DHEC ADMINISTRATIVE POLICY MANUAL COMMISSIONERS OFFICE Subject: Laws/Regulations: Confidentiality of Health Record Information South Carolina Freedom

of Information Act- S.C. Code 30-4-10, et seq; Confidentiality of Sexually Transmitted Disease Records- S.C. Code 4429-135 and S.C. Code Reg. 61-21; Court orders for disclosure of records for law enforcement purposes; confidentiality safeguards- S.C. Code 4429-136 ; South Carolina Physicians Patient Records Act- S.C. Code 44-115-10, et seq.; Social Worker Disclosure of Client Information- S.C. Code 40-63-190; Confidentiality of Mental Health Records- S.C. Code 44-22-100; Access to Mental Health Information- S.C. Code 44-22-110; Confidentiality of Family Planning Services in Medical Records- 42 CFR 59.11, Confidentiality of Substance Abuse Records42 U.S.C.A. 90dd-2; Health Insurance Portability and Accountability Act- 45 CFR Part 160 and Part 164; Contagious and Infectious Diseases, S.C. Code 44-29- 150 - 170.

Policy Statement: Confidentiality of Agency information is determined by its exempt, nonexempt or confidential status as defined by the Freedom of Information Act and other applicable laws. Generally, health information is exempt from the Freedom of Information Act and is not released via FOI request. As required by HIPAA and other federal and state laws, DHEC provides for the confidentiality of health information. HIPAA defines protected health information as individually identifiable health information that is or has been electronically maintained or transmitted by a covered entity, as well as such information when it takes any other form that is created or received by a health care provider, health plan, employer or health care clearinghouse and relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual. Rules: 1. EMPLOYEE RESPONSIBILITY: a. Employees of the Department of Health and Environmental Control are responsible for ensuring that the confidentiality of client health information is maintained. Information about clients will be held confidential and will not be divulged without the authorization of the individual to whom it pertains except as needed for the continuation of care in providing health services or as otherwise required by law. When using or disclosing protected health information (PHI) or when requesting PHI from another agency or organization covered by HIPAA, DHEC employees must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. DHEC employees, volunteers and other personnel working with DHEC clients (students, contract staff, etc.) will sign an appropriate confidentiality statement.

b.

c.

Rev 7/2011

A.910

Page 1 of 6

DHEC ADMINISTRATIVE POLICY MANUAL COMMISSIONERS OFFICE d. Should copies of health record information be made by DHEC staff for uses such as the provision of services off-site, the copies will be kept secure and the information will be kept confidential at all times, and shredded once no longer needed. Any employee who does not adhere to the Agency's policies concerning confidentiality will be disciplined in accordance with the Agency's Progressive Discipline Policy and may risk legal prosecution.

e.

2.

CONFIDENTIAL INFORMATION INCLUDES: a. b. c. d. The protected health information that identifies individuals The social and economic conditions or circumstances of any person served Agency evaluation of information about a person or health facility An individuals medical information, including diagnosis and past history of disease or disability Confidential facts pertaining to health facilities. (ie- Medicare/ Medicaid provider numbers, incident reports, etc.) The identity of persons or institutions that provide health services to an individual Federal program information identified as confidential by appropriate federal authority Clients social security number The names of persons other than the client when they appear in the clients record, unless needed by a health care provider for the purpose of treatment for that person. In that case, the information released is the minimum necessary for the intended purpose of the release. The names of these individuals are not released upon receipt of a subpoena for the clients record.

e.

f. g.

h. i.

3.

SHARING OF CONFIDENTIAL INFORMATION WITHIN THE AGENCY All employees of DHEC are bound by DHECs Confidentiality of Information Policy, A.561. A DHEC employee must not disclose confidential information to other DHEC employees unless those employees have a legitimate need for the information in the performance of their official duties.

4.

CONFIDENTIALITY OF IMMUNIZATION INFORMATION Information about immunizations may be shared with Health Care Providers (defined as DHEC staff, physicians and their office staff) for treatment purposes, and with other

Rev 7/2011

A.910

Page 2 of 6

DHEC ADMINISTRATIVE POLICY MANUAL COMMISSIONERS OFFICE persons having the responsibility and authority to inquire into and/or verify immunization status such as school and day care providers, parents, legal guardians, the client, health plans (during the period of eligibility), and the Centers for Disease Control and Prevention (CDC), without parental, guardian or client authorization in accordance with 45 CFR Section 164.512 of HIPAA Regulations. Such information may include which vaccinations or immunizations an individual has received, the dates each was given, and other history information essential for a health care provider to determine an individual's need for an immunization, or other essential history information, such as prior reactions. The Certificate of Immunization (DHEC 1148) and the Personal Immunization Record (printed from CARES) are considered public health records and do not require a signed authorization to release information. Refusal to share information is appropriate in cases where it is believed that releasing the information would not benefit that client. Immunization Certificates may be released to a childs parent or legal guardian, or to school principals and day care providers as required by law. Any disclosure concerning immunosuppression, if related to HIV infection, or other information related to HIV or STD should be disclosed in strict compliance with S.C. Code 44-29-135 and applicable regulations such as 24A S.C. Code Reg. 61-21. 5. CONFIDENTIALITY OF INFORMATION REGARDING SEXUALLY TRANSMITTED DISEASES (INCLUDING HIV/AIDS INFORMATION) a. South Carolina Code 44-29-135 states: All information and records held by the Department of Health and Environmental Control and its agents relating to a known or suspected case of sexually transmitted disease are strictly confidential except as provided in this section. The information must not be released or made public, upon a subpoena or otherwise, except under the following circumstances: Release is made of medical or epidemiologic information for statistical purposes in a manner that no individual person can be identified. Release is made of medical or epidemiologic information with the authorization of all persons identified in the information released. Release is made of medical or epidemiologic information to the extent necessary to enforce the provisions of this chapter and related regulations concerning the control and treatment of sexually transmitted disease. Release is made of medical or epidemiologic information to medical personnel to the extent necessary to protect the health or life of any person. In cases involving a minor (minor is defined as under age 18), the name of the minor and medical information concerning the minor must be reported to appropriate agents if a report is required by the Child Protection Act of 1977. No further information is required to be released by the department. If a

Rev 7/2011

A.910

Page 3 of 6

DHEC ADMINISTRATIVE POLICY MANUAL COMMISSIONERS OFFICE minor has Acquired Immune Deficiency Syndrome (AIDS) or is infected with Human Immunodeficiency Virus (HIV) and is attending public school in kindergarten through fifth grade, the department shall notify the superintendent of the school district and the nurse or other health professional assigned to the school the minor attends. The notification and information contained in the notification must not be recorded in the childs permanent school record. However, if this information is in the childs permanent school record, the information must be purged from the childs record before the child enters the sixth grade. b. All information regarding individuals with STDs and their identified contacts shall be maintained with utmost confidentiality within DHEC in accordance with established statutes, laws and policy pertaining to sexually transmitted diseases. This includes refusal of subpoenas to share client information in court. STD information may be disclosed if the client specifically authorizes its disclosure pursuant to a HIPAA-compliant authorization. Only a proper court order permits release of DHEC records of this type without the patients authorization. Hepatitis B, STD and HIV test results may be released as directed by court order pursuant to South Carolina Code 16-3-740, Testing of offenders for Hepatitis B, STD and HIV. (See Testing Offenders for Human Immunodeficiency Virus, Hepatitis B Virus and Sexually Transmitted Diseases policy in the Health Services Policy Manual). In addition, STD test results may be released to a solicitor pursuant to a court order under procedures set forth in S.C. Code Section 44-29-136. If an order directing disclosure of STD information is received, immediately contact the Office of General Counsel. If disclosure of STD/HIV information to medical personnel is necessary to protect the health or life of any person pursuant to Section 44-29-135(d), the relevant portion of a clients STD record may be released to a physician who needs to know the information in order to plan and develop a necessary course of treatment. When the Department refers a client who has tested positive for an STD to a physician and/or health professional for medical care, the Department may provide the STD information to the physician and/or health professional directly involved in the clients medical care if the physician and/or health professional has a need to know the information in order to plan and develop a necessary course of treatment. For referral of a pregnant client, the Department may provide the STD information to the physician and/or health professional directly involved in the clients medical care if the physician and/or health professional have a need to know the information in order to plan and develop a necessary course of treatment for the pregnant female and/or her newborn(s). In all cases, the procedures for disclosure of STD/HIV information set forth in S.C. Regulation 61-21(G)(2)must be followed.

c.

d.

Rev 7/2011

A.910

Page 4 of 6

DHEC ADMINISTRATIVE POLICY MANUAL COMMISSIONERS OFFICE 6. CONFIDENTIALITY OF FAMILY PLANNING INFORMATION ON MINORS Information regarding Family Planning services on minors is always kept confidential pursuant to the requirement of 42 C.F.R. 59.11. No disclosure of information is permitted without the written authorization of the minor, except by subpoena or court order. If a parent or guardian requests the minor's record, the minor should be contacted without notifying the parent or guardian. It will be left to each Region Health Directors discretion as to the procedure of contacting the minor. This does not preclude disclosure of relevant information for required reporting for known or suspected child abuse. 7. CONFIDENTIALITY OF SOCIAL WORKER NOTES Client information acquired by licensed social workers during the course of service must not be disclosed except in accordance with S.C. Code 40-63-190. This section allows disclosure: a. As mandated by law for child abuse and neglect reporting and reporting suspected abuse, neglect or exploitation of a vulnerable child. to prevent a clear and immediate danger to a person or persons in cases where the information is necessary to prevent the client from causing harm to himself/herself or others. where the licensed social worker is a defendant in a civil, criminal or disciplinary action arising from service to a client, in which case confidences may be disclosed only in the course of that action. where the client is a party in a criminal or civil proceeding and the client introduces his/her mental condition as an element of a claim or defense. where there is a waiver of confidentiality previously obtained in writing as set forth in the statute. where otherwise required by law or an order signed by a judge of a court of competent jurisdiction.

b.

c.

d.

e.

f.

8.

CONFIDENTIALITY OF MENTAL HEALTH AND SUBSTANCE ABUSE INFORMATION a. Psychiatric Records: From time to time, information related to a clients mental health or substance abuse may be contained in the comprehensive health record. Normally this is secondary information, as DHEC does not provide services in these areas. All information directly or indirectly related to or identifying a mentally ill patient or former patient or whose commitment has been sought must be kept confidential and must not be disclosed unless:

Rev 7/2011

A.910

Page 5 of 6

DHEC ADMINISTRATIVE POLICY MANUAL COMMISSIONERS OFFICE the individual identified or his or her guardian authorizes (unless the physician determines in writing in the record that the information is detrimental to the patients treatment regimen). a court order directs that disclosure is necessary for the conduct of proceedings before it and that failure to make the disclosure is contrary to the public interest. disclosure is necessary to cooperate with law enforcement, health, welfare, and other state or federal agencies or when furthering the welfare of the patient and his family.

b.

All information directly or indirectly related to alcohol or drug abuse (identity, diagnosis, prognosis, or treatment) contained in the comprehensive health record (normally this is secondary information) must be kept confidential and be disclosed only under the following circumstances pursuant to S.C. Code 44-22-100: authorization of the patient. disclosure made to other medical personnel to the extent necessary to meet a bona fide medical emergency. court order showing good cause; on assessing good cause the court must weigh the public interest and the need for disclosure against injury to the patient, the physician-patient relationship and the treatment service.

9.

CONFIDENTIALITY OF TB INFORMATION The School Employee/Individual Certificate of Examination for Tuberculosis (DHEC 1420) may be released without the patients authorization as required by law.

Rev 7/2011

A.910

Page 6 of 6