197807
Model Law on Confidentiality of Health and
Social Service Records
RESOURCE DOCUMENT
Approved by the Board of Trustees, September 1977
Assembly Executive Committee, February 1978
| |
"The findings, opinions, and conclusions of this report do not necessarily represent the views of the officers, trustees, or all members of the American Psychiatric Association. Views expressed are those of the authors."-- APA Operations Manual. |
|
This document was approved by the Board of Trustees at its September 1977 meeting and by the Assembly Executive Committee at its February 1978 meeting. It was prepared by the Task Force on Confidentiality of Children's and Adolescents' Clinical Records1 and the Committee on Confidentiality.2 I. Scope: All confidential information is subject to the provisions of this Act. Except as hereinafter provided, or otherwise specifically required by federal, state or local law, no person shall, without the authorization of the patient/client or his/her authorized representative:
(a) Disclose or transmit any confidential information together with a patient/client identifier to any person, or
(b) Disclose or transmit a patient/client identifier to any person, or
(c) Disclose or transmit confidential information if the person disclosing or transmitting it has reason to believe that the recipient may have a patient/client identifier for such information.
2. Definitions As Used in This Act: (a) “Confidential information” means:
(i) The fact that a person is or has been a patient/client;
(ii) Information transmitted in confidence between the patient/client and service provider in the course of service provision;
(iii) Information relating to diagnosis, facts necessary to the provision of services, or treatment, transmitted in confidence between members of the patient/client's family and the service provider;
(iv) Information relating to diagnosis, facts necessary to the provision of service, or treatment, transmitted between any of the persons specified in (a) (ii) and (iii) above, and persons who participate in the accomplishment of the objectives of diagnosis, fact-finding, or service under the supervision of, or in cooperation with, the service provider;
(v) Any diagnosis or opinions formed by the service provider regarding the patient/client's physical, mental or emotional condition;
(vi) Any advice, instructions or prescriptions issued by the service provider in the course of diagnosis, treatment, or provision of other service;
(vii) Any summary, resume or characterization of the substance, or any part of the information described in sub-sections (f), (i) through (v) of this section 2; and
(viii) Any record, recording, or notation of information described in subsection (f), (i) through (vi) of this section 2, in whatever form and by whatever means recorded or noted.
(ix) Personal information governed by the School Student Records Act is hereby excluded from the application of this statute.
(b) “Patient/client” means a person who consults, is examined, interviewed, treated, or is otherwise served to some extent by a service provider, or a clinical researcher, as hereinafter defined, with regard to a medical, mental, or emotional condition or social deprivation or dysfunction.
(c) “Patient/client identifier” means:
(i) The patient/client's name or other descriptive data from which a person well acquainted with the client might, with reasonable certainty, recognize such patient/client as the described person, or
(ii) A code, number, or other means to be used to match the patient/client with certain confidential information regarding him/her.
(d) “Authorized representative” means:
(i) A person empowered by the patient/client to assert or to waive the confidentiality, or to disclose or consent to the disclosure of confidential information, as established by this Act. Such person shall not, except by explicit authorization, be empowered to waive confidentiality or to disclose or consent to the disclosure of, confidential information;
(ii) If the patient/client is incompetent to assert or waive his rights hereunder, or is in an apparently life threatening or emergency situation, a guardian or conservator, except that pending appointment of such guardian or conservator, the nearest available relative of such patient/client may maintain or waive the confidentiality;
(iii) If the patient/client is deceased, his personal representative or next of kin or
(iv) If the patient/client is less than twelve (12) years of age, his parent or other custodian or guardian.
(e) “Diagnosis, fact-finding, or provision of service” includes observations made for purposes of same and all efforts to prevent, ameliorate, or otherwise overcome the effects of medical, mental or emotional disorders or social deprivation or dysfunction.
(1) “In confidence” means, private disclosures made or intended to be made, so far as the discloser is aware, to no other persons except
(i) The intended recipient;
(ii) Those who are present to further the interest of the patient/client in consultation, examination or interview, diagnosis, treatment, or other service provided;
(iii) Those to whom disclosure is reasonably necessary for the transmission of the information or the accomplishment of diagnosis or treatment, including members of a therapy group of which the patient/client is a participant, and members of the client's family; supervisors or other persons participating in consultation, examination or interview, diagnosis, or treatment, or other service provided under the direction of the provider; third-party payers; and
(iv) Persons reasonably believed to be engaged in good faith in training programs relevant to the activities of the service provided.
(g) “Person” means any natural person, corporation, association, partnership, and any state, local or federal government, or any agency or other part thereof, including a court.
(h) “Service provider” means any person authorized by statute to provide medical, psychological, psychotherapeutic, psychoanalytic, child welfare and/or other social services; any person reasonably necessary for evaluation, diagnosis, consultation, treatment, or care under the supervision of the provider; and, any person reasonably believed by the client to be so authorized or engaged.
3. Authorized Disclosures:
(a) Consent may be given by a patient/client who is twelve (12) years of age or over or by his authorized representative, for the transmission or disclosure of confidential information. Such consent shall be effective only if it is in writing and signed, and also specifies the nature and content of the information to be disclosed, to what person such information may be transmitted or disclosed, and to what use the transmitted or disclosed information may be put. Such specifications shall constitute the limits of the authorization. Every person requesting such authorization shall inform the patient/client or authorized representative that refusal to give such consent will in no way jeopardize his right to obtain present or future service, except where and to the extent disclosure is necessary for service to said patient/client, or for the substantiation of a claim for payment from a person other than the patient/client. The patient/client, or his authorized representative, may withdraw any such consent at any time in writing transmitted to and received by the person authorized to receive such confidential information. Upon receipt of such withdrawal, the person previously authorized to receive said information shall exercise reasonable care in promptly notifying all persons who had previously transmitted information on the basis of said consent, or who might reasonably be expected to do so in the future, that the prior consent has been withdrawn. If consent had been obtained by a person other than the person thereby authorized to receive said information, the person who obtained said consent shall, upon request, promptly, and in the exercise of reasonable care, assist the patient/client in ascertaining the correct name and address to which the withdrawal should be sent. Withdrawal of such consent shall have no effect upon disclosures made prior thereto.
(b) If the patient/client is under twelve (12) years of age or incompetent, consent may be given for the transmission or disclosure of confidential information by the patient/client's authorized representative.
4. Disclosures Without Authorization: Consent from the patient/client shall not be required for the disclosure or transmission of confidential information in the following situations, as specifically limited:
(a) Within the service-providing facility: Confidential information may be disclosed to other individuals employed by the service provider, and to officially designated auditors and surveyors for accreditation, when and to the extent to which the performance of their duties in employment, audit or accreditation requires that they have access to such information. For purposes of this subsection (a), (i) persons engaged in good faith in training programs at a service providing facility and their clinical supervisors are to be considered as being employed by the service provider and may have access to such records and information to the extent reasonably required in their training and duties, but, (ii) individuals employed by the service provider or audit or who are involved in financial audit, preparation of bills or who are otherwise engaged in the collection of charges for services to a patient/client shall not, by virtue thereof alone, have access to confidential records and information, except with respect to names, addresses, and other information essential to the preparation and submission of bills and claims for payment of charges for services to a patient/client.
(b) Clinical supervisors or trainers not employed by the service-providing facility: Confidential information may be disclosed to supervising or training clinicians by service providers who are in training or supervision under a clinician or bona fide training program, whether or not such supervising clinicians are employed by or affiliated with the service-providing facility. For purposes of this subsection (b), the clinical supervisor or trainer receiving such confidential information shall bear the same position and responsibility with regard to the protection thereof as the service provider.
(c) Protection from serious injury or disease; The Abused and Neglected Child Reporting Act: Confidential information may be disclosed, (i) in accordance with the provisions of the Abused and Neglected Child Reporting Act; and (ii), when the statute creating a legislative commission delegates authority to study the needs of minors or incompetents, and to promote services for the protection of the rights and interest of minors or incompetent persons who are in need of, or provided with medical, social and mental health services; subject, however, to guidelines established by the director of the agency providing the service with respect to the validity of the request for material and to the proper precaution as to its confidentiality and use; (iii) when and to the extent a treating or diagnosing service provider, in his sole discretion, determines that such disclosure is necessary to initiate or continue civil commitment proceedings under the laws of this state or to otherwise protect the patient/client or other person against a clear, imminent risk of serious physical or mental injury or disease or death being inflicted upon the patient/client, or by the patient/client on himself or another; and (iv) when and to the extent such is in the sole discretion of the treating or diagnosing clinician, necessary to the provision of emergency medical care to a patient/client who is unable to assert or waive his rights hereunder and there is no relative or other third party available to give consent. Any person, institution, or agency, under this Act, participating in good faith in the making of a report under the Abused and Neglected Child Reporting Act, or in the disclosure of confidential information otherwise in accordance with this provision, shall have immunity from any liability, civil, criminal or otherwise, that might result by reason of such action.
(d) Billing and claims: Information supplied by a service provider to persons involved in the billing for, or collection of, charges for services, shall be limited to names, addresses, dates on which services were performed, and the amount of charges for such services, and shall not otherwise indicate the nature of the conditions for which services were provided. In the event of a claim in any civil action for payment for services, no other confidential information except names, addresses, the dates on which services were rendered, and the amount of charges for such services shall be disclosed in pleadings and motions, except to the extent necessary (i) to respond to a motion of the client for greater specificity, or (ii) to dispute a defense or counterclaim.
(e) Patient/client-litigant exception: Except as provided in paragraph (ii) of this subsection (e)
(i) Confidential information may be disclosed in a civil or administrative proceeding in which the client introduces his physical, mental or emotional condition or any aspect of his diagnosis or treatment for such a condition as an element of his claim or defense if and only to the extent the court in which the proceedings have been brought, or, in the case of an administrative proceeding, the court to which an appeal or other action for review of an administrative determination may be taken, finds, after in camera examination of testimony or other evidence, that it is relevant, probative, not unduly prejudicial or inflammatory, and otherwise clearly admissible; that other satisfactory evidence, such as the results of a present examination of the patient/client by an examining clinician other than the service provider, or stipulations of fact between the parties, are demonstrably unsatisfactory as evidence of the facts sought to be established by such evidence; and that disclosure is more important to the interests of substantial justice than protection from injury to the provider-patient/client relationship or to the patient/client or others whom disclosure is likely to harm. No confidential communication between a service provider and a patient/client shall be deemed relevant for purposes of this sub-section, except the fact of treatment, the cost of treatment and the ultimate diagnosis unless the party seeking disclosure of the communication clearly establishes in the trial court a compelling need for its production.
(ii) This subsection (e) shall not apply to preclude the assertion of the confidentiality privilege as to confidential information disclosed in the course of any treatment of an abnormal mental or emotional condition
(a) In any action brought or defended under the Divorce Act, or
(b) In any action for damages for pain and suffering that does not include a claim for the treatment of such abnormal mental or emotional condition.
(iii) Confidential information or records may be disclosed in a civil proceeding after the patient/client's death when the patient/client's physical or mental condition has been introduced as an element of a claim or defense by any party claiming or defending through or as a beneficiary of the patient/client, provided the court finds, after in camera examination of the evidence, that it is relevant, probative, and otherwise clearly admissible; that other satisfactory evidence, including stipulations of fact between the parties, is not available regarding the fact sought to be established by such evidence; and that disclosure is more important to the interests of substantial justice than protection from any injury which disclosure is likely to cause.
(iv) In the event of a claim made or an action filed by a patient/client, or, following the patient/client's death, by any party claiming as a beneficiary of the patient/client, for injury caused in the course of diagnosis or treatment of said patient/client, the service provider and other persons whose actions are alleged to have been the cause of injury may disclose pertinent confidential information to an attorney or attorneys engaged to render advice about and to provide representation in connection with such matter and to persons working under the supervision of such attorney or attorneys, and may testify as to the said information in any judicial or discovery proceeding for the purpose of preparing and presenting a defense against such claim or action.
(f) Court-ordered examination: Communications made to or diagnoses and opinions made by a service provider in the course of examination ordered by a court for good cause shown may, if otherwise relevant and admissible, be disclosed in a judicial or administrative proceeding in which the patient/client is a party or in appropriate pretrial proceedings, provided such court has found that the patient/client has been as adequately and as effectively as possible informed before submitting to such examination that such communications, diagnoses and opinions would not be considered confidential or privileged. Such communications, diagnoses and opinions shall be admissible only on issues germane to the said proceedings and involving the patient/client's physical or mental condition.
5. Waiver: (a) Particular items of confidential information may be disclosed in judicial proceedings if the court in which the proceedings have been brought finds that the information is relevant and otherwise admissible and that the patient/client or his authorized representative has, without coercion, knowingly waived confidentiality by disclosing, or consenting to disclosure of, the substance of such particular information. In the case of an administrative proceeding, prior to disclosure of confidential information, any dispute as to the issue of waiver of confidentiality shall be referred for determination to the court to which an appeal from the administrative ruling may be taken.
(b) Disclosures that are privileged, disclosures made in the course of obtaining payment for treatment and related services, and disclosures made in the interest of accomplishing a purpose for which the psychotherapist was consulted are not waivers of confidentiality.
(c) For purposes of this section 5, failure by the patient/client or his authorized representative to assert the confidentiality of information in any proceeding in which he has the legal standing and opportunity to do so shall be deemed a consent.
6. Rulings on Claims of Confidentiality: (a) In a ruling on an assertion of confidentiality to prevent disclosure in judicial or administrative proceedings, the court may not require disclosure of information asserted to be confidential under the Act in order to rule on such assertion.
(b) When neither the patient/client nor his authorized representative are parties to an administrative or judicial proceeding or they otherwise lack the opportunity to assert confidentiality, (i) any person asked in administrative or judicial proceedings to disclose confidential information may assert its confidentiality; and, (ii) the presiding officer on his own motion or the motion of any party shall exclude such information. Such presiding officer may not exclude information under this section 6 if, (i) he is otherwise instructed by the client or his authorized representative to permit disclosure; or, (ii) the proponent of the evidence establishes that there is no person authorized to assert confidentiality in existence.
(c) Whenever confidentiality is asserted under this Act in a judicial or administrative proceeding, the party opposing such assertion shall have both the burden of going forward with evidence and the burden of proof with regard to issues of whether confidentiality has been waived and whether any relevant transmissions of information were not made in confidence.
(d) No person shall be held in contempt for failure to disclose confidential information unless he has failed to comply with a court order, a legislative subpoena or an order of an administrative hearing that he disclose such information.
7. Prescriptions: Nothing in this Act shall be construed as limiting or interfering with state and federal regulation and monitoring of the handling and dispensing of prescription drugs; otherwise, however, prescriptions for drugs shall be considered confidential information and subject to the provision of this Act.
8. Research: Persons engaged in research may have access to confidential information that identifies the patient/client where needed for such research, provided no records thereof shall be removed from the service-providing facility that prepared them. Data that do not identify patient/clients or coded data may be removed from a service-providing facility provided the key to such code shall remain on the premises of the facility and no copies thereof are removed. Where the person engaged in research is to have access to confidential information, the research plan first shall be submitted to, and approved by, an appropriate Research Review Committee and by the director of the service-providing facility or his designee. The service-providing facility, together with the person doing the research, shall be responsible for the preservation of the anonymity of the patient/clients and shall not disseminate data that identify a patient/client except as provided by this Act.
9. Mandatory Cautions:
(a) All nonoral disclosures of confidential information shall bear the following statement: “The protection of the confidentiality of information contained herein is required under (chapter) of laws of the State of ( ) which provides for damages and penalties for violations. This material shall not be transmitted to anyone without consent or other authorization as provided in the aforementioned statute.” A copy of the pertinent consent form specifying to whom and for what specific use such communication or record is disclosed or transmitted, or a statement setting forth any other statutory authorization for disclosure or transmittal and limitations imposed thereon, shall accompany all such nonoral disclosures. In cases of oral disclosure, the person disclosing confidential information shall inform the recipient that such information is confidential under the laws of this state.
(b) Service providers shall ensure that all persons in their employ or under their supervision are aware of their responsibilities to maintain the confidentiality of information protected by this Act and of the existence of penalties and civil liabilities for violation of this Act.
10. Civil Remedies and Criminal Penalties: (a) Any person aggrieved by a violation of this Act may petition the court of common pleas for the county in which he or the alleged violator resides or in which such violation occurred, for appropriate relief, including temporary and permanent injunctions, and such petition shall be first priority with respect to assignment for trial. Such aggrieved person may also prove a cause of action for general or special damages, or both, and, in cases of willful or grossly negligent violations, punitive damages.
(b) A willful or grossly negligent violation of this Act shall be punishable as a Class C misdemeanor. For purposes of this section, in cases of willful disclosure of confidential information, each such disclosure of information pertaining to anyone person shall constitute a separate violation.
11. Employee Discipline: (a) Any state, county or local government employee and any employee of a service-providing facility operated under contract to a state, county or local government or department or agency thereof, who repeatedly, willfully or through gross negligence violates this Act, shall be dismissed from employment, or, in the case of mitigating circumstances deemed adequate by the employer, appropriately disciplined and transferred to a position, if available and otherwise suitable, outside a service-providing facility and involving no access to confidential information.
(b) Negligent, nonrepetitive violations of this Act shall render such employees subject to appropriate disciplinary action.
(c) In the course of any disciplinary or dismissal actions against such employees, confidential information shall not be used except to the extent necessary to comply with principles of fair notice and hearing, and patient/client identifiers shall be removed from any such information prior to its use in such proceedings.
(d) All contracts between private persons and any state, county or local government or department or agency thereof involving access by such private persons or their employees, representatives, agents or subcontractors shall include a provision setting forth requirements of this section. Failure to include this clause in any such contract shall not limit the operation of this section.
12. Patient/Client Access to Information: (a) Except as provided in (c) and (d) of this section 12, upon request of a patient/client, a service provider shall, within thirty days following the request, allow the patient/client access to his service record.
(b) The service provider shall establish procedures that: 1) allow a person to purchase copies of his record at a reasonable cost, not exceeding the actual cost of duplication to the service provider; 2) allow a person to contest the accuracy, completeness or relevancy of the record content; 3) allow information contained therein to be corrected on request of the person when the service provider concurs in the proposed correction: 4) allow a person who believes that the service provider maintains inaccurate or incomplete information concerning him to add a statement to the record setting forth what he believes to be an accurate or complete version of those personal data. Such a statement shall become a permanent part of the service provider's personal data system, and shall be disclosed to any individual, agency or organization to which the disputed personal data are disclosed.
(c) If a service provider determines that disclosure to a person of medical, psychiatric or psychological data concerning him would be detrimental to that person, or that nondisclosure to a person of personal data concerning him is otherwise required by law, the service provider may refuse to disclose those personal data, and shall refuse disclosure where required by law. In either case, the service provider shall advise that person of his right to appoint another clinician of his own choice as “clinical mediator” to have access to the record. The “clinical mediator” may, upon review of the record, disclose the record to the person, offer to interpret the contents of the record to the person, or may refuse to disclose. If the “clinical mediator” determines against disclosure and the person is unwilling to accept an interpretation of his record, the service provider shall advise the person of his right to seek judicial relief.
(d) If disclosure of personal data is refused by a service provider under this section 12, the person aggrieved thereby may, within 30 days of such refusal, petition the court of common pleas for the county or judicial district in which he resides or in which the service provider resides or practices, for an order requiring the service provider to disclose the personal data. The court, after hearing and an in camera review of the personal data in question, shall issue the order requested unless it determines that such disclosure would be detrimental to the person or is otherwise prohibited by law, or may alternatively authorize disclosure to a designated clinician or attorney.
(e) If the person is under 12 years of age, his parent or other custodian shall have the rights set forth in this section 12 on behalf of that person. Further, if the person, in consequence of physical or mental incapacity, shall have been placed under guardianship, his guardian shall have the same rights set forth in this section 12 on behalf of that person.
13. Records and Information Pertaining to Minors: (a) All confidential information pertaining to the provision of health and social services to a minor shall be deemed confidential, and no disclosure of such information shall be made to the child's parent or any other person, except:
(i) If a minor who is twelve (12) years of age or older consents in writing;
(ii) As provided by sections 4 and 12 (c) hereof;
(iii) If the service provider obtains information that he or she believes requires action to prevent serious harm to the minor or another person, he or she may disclose that information to the child's parent, guardian or legal custodian, or as appropriate under the provisions of the Abused and Neglected Child Reporting Act;
(iv) All records shall be available to the child's counsel of record and professional and paraprofessional persons associated with the child's counsel and to staff members of the Juvenile Court.
14. Personal Notes: Special Limitations on Disclosure: (a) A service provider is not required to but may, to the extent he or she determines it necessary and appropriate, keep personal notes regarding a patient/client wherein he or she may record:
(i) Sensitive information disclosed to him or her in confidence by other persons on condition that such information would never be disclosed to the patient/client or other persons;
(ii) Sensitive information disclosed to him or her by the patient/client that would be injurious to the patient/client's relationships to other persons; and
(iii) The service providers speculations, impressions, hunches and reminders.
(b) Such personal notes are the work product and personal property of the service provider and shall not be subject to discovery in any judicial, administrative or legislative proceeding or any proceeding preliminary thereto.
15. Group Health and Life Insurance: No person shall demand or request that information as to medical and mental health history, condition and treatment on group health and group life insurance applications, questionnaires and claim forms or any copy thereof or information therefrom, be submitted to an insurance company regarding the insurance coverage of a resident of this state, (a) to or through any member or representative of the group, or (b) to or through the employer or any representative or agent of the employer of the persons covered by such policy, but only directly from the insured or covered persons or their designees and providers of covered health care services or their designees. Insurance companies with group policies covering persons residing in this state and the representatives and agents of such companies, in accordance with rules and regulations to be promulgated by the Director of Insurance, shall, within 120 days from the effective date of this Act (a) take measures to advise group members, employers of group members and representatives and agents of such employers involved in the administration of such policies of the requirements of this section; (b) cause notices regarding this section to be printed prominently on all newly issued or renewal policies, on printed materials intended to be provided to group members and their employers regarding such policies and on all applications, questionnaires, claims and similar forms to be submitted by or on behalf of covered persons and by persons providing covered health care services. For purposes of this section, covered health care services shall include diagnostic and evaluative services. This section shall not apply to applications for life insurance benefit payments.
16. Health and Life Insurance: Prohibition on Requirement of Consent to Disclosure by Insurance Company to Others: No insurance company or any employee, representative or agent thereof shall require of any person residing in this state as a condition of the issuance, continuation, renewal or reinstatement of life, health, accident, medical, hospitalization or similar insurance policy or as a condition of paying any benefits thereunder that an applicant, insured or covered person, or any person acting in his behalf, authorize or agree to authorize such insurance company to disclose or re-disclose confidential information with patient/client identifiers to persons other than itself. Advice that no such requirement may lawfully be imposed must be given in conjunction with any request for such authorization.
17. State, County and Local Information Systems: (a) Official inspections: Nothing in this Act shall be construed as prohibiting any state, county or local government official from performing any audits, investigations or inspections of health or social service facilities in the state as required or authorized by law, provided that the performance of such duties shall not entail removal from any such facility of any confidential information with client identifiers or any codes or keys to electronically processed information.
(b) Statistical reports: Nothing in this Act shall be construed as prohibiting the issuance of statistical reports and similar anonymous data regarding the operations of health or social service facilities.
(c) Electronic data processing:
(i) No electronically processed data of confidential information with patient/client identifiers shall be recorded on equipment outside a mental health facility except in accordance with this section.
(ii) Confidential information regarding current patient/clients may be recorded on electronic data-processing equipment outside a mental health facility only if:
1. Such information is encoded by means that make it impossible for persons other than data-processing personnel within such facility to discern the identity of individual patient/clients;
2. The encoding means or devices by which a patient/client can be identified are delivered, within 60 days after a client is discharged or otherwise ceases to participate in diagnosis or treatment, by data-processing personnel within such facility to a person or persons under the direct supervision of the facility director, which person or persons are strictly denied access to the electronic data-processing equipment and are responsible for the safekeeping of such encoding means or devices and the denial of access thereto to all persons except as provided in subsection (iii) of this section 17;
3. The encoding means or devices by which a former patient/client can be identified may be returned to data-processing personnel for purposes of reactivating access to confidential information stored on electronic data-processing equipment when and only when, (1) the patient/client to which such information pertains has reentered diagnosis or treatment at such facility, or (2) a request for confidential information that may be honored under the provisions of this Act has been received; and
4. No later than 5 years after a patient/client has been discharged or has otherwise ceased to receive services at such facility, or in the case of a minor receiving service that was terminated during his minority, no later than 5 years after attaining his majority, either said encoding means or devices pertaining to such patient/client shall be destroyed, or, (2) all electronically processed data pertaining to such patient/client shall be returned to data personnel at such facility. Those facilities planning long-term epidemiological research may request under the research provisions of this statute special informed consent from the patient/client or authorized representative to maintain the patient/client’s records for an extended period of time. Treatment may not be denied for failure to consent. The patient/client may at any time cancel consent without prejudice.
(iii) Such encoding means or devices may be disclosed (aa) to the extent necessary for auditors regularly employed by the state to inspect electronic data equipment to ensure strict and complete compliance with this Act, provided that such inspections shall not involve the removal of such encoded means and devices, or copies or other reproductions thereof from a mental health facility, (bb) or to the extent required for a fair hearing in connection with the dismissal of an employee charged with violating this Act, and (cc) to the extent necessary for use in a civil or criminal action arising out of violations of this Act.
(d) Indigency investigations: Any agency of state, county or local government charged with responsibility to investigate or audit claims of indigency, hardship or similar status whereby individuals may receive health or social services without charge or on the basis of reduced charges, shall maintain the confidentiality of the patient/clients in the conduct of such investigations or audits and, upon the completion thereof, shall forward a report to the facility or agency for which prepared and shall keep no record of such investigation by which any patient/client can be identified.
18. Disclosures Required in Federally Funded Programs: (a) Confidential information may be disclosed to federal departments and agencies to the extent required under federal law to obtain reimbursement for diagnosis, treatment and other social services under federally funded programs for review and audit that are a requisite for participation in federally funded programs.
(b) Any organization or agency designated under federal law to perform such reviews or audits of the cases of patient/clients who are residents of this state shall maintain the confidentiality of confidential information, shall not disclose confidential information except to the extent required by federal law, and shall destroy the means by which patient/clients can be identified in such information and records containing such information at the earliest opportunity consistent with the requirements of federal law.
(c) To ensure that confidential information regarding citizens and residents of this state is afforded maximum protection consistent with the provisions of this Act, the directors of each state code department delivering health or social services shall promulgate regulations that specify the minimum information required pursuant to subsections (a) and (b) of this section 18 and disclosures in excess thereof shall constitute violations of this Act. In the event a demand for confidential information in excess of that provided for in such regulations is made on any health or social service provider in this state upon pain of disallowance of reimbursement or other benefits, such provider shall immediately refer the matter to the director of the appropriate state code department or his designee, who shall, on behalf of such provider, attempt a resolution of the matter either by negotiation or appropriate court action, or by authorizing said provider to disclose if he determines that disclosure is required by federal law. Disclosures pursuant to the preceding sentence shall not constitute violations of this Act if all reasonable measures to assure confidentiality are taken.
(d) The director of each state code department delivering health or social services shall prepare written notices describing the requirements under any federally funded programs for the disclosure of confidential information and the purposes for such access; and he shall promulgate regulations establishing procedures whereby each person being provided care or other services for which reimbursement will be sought through a federally funded program involving such disclosure will be given such notice at the outset of the delivery of services. Such notices shall provide advice regarding the individual's option not to receive treatment on a basis whereunder such disclosures are required.
1The Task Force on Confidentiality of Children's and Adolescents' Clinical Records (1976-1977) included Frank Rafferty, M.D., chairperson, John Looney, M.D., Herbert Sacks, M.D., and Lenore Petty, M.D., Falk Fellow. Of Counsel: Sandra Nye, J.D., M.S.W.
2The Committee on Confidentiality (1976-1977) included Jerome Beigler, M.D., chairperson, Ben Bursten, M.D., Maurice Grossman, M.D., Alan McLean, M.D., Don Mosher, M.D., Herbert Sacks, M.D., Hugo Van Dooren, M.D., and Robert Friedman, M.D., Falk Fellow. Of Counsel: Sandra Nye, J.D., M.S.W.
Am. J. Psychiatry 136(1):137-144, January 1979.
OFFICIAL ACTIONS Commentary on Model Law on Confidentiality of Health and Social Service Records
BY SANDRA NYE, J.D., M.S.W.
THIS MODEL ACT addresses and incorporates three allied legal concepts: confidentiality, privacy, and testimonial privilege. These are highly technical and frequently misunderstood. Privilege is an evidentiary concept which provides an exception to the general principle of law that courts have the right to every man's evidence. The concept has relevance only in context of the testimonial arena. A testimonial privilege (or shield law) permits those protected by it to withhold testimony or records, notwithstanding a subpoena (1). The right to privacy protects the individual from unsolicited, unwarranted intrusion in the conduct and affairs of his lifeincluding the right to keep to himself information about himself (2). The right of a patient/client to confidentialityand the concomitant duty of the care provider to maintain the patient/client's confidentialityinheres in the contractual nature of the provider-patient/client relationship. Implied in the contract is a covenant not to disclose (3, 4).
Part of the complexity of this Model Act arises by reason of the legal principles on which it is based and which it intends to alter. In overturning existing law, every detail to be changed must be explicated. Any concept not expressly altered will remain the law. Thus, the Model Act must not only create and articulate novel concepts and procedures but must expressly eliminate or alter existing ones. For example, it is clearly established by case interpretation of statutory or common law privileges that the identity of a patient/client, the fact of the professional relationship, and purely clerical datasuch as dates of service deliveryare not privileged communications and are, therefore, not protected from compelled disclosure in a legal proceeding (5). Further, the presence of a third person who is not a party to the provider-patient/client relationship (e.g., a family member or group member) “pollutes” any privilege that might have existed between the provider and the patient/client (6). Such technicalities as these have severely curtailed the efficacy of the communications privilege as a protection to psychiatric patients.
The Model Act is intended to serve as a basis for examining and proposing changes in local legislation. Although it represents the product of a thorough study of this subject and the combined thinking and expertise of many learned professionals, there are doubtless aspects that may be improved. The caveat to be kept in mind in working with the Act is that much of its phraseology consists of “terms of art.” A knowledgeable lawyer should be consulted in any redrafting effort. In the limited space available for annotation, it is not possible to provide thorough explication and legal authority. We ask that the reader take on faith, for the time being, that what appear to be redundancy, prolixity, or tortured sentence construction translates in “legalese” as meaningful.
1. Scope. This Act defines both a communications privilege and a general law of confidential information. Thus, in addition to protecting confidential information from compelled disclosure in a judicial, legislative, or administrative proceeding, it also establishes a positive statutory duty on health and social service providers to maintain patient/client confidentiality. A salient principle of the Act is that all patient/client information given for the purpose of health care and social service delivery must be protectedirrespective of the nature of service delivered or the discipline or professional status of the care provider. This is a significant departure from most existing law, which makes irrational distinctions in protecting information as to care setting and care provider credentials. The needs of the patient/client for privacy and confidentiality do not differ according to whether the care provider is a social worker, a paraprofessional, or a psychiatrist. It should be public policy to mitigate fear of stigmatization (said to be the greatest barrier to seeking mental health services) so as to encourage individuals to seek necessary health and mental health care and social services.
2. Definitions. Explicit and detailed definitions are required to extend protection to categories of persons and data heretofore excluded by common law principles and certain statutes.
3. Authorized Disclosures. The nature of consent for disclosure is defined and delimited. This section clears up many existing ambiguities and procedural questions and outlines in detail the rights and duties of persons seeking disclosure, of care providers, and of patient/clients.
The minimum age at which consent may be given is established as 12 years. This is consistent with current child development theory recognizing the privacy and confidentiality needs of adolescents receiving mental health treatment and with existing federal and state legislation authorizing persons of this age to consent to certain types of treatment and other services. It is to be noted that parental notification will be automatic in most cases simply by reason of the parent's initiation of or involvement in the service delivered to the minor, or the minor's consent that disclosure be made to his/her parents. In the few cases in which the minor obtains services by reason of legal capacity to do so and does not authorize disclosure to his/her parents, the service provider who deems it necessary to notify the parents in order to protect the minor from serious injury or health hazard has the option under section 4 (c) to do so without the minor's consent or over his/her objection.
4. Disclosures Without Authorization. Although the underlying philosophy of the Act is that an individual has the right to control his/her private and confidential information, there is no question but that certain disclosures of such information are not only necessary but appropriate. In recognizing the “need to know,” the following principles are essential:
a. Unauthorized disclosures should be kept to a minimum, consistent with the needs of the patient/client and the exigencies of service delivery.
b. The primary duty of the service provider is to the patient/client. There is no duty upon a provider to protect third parties, but there may be instances in which the provider deems it in the patient/client's interest to disclose confidential information to protect the patient/client or another from serious harm. This is left to the sole discretion of the service provider, who is immunized against liability for any such disclosure in good faith.
The Patient/Client-Litigant Exception (subsection 4 (e)) is an almost universal exception to existing privilege laws. The adage that “confidentiality is to be a shield, not a sword” decrees that a patient/client waives any privilege he may have as to material relevant to the trial of a lawsuit in which he is a party. This section is based in part on guidelines set forth by Judge Shirley Hufstedtler in her brilliant dissenting opinion in Caesar v. Mountanos (7). It further excludes from the rubric of “mental condition” an action for pain and suffering per se and incorporates a refinement of Illinois law eliminating the exception in divorce cases (8). Strictures are placed on disclosure after the death of the patient/client because the threat of disclosure after death may serve to inhibit communications, particularly in mental health care delivery. This subsection clears up a problem presently existing in some jurisdictions that holds that the privilege expires with its holder.
Court-ordered examination (subsection 4 (f)). Service providers are frequently called upon to conduct examinations for trial purposes. Although clinical skills are utilized in such examinations, the information conveyed is intended to be disclosed, and communications made in the course of such examinations are not protected by a privilege. The relationship of examiner to the subject of the examination is not that of service provider and patient/client. Disclosure should, however, be limited in accordance with the purpose for which it is made.
5. Waiver. At common law, a communication not expressly asserted by its holder is deemed waived. This section clarifies the question of waiver and obviates certain “accidental” or “resulting” waivers.
6. Ruling on Claims of Confidentiality. This section protects, to the extent possible, confidential information during a controversy as to its discoverability or admissibility in a judicial or administrative proceeding. The person seeking disclosure has the burden of establishing discoverability or admissibility. The court is empowered to protect confidential information in appropriate cases in which there is no person in existence who is otherwise empowered to do so.
7. Prescriptions. The patient/client's need for confidentiality is balanced by the interest of the community in regulating drugs.
8. Research. Although confidential information disclosed by a patient/client in the course of receiving health and social services is intended by the patient/client to be utilized for his direct benefit in service provision, the value to the community in accessibility of data for research and development cannot be overlooked. This section provides access to data under strictures that will protect the patient/client.
9. Mandatory Cautions. The disseminator of confidential information is charged with the instruction of employees and disclosees as to the protection of the information he/she is disclosing.
10. Remedies. Civil (equitable and legal) relief is authorized for any person aggrieved by violation of this Act. In some jurisdictions violations of confidentiality statutes have been discouraged by criminal sanctions as well. Alternatives are provided herein.
11. Employee Discipline. This section is intended to enable employers to take appropriate action against employees who willfully or by gross negligence violate the Act. Employers are said to fear that, without such provisions, civil service and union procedures will effectively preclude disciplinary action against erring employees who are employed under civil service regulations or union contracts and whose wrongful acts not only injure patient/clients but also expose the employers to liability.
12. Patient/Client Access to Information. As a general principle, it is held that every person should have access to any record of information about him. If information is to be disclosed pursuant to consent, such access is probably mandatory. (Consent is not valid unless informed; one cannot give informed consent to disclose unless he/she has knowledge as to the content of the disclosure.) Further, a patient/client should have an opportunity and right to seek correction or at least enter his/her opinion into a record that contains an error or with which he/she disagrees. Experience with allowing patient/client access to records has been positive. At the same time, some clinicians are concerned that there may be occasional instances in which the patient/client will be harmed by such access or the treatment process compromised. A procedure is established that, although possibly cumbersome, will allow access as a general rule and will offer protection in cases in which the service provider deems access to be against the interest of the patient/client.
13. See annotation to Section 3, supra.
14. Personal Notes. This concept has been discussed for a number of years as a device by which clinicians can protect records of certain types of data (9). As the public insistence on patient/client right of access to records has grown, some care providers have been concerned about the effect on the individual who discovers unknown facts about him/herself or others or is exposed to speculations and interpretations of the clinician. Some informationalthough clinically relevantmay be so “sensitive” as to warrant excluding it from the case record entirely. Notes kept by the care provider for use in research, teaching, or supervision may contain material that is inappropriate for the clinical record. Further, by reason of the nature of mental health treatment, certain record content may be highly prejudicial to the patient/client if disclosure is compelled in a judicial or other proceeding.
The “personal notes” concept borrows from a protection afforded “the work product of the attorney.” Certain specific types of material can be recorded in the clinician’s “personal notes,” which are to be utilized by the clinician for his/her own purposes and may not be disclosed or discovered. Concern has been expressed by some administrators and attorneys that this device will afford lazy, careless, or unscrupulous care providers a means of “hiding their wrongdoings” or, at best, neglecting their recordkeeping. Although it is not possible to preclude wrongdoing on the part of any person who is so inclined, the language of the section is eminently plain and clear as to the limited usage of “personal notes.” The value of the device in protecting patients and enhancing service provision is deemed to outweigh any possible misuse potential.
15. Group Health and Life Insurance. Although the insurance industry denies the charge, there is a widespread belief that it is the major perpetrator of privacy and confidentiality offenses. In any case, care providers and patient/clients have expressed outrage over insurance company demands for information. A particular source of concern has been the practice of claims processing through employers. This section establishes parameters for data collection by insurors and requires that information about these parameters be supplied to the insured.
16. Health and Life Insurance Disclosure of Information. Of the several insurance company practices objected to by providers and patient/clients, one of the most decried is the exchange and dissemination of data among insurors. The practice is widespread; the insurors insist they have a need and right to protect themselves. The many documented abuses of this practice lead to the conclusion that it must be curbed. The interests of the individual and the community in encouraging health careand particularly mental health careare held to outweigh the financial interest of the insurors.
17. State. County and Local Information Systems. Electronic data collection and storage is perceived as a threat to individual liberty (10). Despite the best intentioned efforts at safeguarding data banks, they are vulnerable to invasion and misuse. Rules for protecting patient/client privacy and confidentiality are established in the light of the realities of audit and accountability requirements.
18. Disclosures Required in Federally Funded Programs. The practical exigencies of federal funding are recognized in this section, with safeguards established for confidential information being disclosed. Notice to the patient/client relative to disclosures and options is required.
Ms. Nye is Assistant Professor, Department of Psychiatry, University of Illinois Abraham Lincoln School of Medicine, and Director of Legal Affairs, Jewish Family and Community Services, 1 South Franklin St., Chicago, Ill. 60606.
REFERENCES
1. Slovenko R: Psychiatry and Law. Boston, Little, Brown and Co, 1973, p 61
2. Perr I: Problems of confidentiality and privileged communications in psychiatry. Leg Med Annu 1971, pp 327-341
3. Hammonds v Aetna Casualty Surety Co, 243 F Supp 793 at 801 (N D Ohio, 1965)
4. Doe v Roe, 345 NYS 2d 560, aff’d 33 NY 2d 902, 352 NYS 2d 626, 307 NE 2d 823, 20 ALR 3d 1109 (1977)
5. 97 CJS Witnesses, 283
6. 81 Am Jur 2d Witnesses
7. Caesar v Mountanos, 542 F 2d 1064 (9th Cir 1976)
8. Beigler JS: The 1971 amendment of the Illinois statute on confidentiality: a new development in privilege law. Am J Psychiatry 129:311-315, 1972
9. Jackson CBJ Jr: Consideration of the “active working record” versus the “permanent record.” Psychiatric Opinion 12:29-33, 1975
10. Nycum SH: Computer abuses raise new legal problems. American Bar Journal 61:444-448, 1975
Am. J. Psychiatry 136(1):145-147, January 1979.