The Center for Health & Pharmaceutical Law & Policy The regulation identifies a number of exceptions to this general confidentiality requirement. 199 Most pertinent for purposes of information sharing to facilitate integrated care, there is a limited treatment exception.200 Provider agencies may disclose information “to any licensed mental health provider or medical health care provider who has a contract with [the Division of Mental Health and Addiction Services (DMHAS)] or [DHS], or to the consumer's personal physician if it appears that the information is to be used for the benefit of the consumer.” 201 Although it is not clear, it appears that the “benefit of the consumer” condition only applies to disclosure to a consumer’s personal physician and does not also apply to providers with DHS or DMHAS contracts. Section 10:37-6.79(b) includes additional provisions for sharing patient health information, “upon presentation of appropriate credentials.” 202 For one, provider agencies may disclose confidential information to employees of the agency involved in the care of the consumer as long as the patient is advised when he or she enters treatment that agency staff will have access. 203 Employees of the agency also may disclose confidential information relevant to current treatment to the staff of another “such agency” as long as the disclosure complies with HIPAA, 204 although the regulation does not define “such agency.” Disclosures pursuant to Section 10:37-6.79(b), however, are subject to a number of additional conditions. 205 Curiously, for example, the regulation calls for such disclosures to use initials in place of the patient’s name, where possible, which would seem to limit the information’s value for care coordination.206 In addition, the custodian of the records must provide written notice that redisclosure without patient authorization or as otherwise provided by law is prohibited. 207 The information and records disclosed “shall be limited to that information which is relevant and necessary for the purpose of the disclosure, except as authorized by the consumer or his or her representative or required by law.” 208 But “[w]here the disclosure is between agencies for the purpose of treatment and is not limited by the consumer's authorization, the agency releasing the information shall rely upon the recipient's assertion of need for the information.” 209 The request for information and the response thereto must be recorded in the consumer’s clinical record, and consumers are entitled to an accounting for up to six years from the
See id. § 10:37-6.79. See id. § 10:37-6.79(f). 201 Id. 202 Id. § 10:37-6.79(b). 203 See id. § 10:37-6.79(b)(1). 204 See id. § 10:37-6.79(b)(1)(i). 205 See id. § 10:37-6.79(h). 206 See id. § 10:37-6.79(d). This condition may be sensible for other disclosures permitted in Section 10:37-6.79(b), where the purpose for the disclosure does not depend on access to individually identifiable information, such as disclosures for purposes of audit and investigation. See id. § 10:37-6.79(b)(2)-(4). But requiring redaction and use of initials seems in tension with disclosures for treatment, where the very purpose of disclosure is to treat an identifiable individual. 207 See id. § 10:37-6.79(h)(1). It is not clear why DHS opted to apply this restriction only to disclosures to treatment personnel and agency staff authorized in Section 10:37-6.79(b) and did not apply a similar redisclosure notice requirement on disclosures to other medical providers pursuant to Section 10:37-6.79(f). 208 Id. § 10:37-6.79(h)(2). 209 Id. 199 200
SETON HALL LAW
II 25