| Access to Criminal History Information:
MHL §7.09(j): The Commissioner of OMH is authorized to have access to criminal history information contained in the central data facility established by DCJS; summary reports can be included in patient records for purposes of making decisions regarding care and treatment, health and safety, privileges and discharge planning for patients admitted to/retained in hospitals operated by OMH. |
§160.103: Covered entity means: (1) a health plan; (2) a health care clearinghouse; (3) a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. |
No preemption: Assuming DCJS is not a covered entity under HIPAA, there are no HIPAA restrictions on its disclosures to OMH. OMH is authorized to receive criminal justice information by State law. |
| Directors of Facilities: Subpoena Authority:
MHL §7.21 (c): In any investigation into treatment and care of patients or the conduct, performance, or neglect of duty of officers or employees, the director of a department hospital shall be authorized to subpoena witnesses, compel their attendance, administer oaths to witnesses, examine witnesses under oath, and require the production of any books or papers deemed relevant to the inquiry or investigation. A subpoena issued under this section shall be regulated by the civil practice law and rules. |
§164.501: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory…or a person or entity operating under a grant of authority from or contract with such public agency….that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
§164.512(d) A covered entity may disclose PHI to a health oversight agency for oversight activities authorized by law.
§164.512(e): PHI can be released w/out patient consent in the course of any judicial or administrative proceeding(1)in response to an order of a court or administrative tribunal, provided release is limited to that PHI expressly authorized in the order; or(2) in response to a subpoena, discovery request, or other lawful process if the covered entity has made reasonable efforts to give the patient notice of the request or the covered entity is assured that reasonable efforts have been made to secure a qualified protective order. |
No preemption. Disclosures to facility directors under these circumstances can be made consistent with the "health oversight agency" and "in the course of administrative proceedings" exceptions to the HIPAA regulations. As such, the State law is not contrary to the Federal regulations and State law applies. |
| Board of Visitors:
MHL §7.33 (h): Any member of the Board of Visitors of an OMH facility may visit and inspect such facility at any time ….the board shall have the power to investigate all charges against the director and all cases of alleged patient abuse or mistreatment…..in conducting such an investigation, the board shall have the power, in accordance with the civil practice law and rules, to subpoena witnesses, compel their testimony,….and require the production of any books or records deemed relevant to the investigation. |
§164.501: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory…or a person or entity operating under a grant of authority from or contract with such public agency….that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.
§164.512(d) A covered entity may disclose PHI to a health oversight agency for oversight activities authorized by law. |
No preemption. Disclosures to the Board of Visitors can be made consistent with the "health oversight agency" and "required by law" exceptions to the HIPAA regulations. As such, the State law is not contrary to the Federal regulations and State law applies. |
Transitional Care:
MHL §7.38 (c),(f)
(c) The Office shall enter into a memorandum of understanding with the department of social services to facilitate access by the office to child care facilities providing transitional care to young adults as may be necessary by the office to meet its responsibilities for monitoring the care of young adults.
(f) In any case where an individual receiving transitional funding is about to be transferred from one facility to another, a transfer plan shall be prepared by the sending facility and forwarded to the receiving facility and the individual, and unless the individual objects,parents, guardians or other persons interested in the care of such person prior to the transfer. The transfer plan shall include any information necessary to facilitate a safe transfer, such as specific problems, a schedule for administering medications and behavior unique to the individual. |
re: (c): §164.501: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory…or a person or entity operating under a grant of authority from or contract with such public agency….that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
re: (f): §164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02
§164.510(b)(1): A covered entity may disclose to a family member, other relative, close personal friend of the individual or any other person identified by the individual, the PHI directly relevant to such persons involvement with the individual's care or payment related to the individual's care, if the individual is given the opportunity to agree, prohibit, or restrict the disclosure. |
re: (c):
No Preemption. Access to PHI by OMH can be obtained consistent with the "health oversight agency" exception to the HIPAA regulations. As such, the State law is not contrary to the Federal regulations and State law applies.
re: (f): No Preemption: The state law requirement mandating that a transfer plan be submitted from a sending facility to both a receiving facility and the individual is permitted via the "required by law" exception in HIPAA and hence this part of the State law is not preempted. Furthermore, adoption of the proposed amendments to HIPAA, which eliminated the requirement for obtaining patient consent to use/disclose PHI for treatment purposes, render this provision consistent with HIPAA.
With regard to notifications of parents, guardians, and other interested persons, the State law provision which affords an opportunity for the patient to object to such notifications is consistent with HIPAA. As such, State law applies. |
