NMCSAP

Working to prevent sexual abuse and sexual violence in New Mexico

By

Patient Confidentiality and the Relevancy of Health Insurance Portability and Accountability Act (HIPAA) on SANE

1. Confidentiality Matters to the Sexual Assault Victim

  • During a sexual assault, the offender takes control over everything, including the victim’s body and ability to make choices.
  • After the crime, the victim will need to make his or her own decisions. The systems that respond to a sexual assault victim may be focused on their needs and may not have the victim’s rights forefront in their actions or words.
  • Victims in crisis mode may comply with professionals, not fully understanding their choices or the implications of their decisions.
  • Victims may not even access services out of fear of losing control of their choices and confidentiality. The World Health Organization has extensive research on how patients do not seek medical treatment when they believe that their health information will not be confidential.
  • Victims in crisis mode may feel that decisions are absolute – that when they file a police report or chose to have a SANE exam, that they can’t change their mind or stop events during the process or afterwards.

The SANE and the Rape Crisis Advocate can help the victim understand what decisions mean. Providing accurate and understandable information will take time and it is a critical step in building trust with the victim.  Do not gloss over forms or minimize the implications of the victim’s signature on the form. Informed consent means that the victim is fully informed and understands prior to agreeing.

2. The role of the SANE in ensuring confidentiality

Confidentiality belongs to the individual patient but the SANE must play an active role in protecting the victim’s confidentiality. On an obvious level, this includes not releasing medical record or disclosing patient identifiers. In subtle ways, confidentiality may also mean that unnecessary staff is not near the unit when patients might arrive. It may mean not having the words “sexual assault” above your program’s entrance.  Confidentiality also extends into your community, be mindful of speaking about, and acknowledging patients after the SANE exam when in the general public.

3. Policies within each SANE Program

  1. Upon hire, you will be required to sign and abide to a confidentiality agreement. A sample is attached.
  2. For each sexual assault patient you respond to, you will be required to inform the patient of HIPAA notices. While many medical providers simply hand this document over, the SANE must be prepared to explain what HIPAA means, how it applies to the SANE Medical Record if a victim files a police report. A sample is attached.
  3. Each SANE program in New Mexico has a HIPAA compliance policy that may include in-services, test questions, and other activities to ensure staff are fully on-board with patient confidentiality and HIPAA regulations.
  4. The sexual assault patient has a right to a copy of their own SANE medical record; however, the patient should be informed of how released copies may impact future decisions.  New Mexico SANE Programs have a document that outlines the implications of releasing a medical record. A sample is attached.
  5. Take the time to read the attached documents. Practice rewording the core concepts into language that a young person or a non-English speaking person can understand. 

4. Policies/practices within New Mexico

  1. For adult sexual assault, New Mexico does not require you as a medical provider to report the incident to either law enforcement, department of health or other state agency.
  2. The NM Coalition of Sexual Assault Programs processes the invoices for sexual assault exams and also follows confidentiality for billing and reporting purposes.

5. Broad concepts of Confidentiality

  1. Confidentiality is limited protection and can be waived. Examples of waivers include signed medical releases but also disclosure to a third party or speaking in front of someone who is not part of the confidential transaction.
  2. Confidentiality is not equal to “privilege” which is a stricter standard and applies to specific relationships such as attorney/client or psychotherapist/patient.
  3. Confidentiality is most often created by statute or by professional ethical codes.  An important concept about confidentiality is that it is a general protection for private information, but provides limited insulation from disclosure in court – meaning, the general public doesn’t have access to confidential records, but upon a proper showing to a judge, an opposing party in a civil lawsuit or a criminal prosecution might be able to have access to the records. 
  4. The website for the Office of Victims of Crime outlines the issues of confidentiality in their article “Strengthening Sexual Assault Victims’ Right to Privacy,” available at www.ojp.usdoj.gov/ovc/publications/infores/VictimsRightToPrivacy/pfv.html

6. HIPAA

Attached is a brief power point presentation from the Forensic Nurse On-Line website that provides an overview of HIPAA and health care settings. It is provided as supplemental and optional material.

7. Critical Thinking Exercises

  • The patient tells you he is seeing a counselor because he has been raped before. What are the confidentiality issues? Does this information go into your record?
  • The patient has multiple bruises, of different colors, on her body. As you go through the exam, the patient confides what caused most of these bruises. What are the confidentiality issues? What are the medical and your treatment issues? How would you document this in your SANE Medical Record?
  • The patient asks to speak to the medical director. You hear the patient explain she is worried about pregnancy because she had a recent abortion. Both you and the rape crisis advocate overhear this conversation. What would you do with this information?
  • A law enforcement officer who is known to you from other cases stops by the SANE unit while you are with a patient who has not yet decided to file a police report. The officer asks for detailed information on your current patient. How much information will you relay to the law enforcement officer?
  • A colleague SANE is pursuing a Bachelor’s Degree and wants to use photos from a case you worked on for her research project. What are the confidentiality issues? 
  • While shopping at the local Walmart you notice a recent SANE patient. She makes eye contact with you, but doesn’t speak. How would you respond? Is there anything you might say during the actual SANE exam that might alleviate a patient’s concern about being recognized?

SAMPLE: Confidentiality Statement for SANE Personnel File

SANE and its affiliates have a legal and ethical responsibility to safeguard the privacy of all patients and to protect the confidentiality of their health information. Additionally, SANE and its affiliates must assure the confidentiality of its human resources, payroll, fiscal, research, computer systems, and management information. In the course of my employment/assignment at SANE, I may come into the possession of confidential information.

By reading and this document I understand the following:

  • I agree not to disclose or discuss any patient, human resources, payroll, fiscal, research and/or management information with others, including friends or family, who do not have a need-to-know.
  • I agree not to access any information or utilize equipment, other than what is required to do my job, even for my own private information.
  • I agree not to discuss patient, human resources, payroll, fiscal, research or administrative information where others can overhear the conversation, e.g. in hallways, on elevators, in the cafeterias, at restaurants, or at social events. It is not acceptable to discuss clinical information in public areas even if a patient’s name is not used. This can raise doubts with patients and visitors about our respect for their privacy.
  • I agree not to make inquiries or have discussions with other personnel who do not have proper authority.
  • I agree not to willingly inform another person of my computer password or knowingly use another person’s computer password instead of my own for any reason.
  • I agree not to make any unauthorized transmissions, inquiries, modifications, or purgings of data in the system. Such unauthorized transmissions include, but are not limited to, removing and/or transferring data from a SANE computer system to unauthorized locations, e.g. home.
  • I agree to use Screensaver PASSWORD or log off prior to leaving any computer or terminal unattended.
  • I agree to protect the security of any patient health information if using computer/programs off the premises of SANE.

I have read the above special agreement and agree to make only authorized entries for inquiry and changes into the system and to keep all information described above confidential. I understand that violation of this agreement may result in corrective action, up to and including termination of employment and/or suspension and loss of privileges. I understand that in order for “User ID” and/or PASSWORD to be issued to me, this form must be completed. I further understand that computer access activity is subject to audit.

SAMPLE: Notice of Privacy Practices for Patients seen by SANE

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU COULD BE USED. PLEASE REVIEW IT CAREFULLY.  If you have any questions about this notice please talk to the SANE nurse or call the SANE Program administrator.

Summary

In order to treat you for sexual assault, the SANE Program obtains personal information about your health.  We are required to keep this information confidential.  This notice of our privacy practices is intended to inform you of the ways this information could be given to others. 

The consent form you sign for the sexual assault exam allows for the sharing of your medical record to Law Enforcement and other agencies involved with legal proceedings of the sexual assault. It is your right not to sign the consent form. We will share your medical record information with legal entities only with your authorization or by court order.

We may use your information within our organization to evaluate and improve health care operations, as well as for internal training and quality assurance.  For these reasons, your name will not be used. 

Kinds of Information This Notice Applies To:

This notice applies to any information in our possession that would allow someone to identify you and learn something about your health.  It does not apply to information that contains nothing that could reasonably be used to identify you.

Who Must Abide By This Notice:   

  • SANE Program Employees
  • Individuals and agencies that have an on-site business relationship with SANE
  • Individuals and legal agencies that receive SANE patient medical records

Our Legal Duties:

  • We are required by law to maintain the privacy and security of your health information.
  • We are required to provide this notice of our privacy practices and legal duties regarding health information to anyone who asks for it.
  • The people and organizations to which this notice applies have agreed to abide by its terms.  We may share your information with each other for purposes of treatment and as necessary for activities as described below.

How We May Use or Give Others Your Health Information:

We may use your health information, and give it to others, for the reasons described below.  Any time we give your information to someone else, it will fit one of the reasons listed here.

  1. Payment.  We will use your health information and disclose it to others as necessary to receive reimbursement from the state of New Mexico Department of Health.
  2. Health Care Operations.  We may use your health information for activities that are necessary to operate this organization. We may disclose your information as necessary to others with whom we contract to provide administrative or emergency services, such as hospital ER or EMS.
  3. Legal Requirement to Disclose Information.  We will disclose your information when we are required by law to do so, by court order or other judicial or administrative process.
  4. Public Health Activities. We will disclose your health information when required to do so for public health purposes. This includes reporting certain diseases, reactions to certain medications, and notifying people who have been exposed to a disease.
  5. To Report Abuse. We may disclose your health information when the information relates to child or elder abuse or abuse of a disabled/vulnerable adult, or a victim of neglect or domestic violence. We will make this report only in accordance with laws that require such reporting, or with your permission.
  6. Law Enforcement. We may disclose your information for law enforcement purposes. This includes providing information to help locate a suspect or in connection with suspected criminal activity.  We must also disclose your health information to state and federal agencies investigating our compliance with privacy regulations.
  7. To Avert A Serious Threat. We may disclose your health information if we decide that the disclosure is necessary to prevent serious harm to the public or to an individual. The disclosure will only be made to someone who is able to prevent or reduce the threat.

Your Rights:

Authorization.  We may use your health information for those purposes that are listed in this notice without your written consent.  We will not use or disclose your health information for any other reason without your consent.  

Request Restrictions.  You have the right to ask us to restrict how we use or disclose your health information. We will consider your request, but we are not required to agree.  If we do agree, we will comply with the request unless the information is needed to provide you with emergency treatment.  If required by law, we must give others this information. 

Confidential Communication.  If you believe that the disclosure of certain information could endanger you, you have the right to ask us to communicate with you by a special means.  We will agree to any reasonable request.

Inspect And Receive A Copy Of Health Information. You have the right to inspect health information about you in your record, and to receive a copy of it. This right is limited to information about you that is kept in our records that are used to make decisions about you.

Amend Health Information.  You have the right to ask us to amend health information, which you believe is incorrect or incomplete. You must make this request in writing, with the reason you believe the information is incorrect or incomplete. We will add your written request to your medical record.

Accounting of Disclosures.  You have a right to receive an accounting of the disclosures of your information to others.  This accounting will list the times we have given your health information to others, the dates of disclosure, the name of the people or organization, and a description of information. 

Paper Copy Of This Privacy Notice.  You have a right to receive a paper copy of this notice.

Complaints.  You have a right to complain about our privacy practices if you think your privacy has been violated.  You may file your complaint with the Administrator of the SANE Program. You may also file a complaint directly with the Secretary of the US Department of Health and Human Services, Office for Civil Rights, US Department of Health and Human Services, 200 Independence Avenue, SW Room 509F HHH Bldg., Washington, DC20201.  All complaints must be in writing.  We will not take any retaliation against you if you file a complaint.

Implications of Releasing SANE Medical Record

Our SANE Program ensures every possible measure to keep your SANE medical record private. Records are kept locked and secure. We adhere to HIPAA standards and only release your record to authorized personnel based on your signature on the initial consent page. Personnel with the SANE Program welcome the opportunity to sit with you to review the details of your SANE medical record. We can discuss the findings and photos in a private setting and answer your questions about the SANE exam and the SANE medical record.

While HIPAA states you have a right to your medical record, we discourage making copies of your SANE Medical Record for you personally or for unrelated agencies for the following reasons:

  • The SANE medical record is of a personal nature with diagrams and descriptions of your body and with intimate details you shared of an assault that occurred to you.
    • Reading this record without the benefit of medical consultation may affect your personal well-being and understanding of the assault. 
    • Your patient privacy is diminished in terms of your ability to safeguard the information from casual readers or from potential theft or loss.
  • Once you decide to file a police report, the SANE medical record has legal implications.
    • Your reading the documentation may influence your recollection and description of events which may adversely affect you throughout any legal proceedings.
    • Your medical record relates to a criminal charge; by pursuing civil actions before the criminal case is completed, a released copy of your medical record may interfere with the criminal proceedings.
  • If you chose to share your SANE Medical Record with other agencies, you need to understand that other agencies
    • may not have safeguards in place to secure the privacy of your information.
    • may use the information in ways that could adversely affect you in the future.
  • If your concern is continued medical care from another provider, your patient discharge instructions may be the relevant document that needs to be shared. We can make a copy of your patient discharge instructions without copying your entire Medical Record.
  • If you chose to obtain a copy of your SANE Medical Record, this release form will be become part of your medical record just as there is a permanent record for other requests for your SANE medical record.

 Your signature indicates your understanding of the implications of requesting and having a copy of your SANE medical record, as outlined above. 

MENU