Mental Health Issues & Mental Health Issues & Information SharingInformation Sharing

Professor Peter P. SwireProfessor Peter P. Swire

The Ohio State UniversityThe Ohio State University

NAAG Task Force on School SafetyNAAG Task Force on School Safety

July 5, 2007 July 5, 2007

OverviewOverview My backgroundMy background When does information sharing actually help?When does information sharing actually help? HIPAAHIPAA FERPAFERPA Reasons to do due diligence before assuming Reasons to do due diligence before assuming

that information sharing has net benefitsthat information sharing has net benefits

My BackgroundMy Background

Currently:Currently: Moritz College of Law, Ohio State U.Moritz College of Law, Ohio State U. Senior Fellow, Center for American ProgressSenior Fellow, Center for American Progress Research on privacy, consumer protection, Research on privacy, consumer protection,

computer security & homeland securitycomputer security & homeland security 1999 to early 2001:1999 to early 2001:

Chief Counselor for Privacy, OMBChief Counselor for Privacy, OMB White House coordinator, HIPAA privacy ruleWhite House coordinator, HIPAA privacy rule Led HIPAA/FERPA processLed HIPAA/FERPA process

I. When Will Info Sharing Help?I. When Will Info Sharing Help?

2006 article 2006 article Privacy & Information Sharing in the Privacy & Information Sharing in the War Against TerrorismWar Against Terrorism Due diligence list for proposed info sharingDue diligence list for proposed info sharing Often, undue optimism that good things will Often, undue optimism that good things will

happen with info sharinghappen with info sharing Be careful what you wish for …Be careful what you wish for …

Be Careful What You Wish ForBe Careful What You Wish For

Suppose state AGs received reports on:Suppose state AGs received reports on: Every troubled or depressed youthEvery troubled or depressed youth Every suspicious gun purchaseEvery suspicious gun purchase Every threat by a teen against anotherEvery threat by a teen against another

If State AGs Get the DataIf State AGs Get the Data

If you receive the information, what do you If you receive the information, what do you do with it?do with it? Investigate every lead?Investigate every lead? Is that a good use of resources?Is that a good use of resources? The problem of “false positives” and a quick The problem of “false positives” and a quick

check (that you can afford) won’t be good at check (that you can afford) won’t be good at telling the one in ten thousand that is truly telling the one in ten thousand that is truly dangerousdangerous

If State AGs Get the DataIf State AGs Get the Data

What if you receive the info but do nothing What if you receive the info but do nothing with it?with it? The wasted resources to create an The wasted resources to create an

information sharing system that is not usedinformation sharing system that is not used When the next thing goes wrong, lots of finger When the next thing goes wrong, lots of finger

pointing about why nothing was done to pointing about why nothing was done to prevent the incidentprevent the incident

In short, do info sharing if and only if there In short, do info sharing if and only if there are net benefits, after due diligenceare net benefits, after due diligence

II. HIPAA BasicsII. HIPAA Basics

HIPAA applies only to “covered entities”HIPAA applies only to “covered entities” For your purposes, providers and health For your purposes, providers and health

insurers (as well as their business associates)insurers (as well as their business associates) Others who create or transmit health care Others who create or transmit health care

data are not covereddata are not covered State public health agencies broadly State public health agencies broadly

exemptedexempted But often have state or local laws that are But often have state or local laws that are

stricter, and they may limit sharingstricter, and they may limit sharing

Disclosure from Covered EntitiesDisclosure from Covered Entities

Basic rule – disclosure from covered entities Basic rule – disclosure from covered entities only with patient authorization (an “opt in”)only with patient authorization (an “opt in”)

Some important exceptionsSome important exceptions ““Required by law” – gunshot wounds & other Required by law” – gunshot wounds & other

required reportsrequired reports Disclosure to public health agenciesDisclosure to public health agencies Legal proceedings – a judge can orderLegal proceedings – a judge can order Law enforcement access, usually with an Law enforcement access, usually with an

administrative subpoenaadministrative subpoena

HIPAA & Mental HealthHIPAA & Mental Health

““Psychotherapy notes” are more strictly Psychotherapy notes” are more strictly protectedprotected Follows Jaffee v. Redmond and stronger Follows Jaffee v. Redmond and stronger

privilege for psychotherapy careprivilege for psychotherapy care Many HIPAA exceptions don’t applyMany HIPAA exceptions don’t apply

Not the usual law enforcement accessNot the usual law enforcement access Not the usual judge-order court accessNot the usual judge-order court access Strong idea of “privilege” in order to assure Strong idea of “privilege” in order to assure

patient openness in therapypatient openness in therapy

HIPAA & Mental HealthHIPAA & Mental Health

Sometimes disclosure is permittedSometimes disclosure is permitted Tarasoff situation – “in order to prevent or Tarasoff situation – “in order to prevent or

lessen the risk of a serious or imminent threat lessen the risk of a serious or imminent threat to the health or safety of a person or the to the health or safety of a person or the public”public”

Scope of “psychotherapy notes”, though, Scope of “psychotherapy notes”, though, is limitedis limited Are notes kept separate from a patient’s Are notes kept separate from a patient’s

standard medical filestandard medical file

III. FERPA IssuesIII. FERPA Issues

Family Educational Right to Privacy Act of Family Educational Right to Privacy Act of 1974 (FERPA)1974 (FERPA)

Basic rule is opt-in consent for disclosure Basic rule is opt-in consent for disclosure of “educational records”of “educational records” GradesGrades Disciplinary proceedings, etc.Disciplinary proceedings, etc.

No special rules for mental health under No special rules for mental health under FERPAFERPA

The School Nurse & FERPAThe School Nurse & FERPA

Medical records typically are “educational records” under Medical records typically are “educational records” under FERPA and are disclosed only with parent consentFERPA and are disclosed only with parent consent Student consent once 18 or post-secondaryStudent consent once 18 or post-secondary

NotNot “educational records” when “are made or maintained “educational records” when “are made or maintained by a physician, psychiatrist, psychologist, or other by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the only in connection with the provision of treatment to the student, and are not available to anyone other than student, and are not available to anyone other than persons providing such treatment”persons providing such treatment”

Those records are likely to be covered by HIPAAThose records are likely to be covered by HIPAA

HIPAA & FERPAHIPAA & FERPA

We did not want the school nurse to have to We did not want the school nurse to have to comply with both HIPAA & FERPAcomply with both HIPAA & FERPA

HIPAA says doesn’t count as protected health HIPAA says doesn’t count as protected health information if it is covered by FERPAinformation if it is covered by FERPA

In practice, colleges now often are HIPAA; pre-In practice, colleges now often are HIPAA; pre-college usually are FERPAcollege usually are FERPA

AG Access to School RecordsAG Access to School Records

Both HIPAA & FERPA have basic rule of opt-in Both HIPAA & FERPA have basic rule of opt-in consent for disclosureconsent for disclosure

FERPA allows disclosure pursuant toFERPA allows disclosure pursuant to Court order, orCourt order, or Subpoena with prior notice to the familySubpoena with prior notice to the family

HIPAA, as discussed above, is stricter for HIPAA, as discussed above, is stricter for psychotherapypsychotherapy Otherwise administrative subpoena usually Otherwise administrative subpoena usually

worksworks

ConclusionConclusion Be careful what you wish for when it comes to Be careful what you wish for when it comes to

information sharinginformation sharing Target real needs, and realize downsides of Target real needs, and realize downsides of

false positives, computer security obligations if false positives, computer security obligations if you run a system, and privacy invasionsyou run a system, and privacy invasions

Are other approaches better, such as better Are other approaches better, such as better coordination with campus police?coordination with campus police?

Thank youThank you

Contact InformationContact Information

Phone: (240) 994-4142Phone: (240) 994-4142 Email: Email: peter@peterswire.net Web: Web: www.peterswire.net ““Privacy & Information Sharing in the War Privacy & Information Sharing in the War

Against Terrorism” at Against Terrorism” at http://ssrn.com/abstract=899626