No. 11-02 (The Extent to Which Federal Law Allows the Colorado Mental Health Institute at Pueblo to Notify Outside Authorities, Including Media and Public Schools, When Forensic Patients Escape or El

John w . Suthers Attorney General Cynthia H. Coffman Chief Deputy Attorney General Daniel D. Domenico Solicitor General STATE OF COLORADO DEPARTMENT OF LAW Office of the Attorney General State Services Building 1525 Sherman Street - 7th Floor Denver, Colorado 80203 Phone (303) 866-4500 FORMAL ) OPINION ) No. 11-02 ) OF ) AG Alpha No. HS SH AGBDJ ) JOHN W. SUTHERS ) March 24, 2011 Attorney General ) Ken Cole, Director, Mental Health Institutes, Colorado Department of Human Services, Office of Behavioral Health and Housing, requested an opinion from this office concerning the extent to which federal law allows the Colorado Mental Health Institute at Pueblo (“the Institute”) to notify outside authorities, including media and public schools, when forensic patients escape or when civil patients elope, and to what extent the Institute can provide current threat assessments when patients escape or elope. QUESTIONS PRESENTED AND CONCLUSIONS Question 1: To what extent does federal law allow the Institute to notify outside authorities, including the media and public schools, when forensic patients escape and when civil patients elope? Answer 1: State and federal law must be read together to determine when the Institute may notify outside authorities, including the media, public schools and law enforcement, that a civil or forensic patient has eloped or escaped. The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), sets a minimum level of individual protection against disclosure of personally identifiable health information by covered entities. State law adds to these protections, but also contains mandatory reporting requirements that are consistent with the requirements of the HIPAA Privacy Rule. Question 2: To what extent does federal law allow the Institute to provide current threat assessments when forensic and civil patients escape or elope? Answer 2: The Institute will necessarily be making threat assessments in order to determine whether certain disclosure provisions are triggered. However, to the extent that a threat assessment is based on the information learned in the course of treatment, such disclosure generally would be contrary to law or ethical standards. One exception is for disclosure of a threat to a specific person or persons under the State’s duty to warn statute. DISCUSSION Question 1. To what extent does federal law allow the Institute to notify outside authorities, including the media and public schools, when forensic patients escape and when civil patients elope.1 The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), governs release of patient-related information by the Institute to outside authorities.1 2 The United States Department of Health and Human Services (“HHS”) adopted the HIPAA Privacy Rule to implement HIPAA requirements.3 The Privacy Rule establishes certain minimum standards for the use and disclosure of individually identifiable health information, known as protected health information or PHI, for covered entities. The Institute is a “covered entity” under the Privacy Rule. A covered entity means, among other things, a health care provider who transmits any health information in electronic form in connection with transactions covered by the HIPAA regulations.4 The Privacy Rule provides that covered entities may not use or disclose PHI except as permitted by the Rule.5 Certain disclosures require authorization by the individual whose PHI is being sought, others do not. PHI disclosures concerning escapes or elopements fall within the regulations authorizing public interest disclosures for which no authorization is required.6 1 For purposes of this opinion, “forensic patient” means a patient who was referred to the Institute through the criminal court process. A “civil patient” means a person who has been referred to the Institute through voluntary commitment or through the civil court process. A forensic patient’s disappearance from the Institute is referred to as an “escape”, and the disappearance constitutes a crime. § 18-8-208(6), C.R.S. A civil patient’s disappearance is referred to as an “elopement” and does not constitute a crime. It is necessary to distinguish between forensic and civil patient disappearances because Federal law permits broader disclosures of PHI if the patient has committed a crime. The Interstate Compact on Mental Health, section 24-60-1001, C.R.S., does not make this distinction, referring to both types of disappearance as escapes. 2 Pub. L. No. 104-191, codified at 42 U.S.C. § 1320d - 1320d-8. 3 U.S. C.F.R., Parts 160, 162 and 164. 4 45 C.F.R. § 160.102. 545 C.F.R. § 164.502. 6 45 C.F.R. § 164.512. 2 A. HIPAA Preemption HIPAA must be read in conjunction with State law requirements. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply.7 “Contrary” means that it would be impossible for a covered entity to comply with both the State and federal requirements or State law presents an obstacle to the objectives of the federal requirements.8 When the provisions at issue are not contrary, the State and federal laws applicable to disclosure should be construed so as to give effect to both. However, State law controls when it provides more stringent privacy protection.9 The term “more stringent” means the State law prohibits or restricts a use or disclosure that would be permitted under HIPAA.10 * State laws protecting the confidentiality of patient records control if they provide greater privacy protections. Where State law protects the confidentiality of patient information and is not contrary to HIPAA, the State law and HIPAA must be read together in determining what information may be disclosed, to whom, and under what circumstances. B. State Law 1. Authorized Disclosures Under the State Confidentiality Statute The State statutes governing treatment of persons with a mental illness at the Institute and other DHS facilities were drafted with the intent to “provide the fullest possible measure of privacy, dignity, and other rights to persons undergoing care and treatment for mental illness”.11 Consistent with this intent, State law provides strict privacy protections concerning information obtained and records prepared in the course of providing mental health services. Section 27-65-121, C. R.S. (“the State Confidentiality Statute”) provides that all information obtained and records prepared in the course of providing any services to individuals under Article 65 shall be confidential and privileged.12 However, section 27-65-121(3), C.R.S., makes clear that there is no privilege or confidentiality for information concerning observed criminal behavior committed upon the premise, except written medical records or information covered by one of the testamentary privileges.13 A forensic patient who escapes commits the crime of 7 45 C.F.R. § 160.202. 8 45 C.F.R. § 160.202, 9 45 C.F.R. § 160.203. 10 45 C.F.R. § 160.202. “ § 27-65-101(l)(c), C.R.S. 12 § 27-65-121(1), C.R.S. 13 § 13-90-107, C.R.S. (The Colorado statute detailing testamentary privileges including those related to communication with physicians, psychologists, therapists and social workers.) 3 escape and the crime occurred on the premises of the Institute.14 Therefore, the State Confidentiality Statute permits the Institute to disclose information concerning the escape. Reading the State Confidentiality Statute together with the Privacy Rule bases for authorizing PHI disclosure, information concerning a forensic patient’s escape may be disclosed so long as the disclosure is consistent with applicable law and standards of ethical conduct, and PHI disclosure is limited as follows: a. disclosure to law enforcement as necessary to identify or apprehend an individual who has escaped from a correctional institution or from lawful custody.15 b. disclosure to anyone reasonably able to prevent or lessen an imminent threat to health and safety of a person or the public.16 c. disclosure in response to a law enforcement request for information for purposes of identifying and locating a suspect, material witness or missing person.17 When a civil patient elopes, the elopement does not constitute a crime. Therefore, the State Confidentiality Statute does not permit disclosure of any information about a civil patient elopement unless the eloping patient is also observed engaging in criminal conduct on the premises. Under these circumstances, the State Confidentiality Statute, when read with the Privacy Rule, permits the Institute to disclose information as set forth in paragraphs b and c above, but not paragraph a, since the elopement is not an escape from a correctional institution or lawful custody.18 14 While the patient’s departure may not be “observed”, the patient’s absence is observed and that absence without authorization is criminal behavior. “ 45 C.F.R. § 164.512(j)(l)(ii)(B). 16 45 C.F.R. § 164.512(j)(l)(i)(A) and (B). 17 45 C.F.R. § 164.512(f)(2). PHI that may be disclosed under this provision is limited to the patient’s name and address, date and place of birth, social security number, ABO blood type and RH factor, type of injury, date and time of treatment, date and time of death, if applicable, and a description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos. These disclosures also may be made to a requesting law enforcement agency or to a person making a request on behalf of law enforcement, for example, a media organization making a television or radio announcement seeking the public’s assistance in identifying a suspect. 65 Fed. Reg. 82,531 — 82,532 (Dec. 28, 2000). 18 The Privacy Rule also permits disclosure as necessary for law enforcement authorities to identify or apprehend an individual who has made a statement admitting to participation in a violent crime that the Institute reasonably believes may have caused serious physical harm. 45 C.F.R. § 164.512(j)(l)(ii)(A). Disclosure is prohibited if the statement admitting to participation in a violent 4 2. Authorized Disclosures Under the State Duty to Warn Statute The State Duty to Warn Statute recognizes the overriding need to have health care providers make reasonable and timely efforts to warn or protect any person or persons when a patient has communicated a serious threat of imminent physical violence against a specific person or persons, and notify an appropriate law enforcement agency or take other appropriate action, regardless of the patient’s status as a forensic or civil patient.19 Depending on the circumstances, other appropriate action could include giving notice to the media or a local school district if such action is to warn or protect from harm the person or persons specifically threatened. The disclosures required under the State Duty to Warn Statute are consistent with the Privacy Rule permitted use and disclosure to avert a serious threat to health or safety.20 Therefore, when an escaping forensic patient or an eloping civil patient has communicated a qualifying threat, the Institute may make disclosure of PHI as reasonably necessary to warn or protect the target(s) and notify law enforcement or take other appropriate action. 3. Authorized Disclosures Under the Interstate Compact on Mental Health The Interstate Compact on Mental Health (“the Compact”) mirrors the State Duty to Warn Statute recognition of the need to notify appropriate authorities when a dangerous or potentially dangerous patient escapes.21 Although the Compact is generally applicable to voluntary or civil commitments, the duty to warn applies to forensic patients and civil patients alike.22 Article V states: Whenever a dangerous or potentially dangerous patient escapes from an institution in any party state, that state shall promptly notify all appropriate authorities within and without the jurisdiction of the escapee ...,23 crime is learned by the covered entity in the course of treatment to affect the propensity to commit the criminal conduct or through a request by the individual to initiate or be referred for treatment, counseling or therapy for the propensity to commit the criminal conduct. Generally, this basis would be subsumed under the Privacy Rule authority to disclose PHI to anyone reasonably able to prevent or lessen an imminent threat to health and safety of a person or the public, is § 13-21-117, C.R.S. 20 45 C.F.R. § 164.512(j). 21 § 24-60-1001, C.R.S. 22 § 24-60-1001, Art. IX(a), C.R.S. 23 § 24-60-1001, Article V, C.R.S. 5 The disclosures required under the Compact are consistent with the Privacy Rule’s permitted use and disclosure to avert a serious threat to health or safety.24 Therefore, when a dangerous or potentially dangerous patient, whether forensic or civil, escapes, the Institute is authorized to disclose PHI to all appropriate authorities as are reasonably able to prevent or lessen the threat.25 Because the mandate of the Compact provides the Institute with wide latitude in determining when a patient qualifies as dangerous or potentially dangerous, and to what authorities a report of such escape shall be reported, but provides no definitions or clarification of the terms “dangerous” or “authorities”, it is reasonable to look to the Privacy Rule for guidance, since the intent of the Compact is to provide nationwide standards for mental health patient transfers and the purpose of HIPAA is to provide nationwide standards for privacy of PHI. “Dangerous” or “potentially dangerous” can be read in the context of the Privacy Rule to mean a patient who the Institute has determined to pose a serious threat to health or safety. 26 “Appropriate authorities” can be read in the context of the Privacy Rule to mean law enforcement or any persons the Institute believes reasonably able to prevent or lessen the identified threat.27 In this manner, the Compact and HIPAA can be construed so as to give effect to both. Question 2: To what extent does federal law allow the Institute to provide current threat assessments when forensic and civil patients escape or elope? Several of the bases for disclosure discussed above require the Institute to have made a threat assessment in order to determine what disclosure is authorized or required. However, such a threat assessment would generally be based on information obtained in the course of treatment. Such treatment information is confidential under numerous laws, and disclosure would in most cases conflict with the ethical obligations of the treating professional.28 Only under limited circumstance are disclosures of information obtained in the course of treatment appropriate; most notably pursuant to section 13-21-117, C.R.S., for notification of the target of a specific threat and an appropriate law enforcement agency when a mental health patient communicates a serious threat of imminent physical violence against a specific person or persons. Therefore, whenever a forensic patient escapes, the Institute may notify law enforcement authorities. When any patient escapes or elopes, the Institute may 24 45 C.F.R. § 164.5120). 25 45 C.F.R. § 164.5120)(1)(A) and (B). 26 45 C.F.R. § 164.5120). 27 Id. 28 See § 12-43-218, C.R.S., concerning the disclosure of confidential communications by a mental health professional; §13-90-107, C.R.S., concerning testamentary privileges. 6 disclose limited PHI in response to requests for information from law enforcement or those acting on behalf of law enforcement to identify and locate a suspect, material witness or missing person. When the escape or elopement of any patient presents a serious and imminent threat to the health or safety of a person or the public, PHI may be disclosed to anyone reasonably able to prevent or lessen the threat. The Institute will necessarily be making threat assessments in order to determine whether certain disclosure provisions are triggered. However, to the extent that a threat assessment is based on the information learned in the course of treatment, such disclosure generally would be contrary to law or ethical standards. One exception is for disclosure of a threat to a specific person or persons under the State’s Duty to Warn Statute. Issued this 24th day of March, 2011. 7