEW) Share between local/state health

departments and health care providers currently treating the patient.

61



To oversight authorities for program monitoring, evaluation, & review


62



Occupational exposure

Only include this provision in certain occupational settings

Ex: medical or dental offices, emergency response functions performed, facilities regulated by various state agencies

See Model Policies & Protocols p. 20

63



Disclosures to insurers for health care reimbursement

Only include if your agency is a health care provider/facility seeking reimbursement for health care services from private or public insurers


64


5. Anti-discrimination provision:

Policy prohibiting employees, agents, and contractors from discriminating against persons having or suspected of having HIV infection.


65


Optional: Grievance procedures

Not required by Art. 27-F, though highly recommended

HIPAA does require patient complaint process

See Model Policies & Procedures, p. 23

66

Helpful resources for Step 1

Legal Action Center resources:

Model HIV Confidentiality Policies and Procedures for Human Service Providers in New York State –

Periodically get updated, so check www.lac.org (free publications) each year

67

Helpful resources for Step 1 (cont.)

More LAC resources:

Hand-outs for this training

LAC’s website: www.lac.org (click on Training)

Call LAC’s HIV Confidentiality Hotline 212-243-1313 or 800-223-4044 Ask for the attorney on call

68

Helpful resources for Step 1 (cont.)

NYS Dept. of Health & AIDS Institute resources: Hand-outs for this training

DOH/AIDS Institute websites: www.health.state.ny.us – and go from there!

DOH Confidentiality Hotline: 800-962-5065

Your AIDS Institute contract manager and other staff.

69

Step 2 – Your Annual Review

So How Do You Conduct an Annual

Policy Review?

70

How to conduct your annual policy review

Review your agency’s existing HIV Confidentiality Policies & Procedures:

Identify gaps, needed additions or changes: Elicit input from both new and experienced

staff Assess what your on-the-ground experience

has taught you over the past year

More…

71

How to conduct your annual policy review

Look to what the future will likely bring

Any changes in law? Ask Legal Action Center or visit AI website.

Update your policy accordingly

72

How to conduct your annual policy review (cont.)

Also update, as needed, your agency’s Need-to-know list

Employee attestation forms

Other documents required to document your agency’s continuing compliance with Article 27-F’s HIV confidentiality requirements

73

Step 3: Staff Training

How to Train & Update Your Staff?

74

Initial Staff Training

Remember: all employees must receive HIV confidentiality training before get access to HIV-related information

Options: Send staff to trainings by RTCs/COEs

Have staff watch 1-hour webinar, “HIV/AIDS Confidentiality Law Overview” created by LAC. Available at:http://www.ceitraining.org/cme/ more…

75

Initial Staff Training

Options (cont.):

Conduct your own training.

LAC can provide model PowerPoint. Use hand-outs from this training.

76

How to provide staff updates

Remember: DOH regulations require updates whenever there are changes to relevant laws or regulations.

Smart practice to provide some type of annual reminder even if law/regs haven’t changed.

77

How to provide staff updates (cont.)

Prepare

1. Seek staff input in advance

issues to be covered, questions about existing agency policies & procedures and the HIV law. The responses will inform the nature of the training required.

2. Consider type of reminder/update you need……

78


Option One: simplest

Send email:

Highlight key components of HIV confidentiality policies & procedures & attach them

Note any changes in policies/procedures or law

Note any problems/issues that have arisen in the past year

79


Option Two: still simple

Send email described in Option 1 Also convene in-person meeting:

Conduct Review of Agency’s HIV Confidentiality Policies & Procedures:1. Key components 2. Changes since last Annual Update

Opportunity for Qs & As

80


Option Three: A little more work

1. Do all “Option One” and “Option Two” activities, PLUS

2. Case studies Use Legal Action Center’s case studies

(in hand-outs) Consider creating your own – tailored to real

life scenarios3. Ask staff for real life examples of HIV

confidentiality issues at work, and discuss

81


Option Four: Thorough Review

1. Do all Options One, Two & Three, PLUS

2. Have a screening of “HIV Confidentiality Law Overview” webinar on AI Clinical Education Initiatives website:

http://www.ceitraining.org/cme/

3. Offer staff additional resources and training materials, including those in your hand-outs

82

Helpful resources for Step 3

Legal Action Center materials in hand-outs for this training and noted above (can download from LAC website: www.lac.org – click on Trainings)

New York State Department of Health and AIDS Institute materials for this training and noted above

83

You can do it! The Legal Action Center is here to help you

make this capacity-building initiative a success for everyone.

Call on our lawyers for continuing support and technical assistance, day in & day out:

Legal Action CenterMondays through Fridays, 1pm to 5pm

212-243-1313 or 800-223-4044

Thank you!

This concludes the webinar.

Thank you.And thanks to the AIDS Institute, New

York State Department of Health.

84

How to Create and Update Your Agency’s HIV Confidentiality Policies & Procedures and Ensure Staff...

Documents

Transcript of How to Create and Update Your Agency’s HIV Confidentiality Policies & Procedures and Ensure Staff...