To implement HB1203 legislative changes to section 945.10, F.S. related to confidential protected health information of inmates.

 

DEPARTMENT OF CORRECTIONS

RULE NO.:RULE TITLE:

33-401.701Medical and Substance Abuse Clinical Files

PURPOSE AND EFFECT: To implement HB1203 legislative changes to section 945.10, F.S. related to confidential protected health information of inmates.

SUMMARY: The proposed rule implements language including: personal representatives, access and responsibility of departmental staff and business associates to safeguard against disclosure of protected health information of inmates and eliminates unnecessary or obsolete language.

SUMMARY OF STATEMENT OF ESTIMATED REGULATORY COSTS AND LEGISLATIVE RATIFICATION:

The Agency has determined that this will not have an adverse impact on small business or likely increase directly or indirectly regulatory costs in excess of $200,000 in the aggregate within one year after the implementation of the rule. A SERC has not been prepared by the Agency.

Any person who wishes to provide information regarding a statement of estimated regulatory costs, or provide a proposal for a lower cost regulatory alternative must do so in writing within 21 days of this notice.

RULEMAKING AUTHORITY: 944.09, 945.10, FS.

LAW IMPLEMENTED: 119.07, 395.3025, 944.09, 945.10, 945.25, 945.6034, FS.

IF REQUESTED WITHIN 21 DAYS OF THE DATE OF THIS NOTICE, A HEARING WILL BE SCHEDULED AND ANNOUNCED IN THE FAR.

THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULE IS: Gregory Hill, 501 South Calhoun Street, Tallahassee, Florida 32399-2500.

 

THE FULL TEXT OF THE PROPOSED RULE IS:

 

33-401.701 Medical and Substance Abuse Clinical Files.

(1) No change.

(2) Definitions.

(a) Business Associate – refers to a person or entity who is not a member of the Department of Corrections’ workforce and who, on behalf of the department, performs a function or activity involving the use or disclosure of individually identifiable health information. A business associate agreement or contract requiring a business associate to appropriately safeguard protected health information is required from business associates.

(b) Designated Records Set – refers to an inmate’s medical, mental health, and dental files, Reception Medical Center Hospital’s inpatient hospital file, and substance abuse clinical files that are maintained by the Department.

(c) Department workforce – includes employees, volunteers, interns, trainees and other persons whose conduct, in the performance of work for the Department, is under the direct control of the Department, whether or not they are paid by the Department.

(d) Disclose – refers to the release, transfer, provision of access to, or divulging in any other manner of information outside the Department.

(e) Health Services Administrator – refers to designated Department employees responsible for working with the privacy officer to ensure that all Department privacy procedures are implemented.

(f) Hospital file – as used in this rule refers to an inmate’s inpatient hospital patient records created and maintained by Reception Medical Center Hospital.

(g) Medical file – as used in this rule refers to the inmate’s medical, mental health, and dental files maintained by the department.

(h) Personal Representative – as used in this rule, means, with respect to a deceased inmate, a person appointed by a court to act as the personal representative, executor, administrator, curator, or temporary administrator of the deceased inmate’s estate, or if a court has not made such a judicial appointment, a person designated by the inmate to act as his or her personal representative in a last will that is self-proved under section 732.503, F.S. an executor, administrator, or other person with authority under Florida law to act on behalf of the deceased inmate or the inmate’s estate. In addition, if a court has not made a judicial appointment as described herein and the inmate has not designated a person in a self-proved last will, a personal representative also means one of the following individuals:

1. A surviving spouse.

2. If there is no surviving spouse, a surviving adult child of the inmate.

3. If there is not surviving spouse or adult child, a parent of the inmate.

With respect to a living inmate, a personal representative means a health care surrogate, proxy, guardian, or other person with authority under Florida law to make decisions related to the inmate’s health care.

(i) Privacy Officer – as used in this rule, refers to a designated employee in the Office of Health Services who is responsible for the development and implementation of the policies and procedures related to the HIPAA Privacy Rule. The privacy officer is the Department’s contact person for HIPAA.

(j) Protected health information (PHI) – where used herein, refers to inmate or offender information that is created or received by the Department of Corrections, whether oral, recorded, transmitted, or maintained in any form or medium, that relates to the past, present, or future physical or mental health or condition of an inmate or offender, the provision of health care to an inmate or offender, or the past, present, or future payment for the provision of health care to an inmate or offender and identifies an inmate or offender or there is a reasonable basis to believe the information can be used to identify an inmate or offender.

(k) Psychotherapy notes – refers to notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private or group session. The term does not include medication prescription and monitoring, session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following: diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.

(l) Substance abuse clinical file – refers to the department’s inmate file containing all written documents, records and forms compiled to detail an inmate’s substance abuse history, substance abuse screening, assessment, intervention, and other substance abuse services, including the results of urinalysis testing done for treatment, program participation, and admission and discharge summaries.

(m) Substance abuse progress notes – refers to notes recorded by a substance abuse health care professional documenting or analyzing the contents of conversation during a private or group session. The term does not include session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following: diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.

(n) Use – refers to, with respect to protected health information, the sharing, employment, application, utilization, examination, or analysis of such information within the Department.

(3) through (7)  No change.

(8) Each Department workforce member employee of the Department of Corrections and the Department’s business associates shall maintain as confidential all medical, mental health, dental and substance abuse information, regarding any inmate or offender that the employee obtains in conjunction with his or her duties and responsibilities, and shall not disseminate the information or discuss the medical, mental health, dental, or substance abuse condition of the inmate or offender with any person except persons directly necessary to the performance of the Department workforce member’s or business associate’s employee’s duties and responsibilities. Workforce An employee who has been designated as a members of the healthcare, mental health treatment team or is part of a mental health or substance abuse treatment team shall not disseminate inmate medical, mental health, or substance abuse information or discuss the medical, dental, mental health, or substance abuse condition of an inmate with any person except other members of the healthcare team, mental health treatment team, or substance abuse treatment team, release officers or any other employees designated to facilitate continuity of care and treatment upon reentry, officers responsible for transporting inmates, upper level management at the institution or facility level, regional level and central office level, inspectors from the Inspector General’s Office if related to law enforcement on the premises of a correctional institution, classification or security staff if related to maintenance of the safety, security and good order of the correctional institution, department attorneys, or other employees and persons authorized to receive such information in accordance with the Health Insurance Portability and Accountability Act Privacy Rule of 1996, (HIPAA) and Florida law. Breach of this confidentiality shall subject the employees of the Department to disciplinary action. Each employee shall acknowledge receipt and review of Form DC2-813, Acknowledgement of Responsibility to Maintain Confidentiality of Medical Information, indicating that he understands the medical and substance abuse confidentiality requirements. Form DC2-813 is hereby incorporated by reference. Copies of the form are available from the Forms Control Administrator, 501 South Calhoun Street, Tallahassee, Florida 32399-2500, http://www.flrules.org/Gateway/reference.asp?No=Ref-02946. The effective date of this form is 8-13.

(9) No change.

(10) Use and disclosure of protected health information.

(a) Inmate protected health information shall be used or disclosed in accordance with the Health Insurance Portability and Accountability Act Privacy Rule of 1996 (HIPAA), and Florida law.

(b) Requests for access to a current inmate’s medical file shall be submitted to the health services administrator at the institution where the inmate is housed. Requests for access to a former inmate’s medical file shall be submitted to: Statewide Record Retention Center, Attention: Inactive Medical Records, 7819 N.W. 228th Street, Raiford, Florida 32083 Reception and Medical Center, P. O. Box 628, Lake Butler, Florida 32054. Requests for access to an inmate’s hospital file shall be submitted to: Reception and Medical Center Hospital, Attention: Hospital Administrator, P. O. Box 628, Lake Butler, Florida 32054.

(c) All requests for access to an inmate’s protected health information shall be specific and in writing.

(d) If use or disclosure of an inmate’s protected health information is not otherwise permitted by law, an inmate must authorize the use or disclosure by giving written consent using Form DC4-711B, Consent and Authorization for Use and Disclosure Inspection and Release of Confidential Information, or Form DC4-711Bsp, its Spanish-language version, or a legally approved, HIPAA compliant release of protected health information form from another governmental agency. Form DC4-711B and Form DC4-711Bsp are incorporated by reference in Rule 33-601.901, F.A.C.

(e) Form DC4-711B, DC4-711Bsp, or any other authorization used for these purposes shall be submitted with the written request for access to an inmate’s protected health information. A copy of the authorization shall be provided to the inmate and the inmate shall acknowledge receipt of the copy by signing in the appropriate location on the authorization. The authorization and acknowledgement of receipt of copy shall become a part of the inmate’s medical file.

(f) Form DC4-711B, DC4-711Bsp, or any other authorization used for these purposes must be notarized unless witnessed by a member of the Department’s workforce. All authorization forms shall be witnessed by at least one person who can verify the fact that he witnessed the signing of the authorization by the inmate and that, to the best of his knowledge, the inmate knew what was signed.

(g) A disclosure of protected health information may not be made on the basis of an authorization which:

1. Has expired;

2. On its face substantially fails to conform to any of the requirements of the Health Insurance Portability and Accountability Act Privacy Rule of 1996;

3. Is known to have been revoked; or

4. Is known, or through a reasonable effort could be known, by the person holding the records to be materially false.

(h) In accordance with 45 C.F.R. §164.502 and Florida law, a personal representative of a deceased inmate shall have access to or may authorize the disclosure of the deceased inmate’s protected health information that is relevant to the personal representative’s legal authority to act on behalf of the deceased inmate or the deceased inmate’s estate.

1. The Department shall verify and document the authority of the personal representative to serve in that capacity. All requests for access to a deceased inmate’s protected health information shall be in writing and accompanied with documentation demonstrating the authority of the personal representative to serve in such capacity as specified in paragraph (2)(h) herein.

2. If the request is made by a person appointed by a court to act as the personal representative, an executor, an administrator, a curator, or a temporary administrator of the deceased inmate’s estate, accompanying documentation shall include a copy of the letter of administration and a copy of the court order appointing such person as the representative of the inmate’s estate. 

3. If the request is made by a person designated by the inmate to act as his or her personal representative in a last will that is self-proved, accompanying documentation shall include a copy of the self-proved last will designating the person as the inmate’s representative.

4. If the request is made by a surviving spouse, a surviving adult child of the inmate, or a parent of the inmate, accompanying documentation shall include a letter from the person’s attorney verifying the person’s relationship to the inmate and the absence of a court-appointed representative and self-proved last will.

5. To authorize the disclosure of the deceased inmate’s protected health information, Form DC4-711B, Consent and Authorization for Use and Disclosure Inspection and Release of Confidential Information must be signed by a personal representative. In accordance with 45 C.F.R. §164.514(h)(1), the Department shall verify and document the authority of the personal representative to serve in that capacity

(i) In accordance with 45 C.F.R. §164.502, a personal representative of a living inmate shall have access to or authorize the disclosure of the inmate’s protected health information that is relevant to the personal representative’s legal authority to make health care decisions on behalf of the inmate. Form DC4-711B, Form DC4-711Bsp, or any other authorization used for these purposes shall be signed by the inmate or the inmate’s personal representative in accordance with Florida law. In accordance with 45 C.F.R. §164.514(h)(1), the Department shall verify and document the authority of the personal representative to serve in that capacity.

(j) In addition to the access described above, in accordance with Section 395.3025, F.S., an inmate’s guardian, curator, personal representative, or in the absence of one of those persons, next of kin of a decedent or the parent of a minor, shall have access to the protected health information contained in an inmate’s hospital file created and maintained by the Reception Medical Center Hospital after the discharge of the inmate.

(k) In accordance with 45 C.F.R. § 164.514(h), the Department shall verify the identity and the authority of a person requesting access to an inmate’s protected health information if the identity or authority of such person is not known.

(l) No information concerning test results, or other protected health information, shall be released over the telephone without proper verification that the caller is the person authorized to receive such information. All calls requesting the disclosure of protected health information over the telephone shall be forwarded to the Chief Health Officer, the Nursing Supervisor or their designees.

(m) Copies of protected health information will be provided upon receipt of payment as provided in subsection 33-601.901(2), F.A.C.

(11) Alcohol and Drug Abuse Treatment Files: Any information, whether recorded or not, concerning the identity, diagnosis, prognosis or treatment of any inmate or offender which is maintained in connection with the performance of any alcohol or drug abuse prevention or treatment function shall be confidential and shall be disclosed only as follows:

(a) With the prior written authorization of the inmate or offenders described in subsection (10) above.

(b) Pursuant to 42 C.F.R. Part 2, the department is authorized to disclose information about an inmate or offender to those persons within the criminal justice system who have made participation in the program a condition of the disposition of any criminal proceedings against the inmate or offender or of the inmate or offender’s parole or other release from custody if:

1. The disclosure is made only to those individuals within the criminal justice system who have a need for the information in connection with their duty to monitor the inmate or offender’s progress; and,

2. The inmate or offender has signed Form DC4-711B, Form DC4-711Bsp, or any other authorization used for these purposes meeting the requirements of subsection (10) except for the revocation provision in paragraph (10)(g). This written consent shall state the period during which it remains in effect. This period shall be reasonable, taking into account:

a. The anticipated length of the treatment;

b. The type of criminal proceeding involved, the need for the information in connection with the final disposition of that proceeding, and when the final disposition will occur; and,

c. Such other factors as the program, the inmate or offender, and the persons who will receive the disclosure consider pertinent. The written consent shall state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable shall be no later than the final disposition of the action in connection with which consent was given.

(c) Each disclosure made with the inmate or offender written consent shall be accompanied by the following written statement:

This information has been disclosed to you from records protected by federal confidentiality rules (42 C.F.R. Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 C.F.R. Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

(d) Whether or not the inmate or offender has given written consent, 42 C.F.R. Part 2 permits disclosure of information as follows:

1. To medical personnel to the extent necessary to meet a medical emergency and for continuity of care;

2. To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel shall not identify, directly or indirectly, any individual inmate or offender in any report of such research, audit, or evaluation, or otherwise disclose inmate or offender identities in any manner;

3. To communicate within a program or between a program and an entity having direct administrative control over that program;

4. To law enforcement officers concerning crimes on program premises or against program personnel, or when a threat to commit such a crime has been made;

5. Reports of suspected child abuse and neglect; and,

6. If authorized by a court order.

Rulemaking Authority 944.09, 945.10 FS. Law Implemented 119.07, 395.3025, 944.09, 945.10, 945.25, 945.6034 FS. History–New 4-15-10, Amended 8-6-13, 5-25-16, ________.

 

NAME OF PERSON ORIGINATING PROPOSED RULE: Thomas Reimers, Health Services Director

NAME OF AGENCY HEAD WHO APPROVED THE PROPOSED RULE: Julie L. Jones, Secretary

DATE PROPOSED RULE APPROVED BY AGENCY HEAD: May 9, 2018

DATE NOTICE OF PROPOSED RULE DEVELOPMENT PUBLISHED IN FAR: October 30, 2017