Delaware Health and Social Services Division of Developmental Disabilities Services Dover, Delaware Title: Confidentiality and Release of Information Approved By:____________________ Division Director Written/Revised By: DDDS Policy Committee Date of Origin: April 2000 Revision Date: July 2006 Date of Implementation: September 15, 2006 I. PURPOSE Individuals receiving services from the Division of Developmental Disabilities Services (DDDS) have the right to privacy of information. The sharing of confidential information must be balanced by the obligation to protect the individual’s best interest. Uniform standards and procedures to ensure the confidentiality of information and for the release of confidential information are established to protect that right. II. POLICY Information contained in the records of individuals receiving services is confidential and is protected from loss, damage, tampering, and unauthorized use or duplication. The Division of Developmental Disabilities Services (DDDS) protects the confidentiality of an individual’s information by restricting access to and the release of information. III. APPLICATION All DDDS employees and any person or entity who provides services, in any capacity. IV. DEFINITIONS A. Breach of Confidentiality: Providing or allowing access to confidential information to a person who is not authorized to have that information within the scope of his/her job or without valid consent for release of that information. A breach of confidentiality may be intentional or unintentional. Examples of breach of confidentiality include, but are not limited to: 1. Providing a copy of or duplicating part or all of an individual’s record without proper authorization; 2. Sharing confidential information with another person other than within the scope of job performance; 3. Copying, duplicating, or allowing someone else to copy or duplicate all or parts of an individual’s record or other confidential information except as permitted by policy; 4. Removing or allowing another to remove all or part of an individual’s record or other confidential information; 5. Taking part or all of an individual’s record out of an approved area except as permitted by policy; 6. Failure to exercise due caution to prevent loss, damage, tampering, unauthorized access or unauthorized use or duplication of information contained in an individual’s record; Administrative Policy Manual Confidentiality and Release of Information Page 2 IV. DEFINITIONS (continued) 7. Failure to exercise due caution in preventing conversation, sensitive discussion or casual reviewing of information regarding an individual from being overheard/viewed by individuals without authorization to access such information. B. Business Day: Monday through Friday, excluding holidays recognized by the State. C. Confidential Individual Information: Any information that is derived from a clinical relationship between an individual and healthcare professionals. This includes all information concerning an individual’s diagnosis, care, treatment, level of function, prognosis, placement, financial status, psycho/social, psychological or medical history, and family information contained in the individual’s record or in an electronic database; incident, injury and death reports, unit records, and assessments or files maintained by professional disciplines. D. Consent: An agreement to an action that involves three elements which include: 1) the capacity to understand and make choices; 2) the information on which the consent decision is based (which shall be presented in terms understandable to the individual and/or substitute decision- maker); and 3) the voluntariness of the decision. E. Health Care Provider: An individual licensed, certified or otherwise authorized or permitted by law to provide health care in the ordinary course of business or practice of a profession. F. Surrogate (known also as Personal Representative in HIPAA regs): For the purpose of this policy, a surrogate may include the following individuals, in descending order of priority: 1. A legal guardian of person or other legally recognized agent assigned to make decisions for an individual in that individual’s best interest when he/she is not competent or otherwise unable to give informed consent. 2. A person identified by a mentally competent individual receiving services, to his/her supervising health care provider, in the presence of a witness. 3. If an individual receiving services has been determined by his/her attending physician to lack capacity and the individual has no agent or guardian, any member of the following classes of the individual’s family who is reasonably available, in the descending order of priority may act as a personal representative for the purpose of requesting and receiving protected health information. a. The spouse, unless a petition for divorce has been filed, or unless the patient has filed a petition or complaint alleging abuse, as defined in § 1041(1) of Title 10, of the patient by the spouse; b. An adult child; c. A parent; d. An adult sibling; e. An adult grandchild; f. An adult niece or nephew. (Title 16 of Del. C., Ch. 25 §2507, Title 16 of Del. C., Ch. 12, §1232 (f)). 4. An adult who has exhibited special care and concern for the individual receiving services, who is familiar with his/her personal values and who is reasonably available may serve as a personal representative, only in the absence of any of the aforementioned individuals. Administrative Policy Manual Confidentiality and Release of Information Page 3 IV. DEFINITIONS (continued) G. Privacy/Complaints Officer: In accordance with 45 CFR Section 164.530 (a) (1) (ii), this designated individual shall receive complaints related to violation of the HIPAA Privacy Act and provide information about matters covered by the Notice of Health Information Practices. The HIPAA Privacy Committee shall advise and support the Privacy/Complaints Officer. H. Protected Health Information: All individually identifiable health information (communicated electronically, on paper, or orally) that is created or received by covered entities (DDDS) or its business associates (provider agencies) that transmit or maintain information in any form. V. STANDARDS A. Individuals receiving services from the Division of Developmental Disabilities Services shall have the right of privacy of information. A “Statement of Confidentiality of Information” shall be maintained in each individual’s COR and Program Book. B. Individual-identifiable data and information, regardless of medium in which stored, belongs to the individual and shall be protected accordingly. The medium on which the information is stored, paper, audio or computer-based, is the property of the Division of Developmental Disabilities Services and shall be maintained in secure, authorized locations in accordance with legal, accrediting, licensing, regulatory, and ethical standards. C. It is the responsibility of each employee to ensure that individuals’ records are kept in a secure location, are transported in such a manner as to protect them from loss, damage, tampering or abuse, and are not removed from the care of the Division of Developmental Disabilities Services except by court order or with the expressed permission of the Division’s HIPAA Privacy Officer. D. The following parties shall have access to pertinent and confidential information from an individual’s record if they have a need to know: 1. Division of Developmental Disabilities Services staff (or contractual representative) responsible for the planning, evaluation or execution of the individual’s treatment or programming; 2. Consultants participating in the individual’s care; 3. Students in clinical affiliation; 4. Other agencies providing active treatment services; and 5. Representatives of fiscal intermediaries and/or regulatory bodies whose access is authorized by conditions of program participation or Delaware Code. E. Written authorization to release information shall not be required for access to or release of confidential information: 1. To individuals receiving services who are legally able to give informed consent for disclosure of Protected Health Information (PHI) if provided directly to the individual; 2. In a bonafide emergency situation posing significant imminent risk to the individual receiving services; 3. To Division of Developmental Disabilities Services staff responsible for the planning, evaluation, or execution of the individual’s treatment or programming; 4. To consultants, contracted service providers and students in clinical affiliation participating in the care or training of the individual; Administrative Policy Manual Confidentiality and Release of Information Page 4 V. STANDARDS (continued) 5. To representatives of fiscal intermediaries whose access is authorized by conditions of program participation (Medicaid, Medicare), regulatory agencies; 6. To administrative committees of the Division of Developmental Disabilities Services or state agencies investigating an individual’s rights issues; and 7. To agencies providing active treatment services. F. Volunteers shall not have access to individuals’ records unless they are the legally authorized personal representative. G. Written authorization to release information shall be required for the disclosure of protected health information, via the use of the Personal Representative Request to Release Information or Release of Information Authorization. H. Release of Information Authorization and Personal Representative Request to Release Information forms shall expire one (1) year from the date they were signed, unless an earlier expiration date is designated. I. Individuals’ legal guardian or recognized surrogate (and his/her contact information) shall be documented on the Social Assessment and Social Assessment Update. This information shall be immediately updated by the DDDS Social Worker/Case Manager as changes occur. J. The determination of a surrogate for a person with no legal guardian or agent shall meet the following conditions: 1. The person shall be determined to lack capacity by the attending physician; 2. The attending physician’s determination shall be documented in the COR. K. The attending physician’s determination relative to capacity shall be documented via the Annual Physical Examination or a similar written statement from the physician (example included in Exhibit I). L. The need for a legal surrogate and the process for such shall be reviewed by the Family Support Specialist (or person in a comparable position) with the individual and his/her family at the initial contact. Exhibit I may be used if documentation of the attending physician’s determination relative to capacity is needed. M. Physical Examination forms shall include the following assessment by the physician: Does the individual lack the capacity to understand significant benefits, risks and alternatives to health care decisions? ______ Yes ______ No N. Reasonable efforts shall be taken to limit the use, disclosure or request of protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. Administrative Policy Manual Confidentiality and Release of Information Page 5 V. STANDARDS (continued) O. Requests by an individual to view his/her record shall be referred to the Health Information Management (HIM) Department and honored by the next business day following the receipt of an approved Release of Information Authorization, in accordance with 16 Delaware Code § 1121 (19). P. Request by an individual for a copy of his/her record or portions of his/her record shall be referred to the Health Information Management (HIM) Department. Requested information shall be released within 2 working days of receipt of an approved Release of Information Authorization and in accordance with 16 Delaware Code § 1121 (19). The cost of the purchase shall not exceed community standards. Q. An adult individual who receives DDDS services may request that a surrogate who does not hold legal guardianship be denied or restricted access to confidential information, in accordance with 45 CFR 164.522 (B). Such a request shall be documented by the Social Worker/Case Manager and copied to the Health Information Management (HIM) Department. R. All employees who have access to confidential information about individuals receiving services have an ethical and legal obligation to maintain confidentiality about this information. Breach of confidentiality on the part of a Division of Developmental Disabilities Services employee may result in discipline up to and including termination of employment and possible legal action on the behalf of the individual. S. Each employee shall sign a “Confidentiality Statement” at the beginning of employment and shall periodically be informed of what constitutes privacy and breach of confidentiality. All other persons who have access to confidential individual information as specified by Standard “D” shall also sign a Confidentiality Statement/Agreement prior to being permitted access to confidential individual information. T. Confidential information shared verbally through meetings and discussion shall be subject to the same confidentiality requirements as apply to written information. U. Violation of this policy may be grounds for contract termination and for possible legal action on the behalf of the individual receiving services. V. Only authorized personnel shall have access to electronic data processing equipment which is used for personal information systems. W. Nothing in this policy shall be construed to prohibit federal, state, or local officials from having access to confidential records which may be necessary in connection with audits or the enforcement of federal and state laws and regulations which relate to those records. Administrative Policy Manual Confidentiality and Release of Information Page 6 X. If suit is brought by or on behalf of the individual against the Division of Developmental Disabilities Services, the right to privacy shall be considered waived in relation to Division activities associated with the suit. Y. An individual may file a HIPAA Privacy Act Complaint Form to the DDDS Privacy Officer if he/she has reason to believe that there has been a violation of a HIPAA Privacy Regulation (45 CFR, Section 164). Z. The operation of this policy is superseded by applicable federal and state laws as well as the DHSS Policy Memorandum #5. AA. Freedom of Information Act (FOIA) Requests to the Department of Health and Social Services shall be forwarded to the DDDS Deputy Director. VI. PROCEDURES RESPONSIBILITY ACTION Receiver of Request to Release Information 1. Directs person making request to assigned DDDS Social Worker/Case Manager/Family Support Specialist (if person is the recognized surrogate) or the H.I.M. Department for all other requests. DDDS Family Support Specialist or Contracted Agent 2. Reviews the DDDS practice of protecting confidentiality and the requirements to release information to anyone other than the person receiving services. 3. Provides family with Exhibit I, Designation of Surrogate, if applicable. DDDS Social Worker/Case Manager/ Family Support Specialist 4. Assists the surrogate, as needed, to prepare the Personal Representative Request to Release Information. Requests to release information from persons other than the surrogate shall be made on the Release of Information Authorization form. 5. Completes the bottom section of the Personal Representative Request to Release Information and forwards to the H.I.M. Department, immediately upon its receipt. Administrative Policy Manual Confidentiality and Release of Information Page 7 Health Information Management Department 6. Receives request, via an approved Release of Information Authorization to view record and ensures the request is honored within one business day. 7. Receives an approved Release of Information Authorization to release a copy of the record and ensures the request is honored within two business days of notice. Ensures cost of purchase does not exceed community standard. VII. SYNOPSIS This policy continues to address the requirements to protect confidential information and delineate the process by which information may be disclosed. HIPAA regulations defer to the States to define “personal representatives”. As such, the State of Delaware has embraced the definition of “surrogate” as found in Title 16, section 2507. The revisions to this policy clearly define who may act as an individual’s surrogate, under what circumstances and how such should be documented. VIII. REFERENCES A. 1996 Survey Procedures and Interpretive Guidelines for Intermediate Care Facilities for Persons with Mental Retardation (ICF/MR) B. The Council on Quality and Leadership in Supports for People with Disabilities C. Title 16 of Del.C., Ch. 11, §1121 (6), (19), 1122 D. Title 16 of Del. C., Ch 12, § 1230-1232 E. Title 16 of Del. C., Ch. 25, § 2507 F. DHSS Policy Memorandum #5 IX. EXHIBITS A. Statement of Confidentiality of Information B. Confidentiality Statement C. Release of Information Authorization D. HIPAA Privacy Act Complaint Form E. Personal Representative Request to Release Information F. Delaware Code, Title 16, Section 2507 G. Annual Physical Examination Form- Community Services/Adult Special Populations H. Social Assessment Update Form- Community Services/Adult Special Populations I. Designation of Surrogate EXHIBIT A Delaware Health and Social Services DIVISION OF DEVELOPMENTAL DISABILITIES SERVICES STATEMENT OF CONFIDENTIALITY OF INFORMATION This record is the property of Delaware Health and Social Services. Its confidentiality must be protected by all staff against loss, damage, tampering, unauthorized access, use or duplication. All information contained in this record is considered confidential. Providing or allowing access to information in this record to a person who is not authorized to have that information within the scope of his/her job or without valid consent for release of that information is a breach of confidentiality. Breach of confidentiality is a violation of federal Health Insurance Portability and Accountability Act (HIPAA), Medicaid regulations, Delaware Nursing Home regulations, the Department of Health and Social Services Policy Memorandum #5 and Division of Developmental Disabilities Services policy and may subject the violator to disciplinary action, civil or criminal legal action. Reviewed by PARC on 04/11/05 Form # 30/Admin EXHIBIT B Delaware Health and Social Services Division of Developmental Disabilities Services CONFIDENTIALITY STATEMENT I hereby understand and agree that: 1. Personal information, in any form, about any individual receiving services from the Division of Developmental Disabilities Services or one of its contracted agencies is confidential and may be privileged; 2. Confidential information shall be protected and shared only with my supervisor(s) and/or others who have an absolute need to know; 3. If I have a question about confidentiality, I will ask my immediate supervisor. If my immediate supervisor is not available, I will follow my supervisory reporting line to obtain an answer; 4. Sharing confidential information outside the context of a professional/service and support discussion is expressly prohibited, and 5. Any breach of confidentiality may result in disciplinary action up to and including termination. As witnessed by my signature below, I certify that I have read this Confidentiality Statement, or it has been read to me, and I have had the opportunity to discuss my questions and concerns. Name Witness Date PARC Reviewed on 04/11/05 Form # 31 /Admin EXHIBIT C Delaware Health and Social Services DIVISION OF DEVELOPMENTAL DISABILITIES SERVICES -Release of Information Authorization- I hereby authorize: The Division of Developmental Disabilities Services Health Information Management Department 26351 Patriots Way Georgetown, DE 19947 to release information concerning _______________________________________________ to (Individual’s Name and Date of Birth) ________________________________ __________________________________ (Name and Title of Person Making Request) (Name of Organization/Agency Making Request) ________________________________ __________________________________ (Street Address) (City, State, Zip Code) for the purpose of: __________________________________________________________________ __________________________________________________________________________________ __________________________________________________________________________________ Specific information requested: ________________________________________________________ __________________________________________________________________________________ __________________________________________________________________________________ _________________ Signature of Individual Receiving Services Date Signature of Legal Guardian or Other Legally Authorized Representative Relationship Date Consent automatically expires one (1) year from the date signed unless earlier expiration date is designated. Information disclosed may be re-disclosed by the recipient and is no longer protected by the Division of Developmental Disabilities Services PARC Reviewed on 04/11/05 Form # 33/Admin EXHIBIT D Division of Developmental Disabilities Services HIPAA Privacy Act Complaint Form I. Please explain the reason for submitting a HIPAA Privacy Act Complaint. It is important that you are as specific as possible so that your complaint can be thoroughly reviewed/ investigated. _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ II. Please explain your response (what you did, what you said) when you became aware of a violation to the HIPAA Privacy Act. _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ _________________________________________________________________________________________ III. Please complete information about yourself in case you need to be contacted for further information. Name: ______________________________________________________________ Title: ______________________________________________________________ Address: _____________________________________________________________ _____________________________________________________________ Phone # and best time to contact you:_____________________________________ IV. Please submit this completed form to the following address: Stockley Center Attention: HIPAA Privacy/Complaints Officer 26351 Patriots Way Georgetown, DE 19947 (302) 934-8031 Reviewed by PARC on 04/11/05 Form # 34 /Admin Exhibit E Delaware Health and Social Services Division of Developmental Disabilities Services Personal Representative Request to Release Information I herby authorize: The Division of Developmental Disabilities Services Health Information Management Department 26351 Patriots Way, Georgetown, DE 19947 to release information to me concerning ________________________________________________________. (Individual’s Name and Date of Birth) for the purpose of: _________________________________________________________________________ _________________________________________________________________________________________ Specific information requested: _________________________________________________________________________________________ _________________________________________________________________________________________ I attest that I am the Personal Representative for the aforementioned named individual as evidenced by the following identified relationship (please initial one) and delineated in Delaware Code, Title 16, Section 2507. _____ Spouse (unless petition for divorce has been filed) _____ Adult Grandchild _____ Parent _____ Adult Sibling _____ Adult who has exhibited special care and concern for the individual _____ Adult Niece/Nephew Signature of Person Receiving Services Date or Personal Representative Mailing Address: ----------------------------------------------------------------------------------------------------------------------------------- For Use by DDDS Social Worker/Case Manager/Family Support Specialist The signatory above is the personal representative on record, in accordance with Delaware Code, Title 16, Section 2507. Yes No The adult individual receiving services has requested a restriction of uses and disclosures. Yes No Social Worker/Case Manager/Family Support Specialist Date Consent automatically expires one (1) year from the date signed unless earlier expiration date is designated PARC Reviewed on 07/25/06 Form # 41/Admin Exhibit F Delaware Code, Title 16, Chapter 25 2507. Surrogates (a) A surrogate may make a health care decision to treat, withdraw or withhold treatment for an adult patient if the patient has been determined by the attending physician to lack capacity and there is no agent or guardian, or if the directive does not address the specific issue. This determination shall be confirmed in writing in the patient's medical record by the attending physician. Without this determination and confirmation, the patient is presumed to have capacity and may give or revoke an advance health care directive or disqualify a surrogate. (b)(1) A mentally competent patient may designate any individual to act as a surrogate by personally informing the supervising health-care provider in the presence of a witness. The designated surrogate may not act as a witness. The designation of the surrogate shall be confirmed in writing in the patient's medical record by the supervising health-care provider and signed by the witness. (2) In the absence of a designation or if the designee is not reasonably available, any member of the following classes of the patient's family who is reasonably available, in the descending order of priority, may act, when permitted by this section, as a surrogate and shall be recognized as such by the supervising health-care provider: a. The spouse, unless a petition for divorce has been filed; b. An adult child; c. A parent; d. An adult sibling; e. An adult grandchild; f. An adult niece or nephew. Individuals specified in this subsection are disqualified from acting as a surrogate if the patient has filed a petition for a Protection From Abuse order against the individual or if the individual is the subject of a civil or criminal order prohibiting contact with the patient. (3) If none of the individuals eligible to act as a surrogate under subsection (b) of this section is reasonably available, an adult who has exhibited special care and concern for the patient, who is familiar with the patient's personal values and who is reasonably available may make health care decisions to treat, withdraw or withhold treatment on behalf of the patient if appointed as a guardian for that purpose by the Court of Chancery. Exhibit G DELAWARE HEALTH & SOCIAL SERVICES DIVISION OF DEVELOPMENTAL DISABILITIES SERVICES COMMUNITY SERVICES/ADULT SPECIAL POPULATIONS Kent County Office Thomas Collins Building 540 S. DuPont Hwy., Suite 8 Dover, DE 19901 Phone: 302-744-1140 FAX: 302-739-5535 Sussex County Office 26351 Patriots Way, 101 LL Georgetown, DE 19947 Phone: 302-934-8031 FAX: 302-934-6193 New Castle County Office Stockton Building, Suite 201261 Chapman Road Newark, DE 19702 Phone: 302-369-2180 FAX: 302-368-6595 (or 6596) Physical Examination Name: __________________________________ MCI #:_______________ Sex:___________ D.O.B.: ______________ Exam Date: _________________ Ht.:__________ Wt.:___________ Temp.: ____________ BP:_________________ P: R: Allergies: Physical Examination: Normal Abnormal Comments Scalp/Hair Ears/Hearing Eyes/Vision Nose/Mouth/Pharynx Neck/Thyroid Skin/Nails Chest/Breast Heart Lungs Spine Abdomen Genitalia (external) Prostate Pelvic/Pap Smear Upper Extremities Lower Extremities Colon/rectal Cancer Screening: Guiac Result: Annual Flu Vaccine Recommended: Yes _______ No ________ Date Annual T.B. Screening: P.P.D. Chest X-ray: Other: RETURN IN 2 DAYS TO CHECK ARM FOR PPD TEST RESULTS Results: IMMUNIZATIONS Current Needed Date Received Current Medical Diagnosis Tetanus 1. Influenza 2. Pneumococcal 3. MMR 4. DPT 5. Polio 6. Hepatitis B Vaccine Other: Name: ____________________________ MCI #: ________________ Page 2 OF 2 Diet as recommended by nutritionist Other LAB Tests / Screenings Ordered Urinalysis CBC Chem Profile Thyroid Liver Profile Lipids Hepatitis Screen PSA Pap Smear Mammogram Chest X-Ray Other Restrictions: Unlimited Limited Avoid Walking Standing Stooping Kneeling Lifting Pushing Pulling Humid Conditions Dry Conditions Dusty Conditions Other Next recommended physical exam - annual 2 yrs 3 yrs Recommendations/Referrals/Adaptive Equipment: Medications: [Include dosage and frequency] Was the individual informed of his/her physical status? ______ Yes ______ No If “no” or “unable,” was the individual’s physical status discussed with his/her surrogate/guardian? ________ Yes ________ No Does the individual lack the capacity to understand significant benefits, risks and alternatives to health care decisions? _________ Yes _________ No Note to Physician: Assessment of capacity is requested, in accordance with CFR 164.502 (g) and Delaware Code, Title 16, Chapter 2507, to determine if DDDS may release records to a designated surrogate. Signature: Address: Telephone: PARC Reviewed and Approved: 07/25/06 Form# 12/COR Exhibit H DELAWARE HEALTH AND SOCIAL SERVICES DIVISION OF DEVELOPMENTAL DISABILITIES SERVICES SOCIAL ASSESSMENT UPDATE Individual’s Name: MCI Number: Place of Residence: Date of Birth: Social Security Number: I. Contact Information Guardian/Legal Agent/Surrogate: Relationship: Address: Phone Number(s): Primary Family Contact(s): Significant Others: Sponsor (if applicable) II. Financial Information: Income: (Check Only) Resources: (Include type, company, name and number on account/policy, value.) SSI Social Security Community Bank Account Railroad Retirement Veterans Benefits Trust Fund Other (please specify) Life Insurance Other (Please specify) III. Insurance Information: (Include policy numbers, subscriber's name if different than individual’s, company name, etc.) Medicaid Number Medicare Number Blood Bank Number Private Insurance IV. Burial & Funeral Arrangements: V. Family Involvement: VI. Interpersonal Relationships: VII. Legal Issues: VIII. Special Requests and/or Considerations of Individual, Legal Representative, Family or Other Individual/Entity: IX. Individual Assessment: X. Recommendations: Signature of Social Worker/Case Manager Date of Report PARC Approved: 07/25/06 Form #: 42/Admin EXHIBIT I Delaware Health and Social Services Division of Developmental Disabilities Services Designation of Surrogate I certify that ______________________________ lacks the capacity to understand significant benefits, Name of Individual and DOB risks and alternatives to health care decisions. To Physician: Assessment of capacity is requested, in accordance to CFR 164.502 (g) and Delaware Code Title 16, Section 2507, to determine if DDDS may release records to a designated surrogate. ______________________________________ Name of Physician (Print) ______________________________________________ Signature of Physician _______________________________________ Address of Physician ______________________________________________ Telephone Number PARC Reviewed and Approved: 07/25/06 Form #43Admin