Legal Aspects of Forensic Photography€¦ · Legal Aspects of Forensic Photography Nolan S. Young,...

Legal Aspects of ForensicPhotography

Nolan S. Young,

Arent Fox LLP

1Legal Aspects of Forensic PhotographySmart in Your World

Arent Fox

Patient/Victim Privacy1


Arent Fox

Patient/Victim Privacy

• It was humiliating; that is not a photo youwould show to anybody. I felt completely takenadvantage of. I felt like people were making itinto a fun topic on the Internet, and it’s mylife. I was disappointed, especially when Ifound out the photo was [supposedly leakedby] two women.


Arent Fox

Overview• Patient’s Right to Privacy

– Health Insurance Portability and Accountability Act (“HIPAA”)– The Health Information Technology for Economic and Clinical

Health (“HITECH”) Act– State Laws

• Informed Consent– What is Required?

– Consent for treatment vs. consent for disclosure.

• Trends

– Increased Enforcement

– Encryption

– Whose Record is it?

4Legal Aspects of Forensic Photography

Smart in Your World

Arent Fox

Patient’s Right to Privacy


Smart in Your World

Arent Fox

Patient/Victim Privacy

• Two primary sources of privacy laws that youneed to consider when developinginstitutional policies:

– Federal HIPAA Regulations

– State Laws

• State Health Information Technology Laws

• State Reporting Requirements


Arent Fox

HIPAA


Smart in Your World

Arent Fox

HIPAA

• HIPAA

– General Provisions

– Privacy Rule - “Establishes . . . a set of [minimum]national standards for the protection of certainhealth information.”

– Security Rule - “Establishes a national set of[minimum] security standards for protectingcertain health information that is held ortransferred in electronic form.”

– Breach Notification Requirements (HITECH Act)


Arent Fox

HIPAA General Provisions

• To Whom does HIPAA Apply?

– “Covered Entities”

• Virtually all health care providers – all health careproviders who transmit health informationelectronically in connection certain transactionsincluding the transmission of claims, benefit eligibilityinquiries, referral authorization requests, etc.

• The use of electronic technology such as email is notenough


Arent Fox

Are You a Covered Health Care Provider?2

STOPYou are NOT acovered healthcare provider

Do you furnish, bill orreceive payment for,

health care in thenormal course of

business?

No

Yes

Do you transmit informationelectronically in connectionwith specified transactionsincluding claims, eligibility,referral authorizations, etc.

Yes You ARE acoveredentity


Arent Fox

HIPAA Privacy Rule3

• Objective - assure that individuals’ healthinformation is properly protected while allowingthe flow of health information needed to provideand promote high quality health care and toprotect the public's health and well being.

• The Rule strikes a balance that permits importantuses of information, while protecting the privacyof people who seek care and healing.


Arent Fox

HIPAA Privacy Rule

• The Basic Principle of the Privacy Rule - Acovered entity may not use or discloseprotected health information, except:

– as specifically permitted or required by the PrivacyRule; or

– as authorized in writing, by the individual who isthe subject of the information.


Smart in Your World

Arent Fox

HIPAA Privacy Rule

• What information is protected

– all "individually identifiable health information"held or transmitted by a covered entity or itsbusiness associate, in any form or media, whetherelectronic, paper, or oral.


Arent Fox

Protected Health Information• “Individually identifiable health information” is information,

including demographic data, that relates to:

– the individual’s physical or mental health or condition,

– the provision of health care to the individual, or

– the payment for the provision of health care to the individual

- AND -- that identifies the individual or for which there is a reasonable

basis to believe it can be used to identify theindividual. Individually identifiable health information includesmany common identifiers (e.g. name, address, birth date, SocialSecurity Number).


Arent Fox

Permitted Uses and Disclosures

1. Uses and disclosures for which authorizationis not required (some require consent):

2. Uses and disclosures for which theopportunity to agree or object is required;

3. Uses and disclosures for which authorizationis required.


Arent Fox

Permitted Uses and Disclosures1. Uses and disclosures for which authorization is not required

(some require consent):

– Disclosures to carry out treatment, payment, or healthcareoperations;

– Disclosures required by law;

– Disclosures for public health activities;

– Disclosures about victims of abuse, neglect or domesticviolence;

– Disclosures for health oversight activities;

– Disclosures for judicial and administrative proceedings;

– Disclosures for law enforcement purposes;


Arent Fox

Required Disclosures

• HIPAA Requires Disclosures only in the followingsituations:

– Disclosure to the individual that is the subject ofprotected health information when that individualspecifically requests the information;

– Disclosure to the United States Department of Healthand Human Services (“HHS”) is required when it isundertaking a compliance investigation or review orenforcement action.

• Note - Disclosure could be required by state law underother circumstances


Arent Fox


1. Uses and disclosures for which authorization is not required(continued):

– Disclosures about decedents;

– Disclosures for cadaveric organ, eye or tissue donationpurposes;

– Disclosures for research purposes;

– Disclosures to avert a serious threat to health or safety;

– Disclosures for specialized government functions;

– Disclosures for workers compensation.


Arent Fox


Disclosures required by law

• Many states have laws that require medicalpersonnel to report information related to certaininjuries or offenses, including protected healthinformation, to relevant authorities.

• Under HIPAA, a covered entity may use or discloseprotected health information to the extent that suchuse or disclosure is required by law and the use ordisclosure is limited to the relevant requirements.


Arent Fox


Disclosures required by law (continued)

– For Example:

• Nearly every state has mandatory reportingrequirements related to injuries caused by firearms or other dangerous weapons.

• Many states have mandatory reportingrequirements related to child abuse, elder abuse,domestic violence, and sexual assault.

– Remember – This requirement is limited to theinformation that is required to be reported.

• Typically does not include photographs.


Arent Fox


Victims of Abuse, Neglect or Domestic Violence

• May disclose PHI about an individual whom you reasonablybelieve to be a victim of abuse, neglect, or domestic violence toan authorized government authority, if:

– the disclosure is required by law;

– the individual agrees to the disclosure; or• oral consent satisfies this requirement

– the disclosure is expressly authorized by legislation, and• necessary to prevent serious injury; or

• where the individual is unable to agree because of incapacity and alaw enforcement official represents that the information is notintended to by used against the individual and that an immediateenforcement activity depends on the disclosure . . .


Arent Fox


Victims of Abuse, Neglect or Domestic Violence

• You must inform the individual of the disclosurewhen disclosure is made to a government authorityas required by law, and the victim has not specificallyprovided consent for the disclosure, unless

– informing the individual would place her or him inserious harm; or

– would require informing a personal representativewho you believe is responsible for the abuse,neglect or harm.


Arent Fox


Disclosures for judicial and administrative proceedings

• May disclose PHI

– In response to a court order

– In response to a subpoena; if

• The individual has been given notice of the request;and

• The requestor has made sufficient efforts to obtain aprotective order protecting the information.


Arent Fox

Permitted Uses and DisclosuresDisclosures to for law enforcement purposes• May disclose PHI:

– As required by laws that require the reporting of certaintypes of injuries.

– In compliance with a court order, warrant, subpoena,summons, grand jury subpoena, or administrative request.

– Information related to the victim of a crime, in response tolaw enforcement request

• with consent of the victim;• if unable to obtain consent because of incapacity with

necessary assurances from law enforcement.• If the individual is the victim of abuse, neglect or domestic

violence, you must follow the specific reportingrequirement related to such offenses.


Arent Fox


Disclosures to for law enforcement purposes(continued)

• When providing emergency care, a health care provider maydisclose PHI to a law enforcement official if such disclosure isnecessary to alert law enforcement to:

– the commission and nature of a crime;

– the location of such crime; and

– the identity, description and location of the perpetrator.


Arent Fox

Permitted Uses and Disclosures2. Disclosures for which the opportunity to agree or object is

required

a. Disclosure for facility directories

• May disclose the individual’s name, location in thefacility, a general description of their condition, andtheir religious affiliation.

• Individual must be informed in advance of thedisclosure, including the information to be disclosedand the persons to whom the information may bedisclosed,

• Individual must be given an opportunity to refuse orotherwise restrict the disclosure


Arent Fox

Permitted Uses and Disclosures2. Disclosures for which the opportunity to agree or object is

required

b. Disclosure for involvement in the individuals care andnotification purposes

• May disclose to a family member, relative, friend, or otherperson identified by the individual, information related to theperson’s involvement in the patients care or payment related tothe patient’s care.

• May disclose information including the patient’s name, location,general condition, or death to notify a family member, personalrepresentative or other person responsible for the patient’s care.

• Individual must be given an opportunity to refuse or otherwiserestrict the disclosure (may be inferred from the circumstances).


Arent Fox

Permitted Uses and Disclosures3. Uses and disclosures for which authorization is required.

a. Except as other permitted by HIPAA.

b. Authorization for use or disclosure of psychotherapynotes is required, notwithstanding any other provisions,except:

• use by the originator of the notes;

• training of the covered entity’s own students, traineesor practitioners in mental health;

• by covered entity to defend itself in litigation broughtby the individual.

c. Authorization required for use in Marketing, with limitedexceptions.


Arent Fox

29Smart in Your World

Arent Fox Legal Aspects of Forensic Photography

HIPAA Disclosures SummaryDisclosureRequired

Without Authorization Opportunity toObject

With Authorization

1. Upon request bythe individualwho is thesubject of theinformation

2. To HHS forcomplianceinvestigation,review, orenforcementaction

1. Treatment,Payment,Operations

2. Required by Law

3. Abuse, Neglect,Domestic Violence• required by law• with consent

4. In response to aCourt Order orSubpoena

5. Law EnforcementPurposes:

• as required by law• with Consent• Subpoena/court

order• In emergency

1. FacilityDirectories

2. Individual Care orNotificationPurposes

1. Except asotherwisepermitted

2. Authorizationrequired fordisclosure ofpsychotherapynotes

3. Authorizationrequired for usein marketing

Valid Authorization

Core Elements – Authorization must contain:• A description of the information to be used or disclosed

• The name or other identifying information of the personauthorized to make the requested use or disclosure

• The name or other identifying information of the person towhom the entity may make the disclosure

• A description of each purpose of the requested use ordisclosure

• An expiration date or event

• Signature of the individual and date


Arent Fox

Valid Authorization

Required Statements.• In addition to the Core Elements, the Authorization must

contain statements adequate to put the individual on noticeof:

– The individual’s right to revoke the authorization in writingincluding how the individual may revoke the authorizationsand the exceptions to the right to revoke;

– The ability or inability to condition treatment on theauthorization (providers may condition treatment onauthorization only in very limited circumstances).

– The potential for the information to be re-disclosed by therecipient and no longer be protected.


Arent Fox

Valid Authorization

• The authorization must be written in plainlanguage.

• The covered entity must provide a copy of thesigned authorization to the individual.


Arent Fox

Valid Authorization

Defective Authorizations:

• The expiration date has passed;

• Core elements are incomplete;

• Authorization has been revoked;

• The covered entity knows that materialinformation is false.


Arent Fox

Valid Authorization

Compound Authorizations:

• Generally, the authorization may not becombined with any other document tocreate a compound authorization.


Arent Fox

Valid Authorization

Prohibition on Conditioning of Authorizations.

• A covered entity generally may not conditionthe provision of treatment on the provision ofan authorization.

• Exceptions:– Research-related treatment;

– Health care that is solely for the purpose ofcreating protected health information fordisclosure to a third party.


Arent Fox

HIPAA Security Rule4

• What information is covered by the SecurityRule?– “Electronic Protected Health Information” (“e-

PHI”).

– e-PHI includes all individually identifiable healthinformation that a covered entity creates,receives, maintains or transmits in electronicform.

– Unlike the Privacy Rule, the Security Rule does notapply to PHI transmitted orally or in writing.


Arent Fox

HIPAA Security Rule

• Requires covered entities to maintain reasonableand appropriate administrative, technical, andphysical safeguard for e-PHI.

• Specifically, covered entities must:1. Ensure the confidentiality, integrity, and availability

of all e-PHI2. Identify and protect against reasonably anticipated

threats to security or integrity of the information;3. Protect against reasonably anticipated,

impermissible uses or disclosures; and4. Ensure compliance by their workforce.


Arent Fox

HIPAA Security Rule

• Confidentiality = Not available or disclosed tounauthorized persons.

• Integrity = Not altered or destroyed in anunauthorized manner.

• Availability = Accessible on demand toauthorized persons.


Arent Fox

HIPAA Security Rule

• Administrative Safeguards

• Physical Safeguards

• Technical Safeguards


Arent Fox

Administrative Safeguards

• Security Management Process – Must identify andanalyze potential risks to e-PHI, and it must implementsecurity measures that reduce risks and vulnerabilitiesaccordingly.

• Security Personnel – Must designate a security officialwho is responsible for developing and implementing itssecurity policies and procedures.

• Information Access Management – Must developpolicies and procedures for authorizing access to e-PHIonly when access is appropriate.

• Evaluation – Must perform periodic assessments.


Smart in Your World

Arent Fox

Physical Safeguards

• Facility Access and Control - Must limitphysical access while ensuring authorizedaccess is allowed.

• Work Station Device Security

– Requires policies and procedures governing useand access to work stations and electronic media.

– Must have P&Ps regarding transfer, removal,disposal, and re-use of electronic media.


Arent Fox

Technical Safeguards

• Access Controls – Technical P&Ps that allow onlyauthorized access to e-PHI.

• Audit Controls – Hardware, software, and/orprocedural mechanisms to record and examine accessand other activity in information systems that containor use e-PHI.

• Integrity Controls – P&Ps to ensure that e-PHI is notimproperly altered or destroyed.

• Transmission Security – Technical security measuresthat guard against the unauthorized access to e-PHIthat is being transmitted over an electronic network.


Arent Fox

HIPAA Security Rule

• Covered entities must comply with every SecurityRule Standard.

• Each Security Rule Standard contains both“Required” and “Addressable” implementationspecifications.– Required Implementation Specifications must be

implemented

– Addressable Implementation Specifications• Not optional

• Covered entities may determine whether thespecification is reasonable and appropriate for thatentity.


Arent Fox

Administrative Safeguards

Required Specifications Addressable Specifications

• Risk Management/Analysis• Sanction Policy• Data Backup/Recovery Plans

• Malicious Software Protection• Log-in Monitoring• Password Management

Physical Safeguards


• Disposal• Media Reuse

• Maintenance Records• Data Backup and Storage

Technical Safeguards


• Unique User ID• Emergency Access

Procedure

• Encryption

SMART IN YOUR WORLD

ARENT FOXLegal Aspects of Forensic Photography 44

HIPAA Security Rule• Covered entities range from the smallest health care

provider to the largest multi-state health plan.– Have very different security needs– The Security Rule is intended to be flexible

• Considerations in developing Security Measures– Size, complexity, and capabilities– Technical, hardware, and software infrastructure,– The costs of security measures, and– The likelihood and possible impact of potential risks to e-PHI.

• Must review and modify security measures to continueprotecting e-PHI in a changing environment.


Arent Fox

HITECH

• The Health Information Technology for Economic andClinical Health (“HITECH”) Act

• Enacted as part of the American Recovery andReinvestment Act of 2009.

• Requires covered entities to notify individuals ofunauthorized disclosures of unsecured PHI.

• Breach notification requirements are not triggered ifinformation is rendered unreadable through encryption.

• Substantially increased sanctions for HIPAA violations.


Arent Fox

State Laws


Smart in Your World

Arent Fox

State Health Information Privacy

• All states have health information privacy lawsthat supplement HIPAA.

• State laws cannot relieve Covered Entitiesfrom HIPAA obligations.

• State laws can and do impose more stringentrequirements.

• State laws frequently impose privacyrequirements on providers and other entitiesthat are not “covered entities” under HIPAA.

SMART IN YOUR WORLD



• Property rights over medical records and theircontents are determined by state law.

– In most states, including California, the MedicalRecord belongs to the provider.

– Patients have a right to a copy, but not the original.

– Once something is put into the medical record, it isthe property of the provider.

• This includes information and images from forensicexams.

SMART IN YOUR WORLD



• Other state laws that do not specificallygovern health information privacy,supplement and clarify HIPAA obligations.

• For example, state laws imposing reportingrequirements on health care providers andother professionals clarify circumstancesunder which PHI may be disclosed.

SMART IN YOUR WORLD



• Every state has laws imposing obligations onhealth care providers to report treatment relatedcertain injuries and conditions to lawenforcement or other state officials.

• As discussed, under HIPAA, health care providersmay disclose PHI to law enforcement and otherauthorized government officials, without theconsent or authorization of patients, wheredisclosure is part of a report required by law.

SMART IN YOUR WORLD


State Reporting Requirements

• Many states have laws requiring health careproviders to report known or reasonablysuspected cases of rape, sexual assault orabuse.

SMART IN YOUR WORLD



• State reporting requirements regarding sexualassault of adults typically fall into four categories:1. State laws that require providers to report treatment related

to rape, sexual assault or domestic violence.

2. State laws that require providers to report treatment relatedto intentional or non-accidental injuries.

3. State laws that require providers to report treatment relatedto injuries caused by criminal acts, including rape, sexualassault or domestic violence.

4. State laws that require reporting of treatment related toinjuries caused by fire arms or other dangerous weapons.

SMART IN YOUR WORLD


Sexual Assault Reporting Requirements5


Smart in Your World

Arent Fox

• Red (Massachusetts) – Must Report Rape or Sexual Assault (but may not identify victim)• Blue (California) – Must Report sexual battery, including assault with intent to commit rape.• Green (Kentucky) – Must report incidents of spousal rape.

Intentional Injury Reporting Requirements6

55

• Red – Must Report Intentional Injuries (if the injury is likely to cause death).• Blue – Must Report Intentional Injuries.• Green – Must Report Intentional Injuries (except for domestic violence unless serious bodily injury or caused by a deadly weapon).

Smart in Your World


Reporting Requirements for Injuries Caused by Criminal Acts7

56

• Red – Must Report Injuries Caused by Criminal Conduct (but may not identify rape or sexual assault victims)• Blue – Must Report Injuries Caused by Criminal Conduct• Green – Must Report Injuries Caused by Criminal Conduct (except for domestic violence).

Smart in Your World


Reporting Requirements for Injuries Caused by DeadlyWeapons8


Smart in Your World

Arent Fox


• California Law requires Health Care Practitioner to:1. Immediately, or as soon as possible, make a report by

telephone to local law enforcement; and

2. Prepare a written report to send to local law enforcementwithin two working days of receiving the information. Thewritten report must include:

• The name of the injured person, if known;

• The injured person’s whereabouts;

• The character and extent of the persons injuries;

• The identity of any person the injured person alleges inflictedthe wound, other injury, or abusive conduct upon the person.

SMART IN YOUR WORLD



• All states have laws requiring health careproviders to report known or reasonablysuspected cases of child abuse or neglect.

• Most states have laws requiring health careproviders to report known or reasonablysuspected cases of elder abuse to either lawenforcement or State Adult ProtectiveServices.

SMART IN YOUR WORLD


Child Abuse and Neglect Reporting Requirements9


Smart in Your World

Arent FoxMART IN YOUR WORLD ARENT FOX

Elder Abuse Reporting Requirements10


Smart in Your World

Arent Fox

Informed Consent


Smart in Your World

Arent Fox

Informed Consent11

• Two separate and distinct consent process:One for medical treatment and one for theforensic examination.

• A third consent may be required for use anddisclosure under HIPAA.

• Patients should be informed of applicablestate law reporting requirements as part ofthe informed consent for the forensicexamination.

SMART IN YOUR WORLD


Informed Consent

• Patients should understand the full nature of theirconsent to each procedure, including, for example,what the procedure entails, possible side effects, andpotential impact.

• Patients can decline any part or all of treatment or theexamination.

• Informing patients of the potential affect of declining aparticular procedure is part of the informed consentprocess.

• Failure to obtain appropriate informed consent,including failure to inform the patient of the potentialaffect of declining a procedure, may be malpractice.

SMART IN YOUR WORLD


Informed Consent

• [T]he informed consent process includes makingpatients aware of the impact of declining a procedure,as it may negatively affect the quality of care and theusefulness of the evidence collection. It may also havea negative impact on a criminal investigation and/orprosecution both because evidence collected may havebeen useful and because defense attorneys may usethe fact that the victim declined a procedure to claimthat the victim is hiding something that would havebeen revealed by that procedure.12

SMART IN YOUR WORLD


Informed Consent• When informed consent is required, and when

informed consent is effective, is determined by statelaw, and thus varies between states.

• Generally, informed consent is necessary for medicalevaluation and treatment related to the following:– General medical care;– Pregnancy testing and care;– Testing and prophylaxis for STIs;– HIV prophylaxis;– Permission to re-contact the patient for medical purposes;

and– Release of medical information.

SMART IN YOUR WORLD


Informed Consent• Informed consent is generally necessary for the

forensic exam and evidence collection for:– Notification to law enforcement or other authority

(depending on reporting requirements);– Photographs;– The examination itself and evidence collection;– Toxicology screening;– Release of information and evidence to law

enforcement;– Permission to contact patients;– Patient notification in case of DNA match or additional

victims.

SMART IN YOUR WORLD


Informed Consent

• An effective “informed consent” necessarilyrequires an understanding of the nature andpurpose of proposed and alternativetreatments.

• If patients are unable to understand the risksand benefits of proposed and alternativetreatments, they are incompetent to giveeffective consent.

SMART IN YOUR WORLD


Informed Consent13

• In California, competency for purposes of consent formedical treatment is defined as “the ability tounderstand the nature and consequences of the illness,the proposed treatment, alternatives to treatment, andthe ability to make a reasoned decision in this regard.”

• Patients may be considered temporarily incompetentto give consent for many reasons including:incapacitating injuries, sedation, intoxication, etc.

• Competency is a case-by-case determination. Yourinstitution should designate someone to be consultedin instances where competency to consent becomes anissue.

SMART IN YOUR WORLD


Informed Consent vs. Authorization to Disclose

• Can an authorization to disclose under HIPAA becombined with informed consent.

– Compound authorizations are defective underHIPAA.

– However, HIPAA does not require an “authorization”to disclose information related to victims abuse,neglect, and domestic violence or victims of a crime.

SMART IN YOUR WORLD



• Remember - a covered entity may disclose PHIabout a victim of abuse neglect, or domesticviolence to an authorized government authority,if:

– the disclosure is required by law, or

– the individual agrees to the disclosure.

• May be oral.

• may be combined with other consents except asprohibited by state law.

SMART IN YOUR WORLD



• Similarly, an entity may disclose PHI about avictim of a crime to a government authority forlaw enforcement purposes:

– If the disclosure is required by law, or

– With the consent of the victim in response to a lawenforcement request.

• May be oral.

• May be combined with other consents except asprohibited by state law.

SMART IN YOUR WORLD


Trends


Smart in Your World

Arent Fox

Increased HIPAA Enforcement


Arent Fox


Cignet Health. (Feb. 22, 2011).• HHS imposed $4.3 Million Civil Monetary Penalty against Cignet

Health for violations of the HIPAA Privacy Rule.

– $1.3 Million for denying patients access to the medicalrecords.

– $3 Million for failing to cooperate with the investigation.

• First time that the Federal Government has imposed CMPs forHIPAA Privacy Rule violations.


Arent Fox


• Covered entities . . . must uphold theirresponsibility to provide patients with access totheir medical records, and adhere closely to all ofHIPAA’s requirements. The U.S. Department ofHealth and Human Services will continue toinvestigate and take action against thoseorganizations that knowingly disregard theirobligations under these rules.

– OCR Director Georgina Verdugo


Arent Fox



Arent Fox


Massachusetts General Hospital. (Feb. 24, 2011).• Agreed to pay $1 Million to resolve allegations related to

“potential violations” of HIPAA related to 192 patientmedical records lost by an employee on a subway on theway to work.

• OCR’s investigation indicated that Mass General failed toimplement reasonable, appropriate safeguards to protectthe privacy of PHI when removed from Mass General’spremises and impermissibly disclosed PHI potentiallyviolating provisions of the HIPAA Privacy Rule.

• As part of the resolution, Mass General agreed to developnew policies with respect to physical removal andtransport of PHI from hospital premises, laptopencryption, and USB drive encryption.


Arent Fox


• We hope the health care industry will take aclose look at this agreement and recognizethat OCR is serious about HIPAA enforcement.It is a covered entity’s responsibility to protectits patients’ health information.

– OCR Director Georgina Verdugo


Arent Fox


• Lessons

– The Government is getting serious about HIPAAenforcement.

– Must continuously review and modify policies andmeasures that can be used to protect PHI,particularly e-PHI that is susceptible to loss orother unauthorized disclosure.


Arent Fox

To Encrypt Or Not To Encrypt?


Smart in Your World

Arent Fox

Encryption

• Do I have to encrypt data?

– It depends

• Encryption is an addressable specification, nota required specification

– Is encryption reasonable and appropriate underthe circumstances?


Arent Fox

Encryption

• Considerations in developing securitymeasures

– Size, complexity, and capabilities

– Technical, hardware, and software infrastructure,

– The costs of security measures, and

– The likelihood and possible impact of potentialrisks to e-PHI.


Arent Fox

EncryptionCMS HIPAA Security Guidance for Remote Use of and Access to e-

PHI16

• [Recommends that covered entities] require that all portable orremote devices that store EPHI employ encryption technologies ofthe appropriate strength . . . Because of the proliferation ofportable devices and media, the risk of loss or theft of ePHI hasincreased.

• Although this implementation specification is addressable, strongencryption provides additional assurances over the protection ofePHI, even in cases where portable devices are lost or stolen.

• The combination of CMS’s recommendation in the remote useguidance, the increasing number of incidents involving lostportable devices, and the decreasing cost of encryption solutionshas resulted in an environment where encryption may not beoptional under the mantra of reasonable and appropriate.


Arent Fox

Encryption

• Though “addressable,” encryption is “recommended”– CMS in its HIPAA Security Guidance for Remote Use of and

Access to e-PHI.

• In the event of a breach, lack of encryption may bedeemed a failure to implement reasonable andappropriate safeguards to protect e-PHI.– Mass General enforcement action and settlement

• HITECH, if data is encrypted, breach notification is notrequired.


Arent Fox

Whose Record Is It Anyway?


Smart in Your World

Arent Fox

Whose Record Is It?

• In California, and most other states, themedical record, and its contents generallybelongs to the provider.

• Once the forensic examination is completedand put into the medical record it belongs tothe provider.

• How about before it is physically placed in themedical record?


Arent Fox

Whose Record Is It?

• Very little law on the issue.

• It may depend on:

– Where the examination was conducted;

– Who conducted the exam;

– What the patient was told during the informedconsent;

• Were they told the examination was for medicaltreatment purposes, evidentiary purposes, or both.


Arent Fox

Whose Record Is It?

• In absence of state law or other definitiveresolution, HIPAA covered entities mustprotect the record and seek the consent of thevictim before disclosing the record to lawenforcement.


Arent Fox

References1. Joel Rubin and Richard Winton; Rihanna Photo Prompts LAPD Probe, LOS ANGELES TIMES (Feb. 21, 2009) available at

http://articles.latimes.com/2009/feb/21/local/me-rihanna21.

2. THE UNITED STATES DEPARTMENT OF HEALTH & HUMAN SERVICES, CENTERS FOR MEDICARE & MEDICAID SERVICES, COVERED ENTITY

CHARTS, available at http://www.cms.gov/HIPAAGenInfo/06_AreYouaCoveredEntity.asp.

3. See THE UNITED STATES DEPARTMENT OF HEALTH & HUMAN SERVICES, SUMMARY OF THE PRIVACY RULE, available athttp://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html.

4. See THE UNITED STATES DEPARTMENT OF HEALTH & HUMAN SERVICES, SUMMARY OF THE SECURITY RULE, available athttp://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html.

5. Source: Teresa P. Scalzo, Esq.; SUMMARY OF LAWS RELEVANT TO RAPE AND SEXUAL ASSAULT REPORTING FOR THE VICTIMIZATION OF

COMPETENT ADULTS; available at http://www.usmc-mccs.org/famadv/restrictedreporting/National%20Rape%20Reporting%20Requirements%206.15.06.pdf.







9. Source: COMPARISON CHART OF PROVISIONS IN ADULT PROTECTIVE SERVICES LAWS, BY STATE (Laws current as of 12/31/06);Prepared by Lori Stiegel and Ellen Klem of the American Bar Association Commission on Law and Aging for the NationalCenter on Elder Abuse; available at http://www.americanbar.org/groups/law_aging.html.

SMART IN YOUR WORLD


http://www.cms.gov/HIPAAGenInfo/06_AreYouaCoveredEntity.asp

http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html

http://www.usmc-mccs.org/famadv/restrictedreporting/National Rape Reporting Requirements 6.15.06.pdf

http://www.usmc-mccs.org/famadv/restrictedreporting/National Rape Reporting Requirements 6.15.06.pdf

http://www.americanbar.org/groups/law_aging.html

References10. Source: CHILD WELFARE INFORMATION GATEWAY (April 2010); available at

www.childwelfare.gov/systemwide/laws_policies/statutes/manda.cfm.

11. See UNITED STATES DEPARTMENT OF JUSTICE; A NATIONAL PROTOCOL FOR SEXUAL ASSAULT MEDICAL FORENSIC EXAMINATIONS, available athttp://www.ncjrs.gov/pdffiles1/ovw/206554.pdf.

12. Id.

13. See CALIFORNIA COALITION AGAINST SEXUAL ASSAULT; CALIFORNIA SEXUAL ASSAULT TEAM MANUAL; available athttp://www.ncdsv.org/images/Patient%20Consent%20Issues.pdf.

14. UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES PRESS RELEASE, HHS IMPOSES A $4.3 MILLION CIVIL MONEY PENALTY FOR

VIOLATIONS OF THE HIPAA PRIVACY RULE (Feb. 22, 2011) available athttp://www.hhs.gov/news/press/2011pres/02/20110222a.html.

15. UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES PRESS RELEASE; MASSACHUSETTS GENERAL HOSPITAL SETTLES POTENTIAL

HIPAA VIOLATIONS (Feb. 24, 2011) available at http://www.hhs.gov/news/press/2011pres/02/20110224b.html.

16. CENTERS FOR MEDICARE & MEDICAID SERVICES; HIPAA SECURITY GUIDANCE FOR REMOTE USE OF AND ACCESS TO ELCTRONIC PROTECTED

HEALTH INFORMATION.

SMART IN YOUR WORLD


http://www.ncjrs.gov/pdffiles1/ovw/206554.pdf

http://www.ncdsv.org/images/Patient Consent Issues.pdf

http://www.hhs.gov/news/press/2011pres/02/20110222a.html

http://www.hhs.gov/news/press/2011pres/02/20110224b.html

Legal Aspects of Forensic Photography€¦ · Legal Aspects of Forensic Photography Nolan S. Young,...

Documents

Transcript of Legal Aspects of Forensic Photography€¦ · Legal Aspects of Forensic Photography Nolan S. Young,...