HIV Ethics: Confidentiality & HIPAA

By Tom Smith, Ph.D. & & Ofer Zur, Ph.D.

 

Confidentiality is a central issue in the treatment of HIV positive people and is a foremost tenet to all of the allied healthcare professions. Maintaining confidentiality is crucial to successful outcomes in the treatment of those with HIV; it can only be broken for compelling legal or professional reasons. Discrimination against people with HIV is common even after 27 years, myriad treatment alternatives, an informed public, and the anticipation of longer life. Disclosure that someone is positive can have ruinous, catastrophic consequences for them. They may lose their job, friends, housing, insurance, healthcare and even family … it still happens. This privacy can only be abridged under very controlled circumstances when it is necessary for the client’s safety or when the client presents a clear and present danger to self or others.

Real or perceived breaches of confidentiality can endanger persons being served, who might face stereotyping; social isolation; loss of social or financial support; barriers to accessing housing, employment, and various social and medical services; and physical or emotional abuse. Such breaches also can undermine community trust in and access to essential public health programs and services; particularly, testing for HIV. For these reasons, policies and procedures for protecting confidentiality are critical. State laws generally protect the confidentiality of all STD information, including information related to HIV and AIDS. In certain states, specific laws or regulations prescribe the parameters of information to be kept confidential and establish penalties for confidentiality breaches.

Although confidentiality is a central principle of allied health services as legally mandated in the HIPAA, Public Law 104-191, it is subject to legal exceptions such as those stipulated in certain duty-to-warn laws, which in certain situations require medical or public health officials to notify known partners who are at risk for infection, even against the specific wishes of the particular patient. However, the standard of confidentiality regarding HIV should be as rigorous and robust as possible. Confidentiality also is subject to practical limits, including the possibility that partners who are informed that they may be HIV positive might guess the identity of the patient at any point during the process of determining if that is the case.

Because allied health services programs cannot absolutely guarantee patient or partner anonymity due to agency interactions and communications, health officials must make all reasonable attempts to ensure that the confidential nature of communication is respected and protected to the fullest extent allowed by law and ethics.

Fundamentally, any allied health care provider; i.e., therapist, social worker, physician, and so on, should NOT release information regarding a client’s HIV status without the client’s informed, written consent. The consent form should be as specific as possible regarding the particular information to be released and to whom. Informed consent means that the practitioner is required to explain the risks and benefits of releasing information to particular parties. The therapist must make sure the client understands the nature of the disclosure and has the capacity to give informed consent and make decisions on their own behalf. The client is NOT to be coerced in any way and they must understand that they have the right of refusal and can revoke consent at any time.

In making referrals or application for entitlement services or any other networking to serve the client, they must clearly understand when and to whom identifying information regarding their HIV status is communicated. This is a process of collaboration between service providers, the client and the therapist because sometimes clients do not understand that to receive certain services their status needs to be revealed. Trust and clear understanding need to be built to properly serve the client and the community.

HIPAA and HIV

HIPAA does not separately address HIV/AIDS patient information. Individuals are still protected under the general guidelines regarding release of any health information including HIV status. In general, the California law gives much more protection to HIV/AIDS information than the federal regulations.

The federal consent form is too general, does not address HIV/AIDS information, and is not required for every separate disclosure. Ca law preempt HIPAA in regard to HIV disclosures. One may include notes on AIDS in Psychotherapy Notes, (I do not recommend keeping Psychotherapy Notes). CA CIVIL CODE SECTION 56.10-56.16 is general does not mention AIDS/HIV. It still applied! HIPAA makes it very clear that there was no intention to affect or interfere with the functions of public health, or state regulatory and oversight functions relating to covered entities.

How do HIPAA regulations affect HIV/AIDS Reporting? Under the HIPAA Privacy Rule, public health authorities have the right to collect or receive information “for the purpose of preventing or controlling disease” and in the “conduct of public health surveillance…” without further authorization. This exception to HIPAA regulations authorizes providers to report HIV/AIDS cases to the HIV Epidemiology Program without obtaining patient permission. Other disclosures of protected information must be made on the “HIPAA- Compliant Authorization for Release of Medical Information and Confidential HIV-Related Information” and must be signed by the patient. State law prohibits any further disclosure of protected information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of state law may result in a fine or jail sentence or both.

For more info, see Zur, 2018 at https://www.zurinstitute.com/hipaakit.html

Best Practices regarding confidentiality

At the outset of treatment, the limits of confidentiality, including child abuse, elder abuse, and prevention of harm to a third party (Tarasoff situations) and other mandated reporting must be openly discussed within the risks and benefits of informed consent.

Never, ever release any verbal or written information regarding the client’s HIV status unless it is specifically and clearly written down and given informed consent with the client’s signature. A general release of information to an insurance company or managed care corporation DOES NOT include the release of any information regarding the client’s HIV status. Separate consent must be obtained to release the record of any HIV information. Under this circumstance, the practitioner may choose to omit any reference to the client’s HIV status in the case file to prevent any unauthorized disclosure … however unintended, inadvertent or accidental.

The client needs to have enough information regarding the risks and benefits of disclosure to anticipate the consequences of disclosure to various entities including insurance companies, law enforcement (for example, if the client is on parole), the military, employers, or other service providers; that is to say, ANY THIRD PARTY. If the client is biased in any way towards the favorable or unfavorable aspects of disclosure, they must be provided a balanced view to consider all the possibilities.

Assume nothing. Do NOT assume that the client’s spouse or significant other or physician is aware of the client’s HIV status or is receiving any services. Document a “no call” or “no mail” list. Never communicate using email. Determine with the client their preferred method of communication and how to speak when making an attempt to contact them. When calling the client at home follow the basic protocol that most practitioners understand of not using your title (just your name is sufficient) or referring to any agency that one may work with. If leaving a message, DO NOT reveal any information at all about the client, their condition or if they are receiving any services. This is standard practice.

Regarding written communications, make sure you have the client’s correct name and address and other contact information. Do not use letterhead or agency forms; just a plain paper note will suffice. As mentioned above, electronic communication is forbidden. Do not use email, cellular phone calls, faxes or other computer interactions; e.g., online chat, to communicate with the client. These means of communication are notoriously insecure and make the practitioner vulnerable to making regretful mistakes that may have legal or ethical consequences.

References

Magnusson, R.S., Privacy, confidentiality and HIV/AIDS health care. Aust J Public Health, 1994 Mar;18(1):51-8.

Reamer, F. (1987). Informed Consent in Social Work. Social Work, 32.

Wolf, L. E., JD, MPH, University of California San Francisco and Bernard Lo, MD, University of California San Francisco, Ethical Dimensions of HIV/AIDS, HIV InSite Knowledge Base Chapter August 2001 (http://hivinsite.ucsf.edu/InSite?page=kb-08-01-05)

Wood, G., Marks, R., and Dilley, J. (1992). AIDS Law for Mental Health Professionals. Berkeley, Celestial Arts.

Zur, O. (2004). HIPAA Compliance Kit, 3rd Edition. Distributed by W. W. Norton, N.Y.: Norton Professional https://www.zurinstitute.com/hipaakit.html