Navigating the Legal Barriers to Sharing Consumer Information

1. Navigating the Legal Barriers to Sharing Consumer Information Oklahoma Department of Mental Health and Substance Abuse Services Deneka Turney Cain Deputy General Counsel July 13-14, 2009

2. You want to do what?? Give substance abuse and mental health treatment information to the Department of Corrections; On any person who is currently receiving SA/MH treatment in DOC custody; On any person who has received SA/MH treatment in our system and is now at DOC; Which means we have to get protected information from DOC to match; DOC wants to use this information to help them take care of their population; We cannot get consents from most because of fear/stigma/illness; So, we want to do it without getting consents; There are multiple projects with multiple funding streams, dates of actions, purposes and goals.

3. Barriers • The Law – State and Federal • 43A Section 1-109 • HIPAA • 42 CFR Part 2 • Type of Agreement • Business Associate Agreement (BAA) • Qualified Service Organization Agreement (QSOA) • Agreement Components: • Covered Entity? • Program? • Timeframe Issues? • What is the purpose/service? • What exactly is shared? • Actual Structure • TRUST & COMFORT

4. DMHSAS & DOC are both “Covered Entities” - just the “unit” is subject to HIPAA. - providing different services. • DMHSAS is a “program.” A portion of DOC is a “program.” - Just the “unit” is a program. • DOC is not law enforcement. - housing unit - special provisions in agreement on “use” of information • Only the “unit” has access to information. - minimum amount necessary - helped facilitate trust between agencies The Hybrid Agreement… Covered Entities & “Programs.” THE RULES: One covered entity can act as a BAA to another. 45 §160.103 “Programs” cannot enter into QSOA’s with other programs providing the same services or with law enforcement. HHS Opinion 78-27

5. What is the service/purpose of the agreement? • Isn’t it all just treatment services?? - No. The purpose of each agency isn’t to provide treatment services. Service was based on the specific project…i.e. placement, staff safety, transition from custody, etc. • Isn’t the background just the mission of the agency? - No. It is the mission and what led to the project…i.e. decrease recidivism, early intervention, custody diversion, etc. • Isn’t the purpose just to share everything on everyone? - No. Each project is item specific, depending on background and purpose.

6. TRUST & COMFORT • The biggest barrier… • Built in safety hatches, like termination, restricted access, signed documents, accountability. • Lots of discussion and face to face time. • IT IS A GOOD THING!!

7. General Purpose of Agreement When ODOC is the “Contractor” or “Receiving Party”, the general purpose of this Agreement is to support implementation of the following ODMHSAS Strategic Plan long-term goals, themes and strategies: a.      Provide and/or facilitate provision of needed services to persons in the criminal justice system; b.      Provide and/or facilitate provision of competent services to traditionally under-served populations, which include populations in the Oklahoma Department of Corrections; c.      Facilitate development of sufficient treatment capacity to address the size, composition and distribution of the state’s population, which includes the re-entering prison population; d.      Facilitate provision of services to former ODMHSAS consumers and consumers of ODMHSAS contracted providers that recognize and address the comprehensive and holistic needs of the people served; e.      Establish planning and partnerships with agencies such as Contractor.

8. When ODMHSAS is the “Contractor” or “Receiving Party”, the general purpose of this Agreement is to provide continuity of care to individuals who have received either ODMHSAS or ODOC mental health and/or substance abuse services, increase identification and appropriate treatment of those who are entering ODOC custody by addressing those mental health and substance abuses issues identified and/or treated by ODMHSAS and/or contracted providers of ODMHSAS while in the community, to decrease danger to consumers, staff, and others in ODOC custody, and address placement and referral by addressing said issues.  These aims will be met by implementing federal grant projects, state-funded programs and other initiatives for providing continuity of care to consumers involved in the criminal justice system.  The federal grant projects, state-funded programs and other initiatives, and the data to be shared in support of each effort, are listed in Attachment A.   Attachment A may be modified at any time by consent of the parties, which is evidenced by an affixed signature of the Commissioner of the ODMHSAS and the Director of the ODOC, or the respective designee of each party agency.

9. Table Headings • Background • Purpose • Service • Contractor • Targeted Population • Date Requested • Variables • Consent • Start & End Date

10. Notice of Privacy Practices • If you are ever incarcerated with the Oklahoma Department of Corrections, we may share your information with DOC for treatment purposes through a legally recognized Qualified Service Organization Agreement or Business Associate Agreement. • If you or your children are placed in the custody of the Oklahoma Department of Human Services, we may share your information for program evaluation purposes.

11. References • 43A O.S. §1-109 (Oklahoma) • 45 C.F.R. Parts 160 and 164 (HIPAA) • 42 C.R.R. Part 2 • Opinion 78-27, Office of General Counsel, Public Health Division, U.S. Department of Health and Human Services (Dec. 6, 1978) • Confidentiality and Communication. A Guide to the Federal Drug & Alcohol Confidentiality Law and HIPAA. Legal Action Center, 2006 Edition