Understanding HIPAA to Overcome Challenges in Child and Family Cases

Courts and service providers must be careful in handling sensitive information regarding the well-being of children in three crucial areas:  health, education, and substance abuse.   What are courts required to do under the Health Insurance Portability and Accountability Act, the Family Educational Rights and Privacy Act, and federal law 42 CFR Part 2?

Alicia K. Davis
Principal Court Management Consultant, National Center for State Courts

More courts and service providers are sharing information to provide better treatment to the children and families entrusted to their care. At one time, the Health Insurance Portability and Accountability Act’s (HIPAA’s) restrictions on sharing health information were commonly misunderstood, leading to far more restrictive interpretations than actually required. As more courts and partners share information electronically, there is much wider recognition that HIPAA allows for the appropriate sharing of information, which can improve service to children in care. Thus, it is encouraging to see what systems are doing to exchange health information appropriately while meeting the spirit and letter of HIPAA.

What Does HIPAA Actually Say?

The 1996 act has two key purposes. Title I protects health insurance coverage for workers and their families when they change or lose their jobs. Title II requires the U.S. Department of Health and Human Services (HHS) to establish national standards for electronic health-care transactions and national identifiers for providers, health plans, and employers for the security and privacy of patient health data.

Painted in very broad terms, the HIPAA rules for protected health information (PHI) exchanged by “covered entities” often give people heartburn. PHI is individually identifiable information, like Social Security numbers, phone numbers, dates of birth, photos, and, of course, health conditions. PHI is not de-identified data in the aggregate. Covered entities are health-care providers or business associates that do the billing and handle the records for health providers. For example, a mental or physical health-care provider is a covered entity. In addition, any businesses or persons that receive payment for such care and also transmit relevant transactions electronically in their normal course of business are covered entities. Medicaid and Child Health Insurance Programs (CHIP) are covered entities. If a program or entity is not providing health care, billing for it, or transmitting information related to such care or billing via electronic means, it is unlikely to be subject to HIPAA.

Police officers, probation officers, and courts have not been deemed to be covered entities. Public-health and social-service agencies have issued statements on whether or not they deem themselves to be covered entities. Even so, HIPAA actually contains a number of provisions that encourage information sharing for emergencies, for children in foster care, and for government functioning. Some states have sought legislation or policy statements that allow for sharing information in conformity with state and federal privacy laws, including HIPAA. 

Authority to Share Information

Even if the privacy rule applies, HIPAA does permit disclosures “made pursuant to court or administrative orders or by subpoena, discovery, or other legal processes.” Information shared is limited to what is essential to be shared, and an authorization must contain 1) specific description of PHI to be shared; 2) names of persons authorized to share PHI; 3) names of persons authorized to receive PHI; 4) expiration date of the event; 5) statement of person's right to revoke authorization; 6) statement that PHI may be subject to re-disclosure and thus not protected by HIPAA; 7) signature of person/guardian and date; and 8) purpose of disclosure. HIPAA does not specify what a court order should contain, but most of the information above is a good start. Motions seeking a court order need to demonstrate that the applicant has made reasonable efforts to request authorization and that the data will only be used for the reason asserted.

Greater Spirit of Collaboration and Information Sharing

Information sharing is in the air—even information once carefully guarded. A November 3, 2010 memorandum from the Executive Office of the President/Office of Management and Budget to the heads of the nation’s executive departments “strongly encouraged” agencies to engage in coordinated efforts to share high-value data. Just last year, regulations were amended to expand use of the Federal Parent Locator Service.

However, state laws or an agency’s HIPAA officer’s interpretation may be more stringent. A legal analysis of the applicability of state and federal privacy laws governing transfer of protected health information is an excellent starting point.

The California Center for Families, Children and the Courts prepared an excellent series of briefings on sharing information about children in foster care, including health care. These briefs are not an exhaustive analysis of all legal issues, but they do “provide a basis for further discussions about identifying and removing legal barriers that prevent child welfare agencies, juvenile courts, and health care providers from obtaining all the information they need to make informed decisions about health services for children in foster care.” If sharing health information is seen as an issue, it is strongly recommended that the jurisdiction review California’s document and prepare their own. Such documents can create the basis for memoranda of understanding between courts and agencies seeking to share information appropriately. 

Conclusion

Social services, courts, schools, service providers, and others agree that health information can facilitate the provision of needed services and that electronic information exchange is one of the most efficient ways to do this. Perhaps all that is needed is a solid legal analysis of existing state and federal privacy laws, including HIPAA. Perhaps it is the creation of template court orders or memoranda of understanding. Maybe legislative changes are in order. What is certain is that the trend toward increased information sharing will continue—and will be for the benefit of children and families before the court.