How to Provide The Mandatory Annual HIV Confidentiality

1

• How to Provide
• The Mandatory Annual
• HIV Confidentiality Update
• For HIV Service Providers in New York
• Who Need to Follow
• Article 27-F of the NYS Public Health Law

2
Technical difficulties?

• Call 212-243-1313 with technical problems during
  webinar OR
• Click on feedback icon right side of toolbar.

3
Who are Your Trainers?

• Sally Friedman, Esq.
• Kate Wagner-Goldstein, Esq.
• Legal Action Center

3
4
Free Legal Services

• Including
• HIV testing confidentiality
• Discrimination based on
• HIV status
• Alcohol/drug history
• Criminal record
• Rap sheet review and error correction
• Certificates of Relief and Good Conduct
• Job Housing Discrimination

4
5
Background

• Why are you here?

6
First, some legal background

• The New York State HIV Confidentiality Law
  Article 27-F of the Public Health Law protects
  the confidentiality of HIV-related information
  about people who receive services from most
  health care or social services providers in New
  York.
• Your agency must comply with Article 27-Fs
  confidentiality requirements.

7
Some legal background (cont.)

• Regulations implementing Article 27-F require
  providers subject to the law to
• establish HIV confidentiality policies and
  procedures,
• require all staff to understand follow them,
• annually review these policies and procedures,
  and
• ensure and document that all employees
  receive initial and annual in-service training on
  HIV confidentiality.

8
This HIV confidentiality capacity-building
initiative What is it?

• The NYS Dept. of Health AIDS Institute is
  sponsoring this HIV confidentiality
  capacity-building initiative
• Dear Colleague letter (in your hand-outs)
  explains
• What is expected of your agency, and
• How the DOH, AIDS Institute and the Legal Action
  Center can help you succeed in fulfilling these
  responsibilities, in-house!

9
This HIV confidentiality capacity-building
initiative What is it? (cont)

• Goals of initiative help your agency develop
  in-house capacity to ensure
• Your HIV Confidentiality Policies and Procedures
  are in place, up to par, and updated annually,
  AND
• Your staff with responsibility for conducting
  your organizations annual staff in-service on
  HIV Confidentiality are ready and able to
  accomplish this successfully.

10
This HIV confidentiality capacity-building
initiative Target audience

• This training is for
• Program directors, managers, and supervisors or
  staff responsible for
• developing and updating your agencys HIV
  confidentiality policies and procedures, or
• conducting annual, in-house, staff in-service on
  HIV confidentiality.

11
By end of training, you should be able to . . .

• State the major requirements of the NYS HIV
  confidentiality law (and HIPAA, if your agency
  must comply with it, too)
• Develop (or update) your agencys own HIV
  Confidentiality Policies and Procedures to comply
  with HIV confidentiality law
• and

12
By end of training, you should be able to. . .
(cont.)

• Conduct an annual review and update of your
  agencys HIV Confidentiality Policies and
  Procedures
• List 3 options for conducting your agencys HIV
  confidentiality in-service and
• Conduct a simple, straightforward annual staff
  in-service on HIV confidentiality

13
Hand-outs

• This PowerPoint
• Another PowerPoint
• Our Annual HIV Confidentiality Update
• Model HIV Confidentiality Policies Procedures
  for HIV/AIDS Service Providers in New York State
  PRINT THIS OUT FOR WEBINAR
• HIV Confidentiality Case Studies
• More

14
Hand-outs (cont.)

• New York States HIV Confidentiality Law and
  Federal HIPAA A Summary for HIV/AIDS Providers
• Dear Colleague Letter
• AI Technical Assistance Bulletin DOH-5032
• QA DOH-2557
• Technical Assistance Bulletin HIPAA Compliant
  Authorization.. (2005)
• More

15
Hand-outs (cont.)

• Flow chart
• HIPPA Compliance Checklist
• HIPAA Information Sheet for HIV Providers-NYS
• HIV/AIDS Testing, Confidentiality
  Discrimination

16
Hand-outs (cont.)

• You should have received (cont.)
• If you didnt download them, you can get them by
  clicking on the tab toward the top right of your
  toolbar that looks like 3 pieces of paper.
• Youll see hand-outs if you put your mouse over
  it.

16
17
Questions/discussion?

• You can ask questions!
• Every 20 minutes or so question answer break.

18
Step 1

• Your Agencys Policies
• Procedures
• How to Create Implement Them

19
Your policies procedures purpose

• Your agency is required to put in place policies
  and procedures to
• Maintain confidentiality of HIV related
  information, and
• Assure that confidential HIV related information
  is disclosed only when appropriate and in
  accordance with the Article 27-F and the
  regulations that govern your agency.

20
Your policies procedures preliminary steps

• Determine how/when the confidentiality law
  applies to your agency (Model Policies
  Procedures, p.2)
• Health and social service provider?
• See App. 3 of Model Policies Procedures
• If not have a contract with the AIDS Institute
  requiring compliance with Art. 27-F?

21
Your policies procedures preliminary steps
(cont.)

• If not (neither health or social service
  provider or contract with AIDS Institute)
• then only requirement to comply with Art. 27-F
  is when receive HIV-related information through
  written release.

22
Your policies procedures preliminary steps
(cont.)

• Determine which confidentiality regulations apply
  to your agency.
• Which state agency regulates your agency?
• Which regulations apply?
• Example DOH regulations Part 63

23
Your policies procedures preliminary steps
(cont.)

• 3. Decide on terminology you will use in your
  Polices Procedures.
• Confidential HIV-related information (Art. 27-F
  term) or Personal health information (PHI)
  (HIPAA term)
• Capacity to consent
• 3. Anything else?

24
Your policies procedures requirements

• Required Components
• Training Updating
• Internal communications protocols
• Protocols to safeguard security of confidential
  records information
• and

25
Your policies procedures requirements (cont.)

• Required Components (cont.)
• Protocols for handling requests by other parties
  for HIV-related information
• Anti-discrimination provisions
• Well discuss these more later

26
Your policies procedures content

• Suggested components
• Introduction
• Purpose
• Confidentiality policy
• Staff responsible
• Definitions
• See Model Policies Procedures, p. 5

27
Your policies procedures content (cont.)

• Required Components
• 1. Training updating
• Policies procedures to educate all staff on
• New Yorks HIV confidentiality law, and
• Your agency-specific HIV confidentiality policies
  and procedures.

28
Your policies procedures content (cont.)

• 1. Training updating (cont.)
• Policy must require
• Annual review and update of agencys HIV
  Confidentiality Policies and Procedures, and
• Annual staff in-service on HIV confidentiality,
  in-house
• Designate staff responsible for both.

29
Your policies procedures content (cont.)

• Training updating (cont.)
• Require initial employee education and annual
  in-service for staff on HIV confidentiality.
• Maintain list of all employees who have received
  such training.
• more.

30
Your policies procedures content (cont.)

• Training updating (cont.)
• Include volunteers and peers who have access to
  HIV-related information.
• Extent of training will depend on how much access
  they have and extent of work they do.
• more.

31
Your policies procedures content (cont.)

• Training updating (cont.)
• Obtain/update employee attestations
• Have received this training.
• Have read and will abide by agencys HIV
  Confidentiality Policies and Procedures.
• See sample attestation App. 4 of Model Policies
  Protocols

32
Your policies procedures content (cont.)

• Training updating (cont.)
• Volunteers and peers should sign attestations too.

33
Your policies procedures content (cont.)

• 1. Training updating (cont.)
• Inform your agencys contractors providing
  services in which HIV related information might
  be disclosed
• That they must follow the confidentiality
  requirements.
• More

34
Your policies procedures content (cont.)

• 1. Training updating (cont.)
• (contractors, cont.)
• Advisable to highlight the requirement verbally
• Could provide contractor with literature about
  Article 27-F
• Document that you have done so.
• Include this in the contract and/or MOU

35
Your policies procedures content (cont.)

• 1. Training updating(cont.)
• OPTIONAL
• Provision Educating Clients about HIV
  Confidentiality Policy Rights
• See Model Policies Procedures, p.7

36
Your policies procedures content (cont.)

• 2. Internal communications protocols
• Develop need to know protocol list. (See
  Model Policies Procedures, App. 5, p. 32)
• Protocol Limit access to and disclosure of
  HIV-related information to authorized employees
  who reasonably need access to perform designated
  job duties/functions. Specify any limits on
  access.
• More..

37
Your policies procedures content (cont.)

• 2. Internal communications protocols
• Develop need to know protocol list (cont.)
• List job titles/functions within those job titles
  for which employees are authorized to access
  confidential HIV related information your need
  to know list.

38
Your policies procedures content (cont.)

• 2. Internal communications protocols (cont.)
• Distribute need to know list to all employees
  during employee education sessions.
• Require that only those staff who received such
  education may have access to confidential
  HIV-related information while performing the
  authorized functions specified in your need to
  know list.

39
Your policies procedures content (cont.)

• 2. Internal communications protocols (cont.)
• For agencies only bound by Art. 27-F because of
  AIDS Institute contract,
• Add provision about internal release form.
  (Model Policies Procedures, p. 8

40
Your policies procedures content (cont.)

• 3. Protocols to safeguard security of
  confidential records information
• Ensure that records containing confidential HIV
  related information, including records that are
  stored electronically, are
• Maintained securely, and
• Used only for the purpose intended.
• See Model Policies Protocols, p. 9
• more..

41
Your policies procedures content (cont.)

• 3. Protocols to safeguard security of
  confidential records information (cont.)
• Cover conversations about clients
• Cover how to contact clients at home.
• See ideas in Model Policies Procedures, p. 10
• Lets do a poll.

42
Your policies procedures content

• 4. Protocols to safeguard security of
  confidential records information (cont.)
• Correct answer 1.
• Violates Article 27-F and HIPAA to disclose
  Janes HIV-related information to someone else
  who answers the phone or on her answering machine
  unless Jane signed an HIV-specific release.

42
43
Your policies procedures content (cont.)

• 3. Protocols to safeguard security of
  confidential records information (cont.)
• Cover written, electronic (fax email) oral
  communications.
• See ideas in Model Policies Procedures, p. 10

44
Your policies procedures content (cont.)

• 4. Protocols for handling requests by other
  parties for confidential HIV-related information.
  Cover
• When you have a release or can get one
• New DOH releases !! June 2011.
• Provide notice prohibiting redisclosure (See
  App. 6, Model Policies Procedure)
• See Model Policies Protocols, p. 13

45
Your policies procedures content (cont.)

• 4. Protocols for handling requests by other
  parties for confidential HIV-related information
  (cont.). Cover
• Requests when there is no release
• Is there some other authorization under Art.
  27-F? (See slides, below.)
• Special procedure for subpoenas
• Redact HIV information?
• Withhold that part of the record?

46
Your policies procedures content (cont.)

• Protocols for handling requests by other parties
  for confidential HIV-related information (cont.)
• Guidelines could also apply to disclosures your
  agency needs/decides to make (as opposed to at
  3rd partys request)
• more..

47
Your policies procedures content (cont.)

• Disclosures without a release
• To outside health care providers
• See Poll.
• Decide which type of release to require general
  or HIV-specific
• See Model Policies Protocols pp. 13-14

48
Your policies procedures content (cont.)

• Disclosures without a release
• To outside health care providers
• Correct answer -- 1
• Disclosures to health care providers permitted if
  necessary for appropriate care/treatment of
  patient
• Not for infection control
• See Model Policies Protocols pp. 13-14

49
Your policies procedures content (cont.)

• Disclosures without a release (cont.)
• Physicians disclosures about Minors
  Incompetent Adults
• Applies only if physicians on staff
• See Model Policies Protocols p. 14

50
Your policies procedures content (cont.)

• Disclosures without a release (cont.)
• To Contacts (sexual or needle-sharing
  partners) if agency is not a mandated case
  reporter
• Provisions will vary depending on whether have
  physician on staff
• See Model Policies Protocols pp. 15-18

51
Your policies procedures content (cont.)

• Disclosures without a release (cont.)
• To public health authorities for HIV/AIDS case
  reporting
• Only if agency is mandated HIV case reporter
  under Public Health Law Sec. 2130
• See Model Policies Protocols p. 18

52
Your policies procedures content (cont.)

• Disclosures without a release (cont.)
• To oversight authorities for program monitoring,
  evaluation, review
• See Model Policies Protocols p. 18

53
Your policies procedures content (cont.)

• Disclosures without a release (cont.)
• Occupational exposure
• Only include this provision in certain
  occupational settings
• Ex medical or dental offices, emergency
  response functions performed, facilities
  regulated by various state agencies
• See Model Policies Protocols p. 19

54
Your policies procedures content (cont.)

• Disclosures without a release (cont.)
• Disclosures to insurers for health care
  reimbursement
• Only include if your agency is a health care
  provider/facility seeking reimbursement for
  health care services from private or public
  insurers
• See Model Policies Protocols p. 19

55
Your policies procedures content (cont.)

• 5. Anti-discrimination provision
• Policy prohibiting employees, agents, and
  contractors from discriminating against persons
  having or suspected of having HIV infection.
• See Model Policies Protocols pp. 21-22

56
Your policies procedures content (cont.)

• Optional Grievance procedures
• Not required by Art. 27-F, though highly
  recommended
• HIPAA does require patient complaint process
• See Model Policies Procedures, p. 22

57
Helpful resources for Step 1

• Legal Action Center resources
• Model HIV Confidentiality Policies and Procedures
  for Human Service Providers in New York State
• Ongoing Updates on Changes Needed in Your HIV
  Confidentiality Policies and Procedures (as
  needed)

58
Helpful resources for Step 1 (cont.)

• More LAC resources
• Hand-outs for this training
• LACs website www.lac.org (click on Training)
• Call LACs HIV Confidentiality Hotline
• 212-243-1313 or 800-223-4044
• Ask for the attorney on call

59
Helpful resources for Step 1 (cont.)

• NYS Dept. of Health AIDS Institute resources
• Hand-outs for this training
• DOH/AIDS Institute websites www.health.state.ny.u
  s and go from there!
• DOH Confidentiality Hotline [phone]
• Your AIDS Institute contract manager and other
  staff.

60
Step 2 Your Annual Review

• So How Do You
• Conduct an Annual
• Policy Review?

61
How to conduct your annual policy review

• Review your agencys existing HIV Confidentiality
  Policies Procedures
• Identify gaps, needed additions or changes
• Elicit input from both new and experienced staff
• Assess what your on-the-ground experience has
  taught you over the past year
• Look to what the future will likely bring

62
How to conduct your annual policy review (cont.)

• Update your policy accordingly
• Also update, as needed, your agencys
• Need-to-know list
• Employee attestation forms
• Other documents required to document your
  agencys continuing compliance with Article
  27-Fs HIV confidentiality requirements
• Now you will be ready to conduct your mandatory
  annual in-service confidentiality update for all
  staff!

63
Step 3 Annual HIV Confidentiality In-Service

• How to Update
• Train Your Staff?

64
How to conduct your annual HIV confidentiality
update in-service

• Prepare
• Seek staff input in advance
• issues to be covered, questions about existing
  agency policies procedures and the HIV law.
  The responses will inform the nature of the
  training required.
• 2 Consider type of annual update you need
• There are at least 3 options, depending on your
  agencys needs (see next slides).

65
How to conduct your annual HIV confidentiality
update in-service (cont.)

• Option One simplest and shortest
• Conduct Review of Agencys HIV Confidentiality
  Policies Procedures
• Key components
• Changes since last Annual Update
• Provide opportunity for Qs As

66
How to conduct your annual HIV confidentiality
update in-service (cont.)

• Option Two Update-plus
• 1. Do all Option One activities, PLUS
• 2. Case studies
• Use Legal Action Centers case studies
• (in hand-outs)
• Consider creating your own tailored to real
  life scenarios
• 3. Ask staff for real life examples of HIV
  confidentiality issues at work, and discuss

67
How to conduct your annual HIV confidentiality
update in-service (cont.)

• Option Three Update PowerPoint
• 1. Do both Options One and Two activities, PLUS
• In-service PowerPoint Presentation
• Use LACs PPT, Our Annual HIV Confidentiality
  Update, tailored to your agencys needs,
• Create your own or
• Use the AIDS Institutes HIV Confidentiality Law
  Overview webinar, soon to be released.

68
How to conduct your annual HIV confidentiality
update in-service (cont.)

• Option Three Update PowerPoint (cont.)
• Offer staff additional resources and training
  materials, including those in your hand-outs
• Provide opportunity for Qs As

69
Helpful resources for Step 3

• Legal Action Center materials in hand-outs for
  this training and noted above (can download from
  LAC website www.lac.org click on Trainings)
• New York State Department of Health and AIDS
  Institute materials for this training and noted
  above

70
You can do it!

• The Legal Action Center is here to help you make
  this capacity-building initiative a success for
  everyone.
• Call on our lawyers for continuing support and
  technical assistance, day in day out
• Legal Action Center
• Mondays through Fridays, 1pm to 5pm
• 212-243-1313 or 800-223-4044

71
Feedback?

• Shortly after the webinar, youll receive a link
  to an evaluation through Survey Monkey.
• Need evaluation to get Certificate of Attendance

72
Thank you!

• This concludes the webinar.
• Thank you.
• And thanks to the AIDS Institute, New York State
  Department of Health.