| NYS Statute |
HIPAA Regulation
(45 CFR Parts 160, 164) |
Preemption Analysis |
| MHL Article 9 - Hospitalization of Mentally ill |
| Voluntary Admissions:
MHL §9.13(b): …if there are reasonable grounds for belief that the patient may be in need of involuntary care and treatment, the director may retain the need for the patient for a period not to exceed 72 hours… Before the expiration of such 72 hour period, the director shall either release the patient or apply to the supreme court or the county court in the county where the hospital is located for an order authorizing the involuntary retention of such patient. |
§164.506(a)(3)(i)(B) :If the covered health care provider is required by law to treat the individual, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02 |
No preemption: If a person meets the statutory criteria for involuntary treatment, a court will issue an order requiring that such treatment be provided (i.e., the treatment is "required by law.") Inasmuch as the disclosures necessary to initiate an action to obtain such order must be made, the "treatment required by law" exception can be reasonably be deemed to extend back to the information that forms the foundation of the order
Note: Under State law, there is no requirement that an attempt be made to obtain patient consent, which would have required a change in current practice; however 8/02 adoption of amendments removing the requirement to obtain patient consent to use/disclose PHI for treatment, payment, or health care operations purposes removes this as a concern. |
| Voluntary/Informal Admissions; Review of Status:
MHL §9.25: …The director shall review the suitability of such patient to remain in such status, and the mental hygiene legal service shall review the willingness of such patient to remain in such status. Notice of the determination of the patient's suitability made by the director shall be given to the mental hygiene legal service….. |
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. |
No preemption: State law applies; the use/disclosure of PHI is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law. |
| Involuntary Admission on Medical Certification:
MHL §9.27(f): Following admission to a hospital, no patient may be sent to another hospital by any form of involuntary admission unless the mental hygiene legal service has been given notice thereof. |
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. |
No preemption: State law applies; the use/disclosure of PHI is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law. |
| Involuntary Admission on Medical Certification: Notice of Admission to Patients and Others
MHL §9.29: (a) The director shall cause written notice of a person's involuntary admission on an application supported by medical certification to be given forthwith to the Mental Hygiene Legal Services.
(b) The director shall cause written notice of the admission of such person….after such admission to the following:
1. The nearest relative of the person alleged to be mentally ill other than the applicant, if there be any such person known to the director;
2. As many as 3 additional persons, if designated in writing to receive such notice by the person admitted. |
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.
§164.510(b)(1): A covered entity may disclose to a family member, other relative, close personal friend of the individual or any other person identified by the individual, the PHI directly relevant to such persons involvement with the individual's care or payment related to the individual's care, if the individual is given the opportunity to agree, prohibit, or restrict the disclosure. |
No preemption: State law applies; the use/disclosure of PHI to the MHLS and the nearest relative of the patient is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law. Further, the ability afforded a patient by State law to designate other persons to receive notice of the patient's hospitalization is consistent with HIPAA provisions that permit such notifications, provided patients have agreed to them. |
| Involuntary Admission on Medical Certification: Patient's Right to a Hearing
MHL §9.31(a),(b),(f)
(a) If….a patient or any relative or friend on behalf of a patient or the Mental Hygiene Legal Services gives notice of a request for a hearing, a hearing shall be held…
(b): It shall be the duty of the director upon receiving notice of such request for hearing to forward forthwith a copy of such notice with a record of the patient to the supreme court or the county court….A copy of such notice shall also be given to the Mental Hygiene Legal Service.
(f) The papers in any proceeding under this article which are filed with the county clerk shall be sealed and shall be exhibited only to the parties to the proceeding or someone properly interested, upon order of the court. |
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. |
No preemption: State law applies; the use/disclosure of PHI is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law.
With regard to MHL §9.31(f), there is no corresponding provision in HIPAA; hence State law provides more protection to PHI in this instance and prevails. |
| Court Authorization to Retain an Involuntary Patient
MHL §9.33(a),(d):
(a): If the director determines that a patient admitted upon an application supported by medical certification , for whom there is no court order authorizing retention for a specific period, is in need of retention and if such patient does not agree to remain in the hospital as a voluntary patient, the director shall apply to the supreme court or the county court…for an order authorizing continued retention….The director shall cause written notice of the application to be given to the patient and a copy thereof…to the persons required by this article to be served with notice of such patient's initial application and to the mental hygiene legal service.
(d): If the director shall determine that the condition of such patient requires his further retention in a hospital, he shall, if such patient does not agree to remain in such hospital as a voluntary patient, apply during the period of retention authorized by the last order of the court to the supreme court or the county court…for an order authorizing continued retention of such patient… |
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. |
No preemption: State law applies; the use/disclosure of PHI is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law. |
| Involuntary admission on Certificate of Director of Community Services or his designee
MHL §9.37(a),(d):
(a): [Effective until 7/01/04]: The director of a hospital, upon application by a director of community services or an examining physician duly designated by him or her,may receive and care for in such hospital as a patient any person who, in the opinion of the director of community services or the director's designee, has a mental illness for which immediate inpatient care and treatment in a hospital is appropriate….
(a): [Effective 7/01/04]: The director of a hospital, upon application by a director of community services or an examining physician duly designated by him may receive and care for in such hospital as a patient any person who, in the opinion of the director of community services or the director's designee, has a mental illness for which immediate inpatient care and treatment in a hospital is appropriate and which is likely to result in serious harm to himself or others…
(d) After signing the application, the director of community services or the director's designee shall be authorized and empowered to take into custody, detain, transport, and provide temporary care to any such person. Upon the written request of such director or the director's designee, it shall be the duty of peace officers, when acting pursuant to their special duties, or police officers who are members of the state police or of an authorized police department or force or of a sheriff's department to take into custody and transport any such person as requested and directed by such director or his designee. Upon the written request of such director or designee, an ambulance service,….is authorized to transport any such person. |
§164.501: Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02 |
No preemption: State law applies; the use/disclosure of PHI is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law.
Under HIPAA, such consent is also not required via the "required to treat," emergency, or "substantial barriers to communicate" exceptions, although an attempt must be made to obtain patient consent. This would have required a change in current practice; however the 8/02 adoption of amendments removing the requirement to obtain patient consent to use/disclose PHI for treatment, payment, or health care operations purposes remove this as a concern. |
| Emergency admissions for immediate observation, care, and treatment:
MHL §9.39
(a) The director of any hospital maintaining adequate staff and facilities for the observation, examination, care, and treatment of persons alleged to be mentally ill and approved by the commissioner to receive and retain patients….may receive and retain therein as a patient for a period of 15 days any person alleged to have a mental illness for which immediate observation, care, and treatment in a hospital is appropriate and which is likely to result in serious harm to himself or others…
Such person shall be served, at the time of admission, with written notice of his status and rights as a patient under this section. Such notice shall contain the patient's name. At the same time, such notice shall also be given to the mental hygiene legal service and personally or by mail to such person or persons, not to exceed three in number, as may be designated in writing to receive such notice by the person alleged to be mentally ill. If at any time after admission, the patient, any relative, friend, or the mental hygiene legal service gives notice to the director in writing of request for court hearing on the question of need for immediate observation, care and treatment, a hearing shall be held as herein…..It shall be the duty of the director upon receiving notice of such request for hearing to forward forthwith a copy of such notice with a record of the patient to the supreme court or county court…A copy of such notice and record shall also be given to the mental hygiene legal services. |
§164.501:Required by law: a mandate contained in law that compels a covered entity to make a use/disclosure of PHI & that is enforceable in a court of law…includes, but is not limited to, court orders/court ordered warrants, subpoenas/ summons issued by a court, grand jury, ..inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; … and statutes or regulations that require the production of information, including statutes/ regulations that require such information if payment is sought under a government program providing public benefits.
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations w/out patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02
§164.512(a): A covered entity may use/ disclose PHI to the extent that such use/ disclosure is required by law and the use/disclosure complies with/ is limited to the relevant requirements of such law.
§164.510(b)(1): A covered entity may disclose to a family member, other relative, close personal friend of the individual or any other person identified by the individual, the PHI directly relevant to such persons involvement with the individual's care or payment related to the individual's care, if the individual is given the opportunity to agree/ prohibit, restrict the disclosure
§164.512(e): PHI can be released w/out patient consent in the course of any judicial or administrative proceeding(1)in response to an order of a court or administrative tribunal, provided release is limited to that PHI expressly authorized in the order; or(2) in response to a subpoena, discovery request, or other lawful process if the covered entity has made reasonable efforts to give the patient notice of the request or the covered entity is assured that reasonable efforts have been made to secure a qualified protective order. |
No preemption: State law applies; the use/disclosure of PHI is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law.
Note: Under State law, there is no requirement that patient consent be obtained to use/disclose patient information in order to treat the patient. Under HIPAA, such consent is also not required via the "required to treat," emergency, or "substantial barriers to communicate" exceptions, although an attempt must be made to obtain patient consent. This would have required a change in current practice; however, the 8/02 amendments removing the requirement to obtain patient consent to use/disclose PHI for treatment, payment, or health care operations purposes remove this as a concern. |
| Emergency admissions for immediate observation, care, and treatment in comprehensive psychiatric emergency programs
MHL §9.40 [Effective 7/1/04]
(a) The director of any comprehensive emergency program may receive and retain patients….may receive and retain therein as a patient for a period not to exceed 72 hours any person alleged to have a mental illness for which immediate observation, care, and treatment in a hospital is appropriate and which is likely to result in serious harm to himself or others…
(b) The director shall cause examination of such persons to be intiated by a staff physician of the program as soon as practicable…..
(c) ….At the time of admission to an extended observation bed, such person shall be served with written notice of his status and rights as a patient under this section. Such notice shall contain the patient's name. The notice shall be provided to the same persons and in the manner as if provided pursuant to subdivision (a) of section 9.39 of this article.
(e) If at any time….it is determined that such person continues to require immediate observation, care and treatment in accordance with this section…such person shall be removed within a reasonable period of time to an appropriate hospital authorized to receive and retain patients pursuant to section 9.39 of this article and such person shall be evaluated for admission and, if appropriate, shall be admitted to such hospital in accordance with section 9.39 of this article…..
(f) Nothing in this section shall preclude the involuntary admission of a person to an appropriate hospital pursuant to the provisions of this article……efforts shall be made to assure that any arrangements for such involuntary admission shall be made within a reasonable period of time. |
§164.501: Required by law: a mandate contained in law that compels a covered entity to make a use/disclosure of PHI and that is enforceable in a court of law; includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a gov'tal…inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation…; and statutes/ regulations that require the production of information, including statutes/ regulations that require such information if payment is sought under a government program providing public benefits.
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02
§164.512(a): A covered entity may use/ disclose PHI to the extent that such use/ disclosure is required by law and the use/ disclosure complies with and is limited to the relevant requirements of such law.
§164.510(b)(1): A covered entity may disclose to a family member, other relative, close personal friend of the individual or any other person identified by the individual, the PHI directly relevant to such persons involvement with the individual's care or payment related to the individual's care, if the individual is given the opportunity to agree, prohibit, or restrict the disclosure
§164.512(e): PHI can be released w/out patient consent in the course of any judicial or administrative proceeding(1)in response to an order of a court or administrative tribunal, provided release is limited to that PHI expressly to a subpoena, discovery request, or other lawful process if the covered entity has made reasonable efforts to give the patient notice of the request or the covered entity is assured that reasonable efforts have been made to secure a qualified protective order. |
No preemption: State law applies; the use/disclosure of PHI is required by law; provided it complies with that law, it is not preempted, though the disclosure must be limited to the relevant requirements of the law.
Note: Under State law, there is no requirement that patient consent be obtained to use/disclose patient information in order to treat the patient. Under HIPAA, such consent is also not required via the "required to treat," emergency, or "substantial barriers to communicate" exceptions, although an attempt must be made to obtain patient consent.This would have required a change in current practice; however, the 8/02 amendments removing the requirement to obtain patient consent to use/disclose PHI for treatment, payment, or health care operations purposes remove this as a concern. |
| Emergency admissions for immediate observation, care, and treatment; powers of certain peace officers and police officers
MHL §9.41 [Effective until 7/1/04]
Any peace officer, when acting pursuant to his or her special duties, or police officer who is a member of the state police……Such officer may direct the removal of such person….or…temporarily detain any such person in another safe and comfortable place….in which event, such officer shall immediately notify the director of community services or, if there be none, the health officer of the city of county of such action.
MHL §9.41 [Effective 7/1/04]
Any peace officer, when acting pursuant to his or her special duties, or police officer who is a member of the state police……Such officer may direct the removal of such person….or…temporarily detain any such person in another safe and comfortable place….in which event, such officer shall immediately notify the director of community services or, if there be none, the health officer of the city of county of such action. |
§160.103: Covered entity means: (1) a health plan; (2) a health care clearinghouse; (3) a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. |
No preemption: Peace/police officers are not covered entities under HIPAA; hence it does not apply. State law applies. |
| Emergency admissions for immediate observation, care, and treatment; powers ofdirectors of community services
MHL §9.45 [Effective until 7/1/04]
The director of community services or the director's designee shall have the power to direct the removal of any person, within his jurisdiction, to a hospital……if the parent, adult, sibling, spouse, or child of the person, a committee of the person, a licensed psychologist……currently responsible for providing treatment services…reports to him that such person has a mental illness for which immediate care and treatment in a hospital is appropriate and which is likely to result in serious harm to him/herself or others. It shall be the duty of peace officers….or police officers….to take into custody and transport any such person. Upon the request of a director of community services…an ambulance service…is authorized to transport any such person. Such person may then be retained in a hospital pursuant…to section 9.39 or 9.40 of this article.
MHL §9.45 [Effective 7/1/04]
The director of community services or the director's designee shall have the power to direct the removal of any person, within his jurisdiction, to a hospital……if the parent, adult, sibling, spouse, or child of the person, a committee of the person, a licensed psychologist……currently responsible for providing treatment services…reports to him that such person has a mental illness for which immediate care and treatment in a hospital is appropriate and which is likely to result in serious harm to him/herself or others….. It shall be the duty of peace officers….or police officers….to take into custody and transport any such person. Upon the request of a director of community services…an ambulance service…is authorized to transport any such person. Such person may then be retained in a hospital pursuant…to section 9.39 of this article. |
§164.501: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory…or a person or entity operating under a grant of authority from or contract with such public agency….that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
§164.501: Required by law: a mandate contained in law that compels a covered entity to make a use/disclosure of PHI and that is enforceable in a court of law; includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a gov'tal…inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation…; and statutes/ regulations that require the production of information, including statutes/ regulations that require such information if payment is sought under a government program providing public benefits.
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02
§164.512(d)(3) PHI may be disclosed to health oversight agencies for oversight activities authorized by law, including licensure or disciplinary actions. (p. 82814:2)
§164.512(j): A covered entity may, consistent with applicable law and standards of ethical conduct, use/disclose PHI if it believes, in good faith, that the use/disclosure (i)(A) is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (B) is to a person(s) reasonably able to prevent/lessen the threat. |
No preemption: State law applies; the use/disclosure of PHI by the director of community services is required by law and is otherwise authorized pursuant to the DCS' health oversight authority. Disclosures/use made by peace and police officers are not governed by HIPAA, since these are not covered entities. Finally, disclosures by health professionals pursuant to this section of law are authorized to lessen or prevent a serious threat to the health/safety of the person with mental illness, due to the "likelihood of serious harm to him/herself or others" criterion within the State statute. Hence, State law applies. |
| Duties of local officers in regard to their mentally ill
MHL §9.47 [Effective until 6/30/05]: (a) All directors of community services, health officers, and social services officials, as defined by the social services law, are charged with the duty of seeing that all mentally ill persons within their respective communities who are in need of care and treatment at a hospital are admitted to a hospital pursuant to the provisions of this article. Social services officials and health officers shall notify the director of community services of any such person coming to their attention. Pending the determination of the condition of an alleged mentally ill person, it shall be the duty of the director of community services and, if there be no such director, of the local health officer to provide for the proper care of such person in a suitable facility.
(b) [Effective until 6/30/05]: All directors of community services shall be responsible for the filing of petitions for assisted outpatient treatment (AOT) …..and for coordinating the delivery of court ordered services with with program coordinators….In discharge of the duties imposed by…section 9.60 of this article, directors of community services may provide services directly, or may coordinate services with the offices of the department or may contract with any public or private provider to provide services for such programs as may be necessary to carry out the duties imposed pursuant to this subdivision. |
§164.501: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory…or a person or entity operating under a grant of authority from or contract with such public agency….that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
§164.512(d)(3) PHI may be disclosed to health oversight agencies for oversight activities authorized by law, including licensure or disciplinary actions. (p. 82814:2)
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02 |
No preemption: Disclosures to the director of community services are permitted by HIPAA without patient consent due to the establishment in this statute of the directors of community services, health officers, and social services officials, as health oversight agencies. Furthermore, some of the express oversight activities authorized by law are set forth in this statute, including the filing of AOT petitions and coordination of the delivery of court ordered care by the director of community services. Uses/disclosures for treatment purposes are permitted since the treatment is required by law, and also because recent amendments to the HIPAA regulations permit uses/disclosures of PHI for treatment purposes without patient consent.
Note 1: Under State law, there is no requirement that patient consent be obtained to use/disclose patient information in order to treat the patient. Originally, the HIPAA final rules provided that such consent would not be required via the "required to treat," exception, although an attempt must be made to obtain patient consent, which would have required a change in current practice. The 8/02 amendments removing the requirement to obtain patient consent to use/disclose PHI for treatment, payment, or health care operations purposes remove this as a concern.
Note 2: To the extent that Directors of Community Services coordinate their health oversight services with other Department offices or contract with public or private providers to provide AOT services to assist in the performance of their statutory duties, Business Associate Agreements may need to be executed. |
| Duties of directors of assisted outpatient treatment (AOT) programs
MHL §9.48 [Effective until 6/30/05]: (a)(1) Directors of AOT programs …shall provide a written report to the program coordinators, appointed by the commissioner of mental health pursuant to …section 7.17 of this chapter…..The report shall…include, but not be limited to…(i) a copy of the court order; (ii) a copy of the written treatment plan; (iii) the identity of the case manager or assertive community treatment team…(iv) the identity of the provider of services; and (v) the date on which services commence(d). (2) The Directors of AOT programs shall ensure the timely delivery of services …pursuant to court order.
(b) Directors of AOT programs shall submit quarterly reports to the program directors regarding the AOT program…the report shall include…(i) the names of individuals served by the program; (ii) the percentage of petitions for AOT granted by the court; (iii) any change in status of assisted outpatient..(iv) a description of material changes in the treatment plans..(v) any change in case managers; (vi) a description of categories of services ordered by the court; (vii) living arrangements of individuals served by the program…(viii) any other information as required by the Commissioner of OMH; and (ix) any recommendations to improve the program. |
§164.501: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory…or a person or entity operating under a grant of authority from or contract with such public agency….that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
§164.501: Required by law: a mandate contained in law that compels a covered entity to make a use/disclosure of PHI and that is enforceable in a court of law…it includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a gov'tal…inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation …; and statutes or regulations that require the production of information, including statutes/ regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use/ disclose PHI to the extent that such use/ disclosure is required by law and the use/ disclosure complies with and is limited to the relevant requirements of such law.
§164.512(d)(3) PHI may be disclosed to health oversight agencies for oversight activities authorized by law, including licensure or disciplinary actions. (p. 82814:2) |
No preemption: State law applies, as all disclosures without patient consent/authorization are permitted by HIPAA. As a designee of the Commissioner of the Office of Mental Health, reports to directors of AOT programs are permitted consistent with its health oversight function. Other disclosures, to the extent incorporated within the AOT court order, are required by law and are therefore permitted under HIPAA without patient consent/authorization.
All reports required by the Commissioner of OMH are authorized consistent with its health oversight responsibilities. Hence, State law applies. |
| Residential treatment facilities for children & youth
MHL §9.51 (also see 14 NYCRR Part 583)
(a) The director of a residential treatment facility for children & youth may receive as a patient a person in need of care and treatment in such a facility who has been certified as needing such care by the pre-admission certification committee serving the facility….
(b) Persons admitted as inpatients to hospitals operated by the OMH upon the application of the director for the Division for Youth pursuant to section 509 of the Executive law or section 353.4 of the Family Court Act ….may, if appropriate..be transferred to a residential facility fo children & youth. The director of the division for youth shall be notified of any such transfer….
(c) The commissioner of OMH shall designate pre-admission certification committees…to evaluate each person proposed for admission or transfer to a residential treatment facility for children & youth…Each pre-admission certification committee shall designate five persons…who shall serve as an advisory board to the committee. Such board shall have the right to visit residential treatment facilities for children & youth served by the committee and shall have the right to review clinical records obtained by the pre-admission certification committee and shall be bound by the confidentiality requirements of section 33.13 of this chapter.
(d) All applications for admission or transfer…..shall be referred to a pre-admission certification committee for evaluation of the needs of the individual..
(g) Notwithstanding any other provision of law, pre-admission certification committees shall be entitled to review clinical records maintained by any person or entity which pertain to an individual on whose behalf an application is made for admission to a residential treatment facility for children & youth. Any clinical records received by a pre-admission certification committee and all assessments submitted to the committee shall be kept confidential in accordance with the provisions of section 33.13 of the mental hygiene law, provided, however, that the commissioner may have access to and receive copies of such records for the purpose of evaluating the operation and effectiveness of the committee. Confidentiality of clinical records of treatment of a person in a residential treatment facility required in section 33.13 of this chapter. That portion of the clinical record maintained by a residential treatment facility for children & youth operated by an authorized agency specifically related to medical care and treatment shall not be considered part of the record required to be maintained by such authorized agency pursuant to section 372 of the social services law and shall not be discoverable in a proceeding under section 358-a of the social services law except upon order of the family court; provided, however that all other information required by a social services district or the state department of social services for purposes of sections 358-a, 392, 409-e and 409-f of the social services law shall be furnished on request, and the confidentiality of such information shall be safeguarded as provided in section 460-e of the social services law. for children & youth shall be maintained as |
§164.501: Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory…or a person or entity operating under a grant of authority from or contract with such public agency….that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.
§164.501: Required by law: a mandate contained in law that compels a covered entity to make a use/disclosure of PHI and that is enforceable in a court of law…it includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a gov'tal…inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation …; and statutes or regulations that require the production of information, including statutes/ regulations that require such information if payment is sought under a government program providing public benefits.
§164.512(a): A covered entity may use/ disclose PHI to the extent that such use/ disclosure is required by law and the use/ disclosure complies with and is limited to the relevant requirements of such law.
§164.512(d)(3) PHI may be disclosed to health oversight agencies for oversight activities authorized by law, including licensure or disciplinary actions. (p. 82814:2) |
No preemption: State law applies, as all disclosures without patient consent/authorization are permitted by HIPAA. The Pre-Admission certification are designated under law to implement the health oversight responsibilities of the Commissioner of the Office of Mental Health. Therefore, reports made to them are permitted consistent with their health oversight function. Other disclosures under this statute are required by law and are therefore permitted under HIPAA without patient consent/authorization.
The provisions of State law which give additional confidentiality protections to medical portions of a clinical record are more stringent than HIPAA, and hence, State law prevails. Provisions of State law requiring production of information pursuant to the Family Court Act and/or Social Services Law are permitted under the "required by law" exceptions of HIPAA.
Note : Business Associate Agreements between OMH and the the pre-admission certification committees may be required, as they are providing a health oversight service on behalf of OMH and PHI is necessary in order to provide this service. |
| Emergency admissions for immediate observation, care, and treatment; powers of emergency room physicians
MHL §9.57 [Effective until 7/1/04]
A physician who has examined a person in an emergency room or provided emergency medical services at a general hospital …. shall be authorized to request that the director of the hospital, or his designee, direct the removal of any person, within his jurisdiction, to a hospital if the physician determines upon examination of such person that such person appears to have a mental illness for which immediate care and treatment in a hospital is appropriate and which is likely result in serious harm to himself or others, as defined in section 9.39 of this article…… Upon the request of the physician, the director of the hospital or his designee is authorized to direct peace officers, ….or police officers….to take into custody and transport any such person. Upon the request of an emergency room physician or the director of the hospital……an ambulance service…is authorized to transport any such person. Such person may then be retained in a hospital pursuant…to section 9.39 or 9.40 of this article.
MHL §9.57 [Effective 7/1/04]
A physician who has examined a person in an emergency room or provided emergency medical services at a general hospital …. shall be authorized to request that the director of the hospital, or his designee, direct the removal of any person, within his jurisdiction, to a hospital if the physician determines upon examination of such person that such person appears to have a mental illness for which immediate care and treatment in a hospital is appropriate and which is likely result in serious harm to himself or others, as defined in section 9.39 of this article…… Upon the request of the physician, the director of the hospital or his designee is authorized to direct peace officers, ….or police officers….to take into custody and transport any such person. Upon the request of an emergency room physician or the director of the hospital……an ambulance service…is authorized to transport any such person. Such person may then be retained in a hospital pursuant…to section 9.39 of this article. |
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02
§164.512(j): A covered entity may, consistent with applicable law and standards of ethical conduct, use/disclose PHI if it believes, in good faith, that the use/disclosure (i)(A) is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (B) is to a person(s) reasonably able to prevent/lessen the threat. |
No preemption: State law applies; the use/disclosure by health professionals pursuant to this section of law are authorized to lessen or prevent a serious threat to the health/safety of the person with mental illness, due to the "likelihood of serious harm to him/herself or others" criterion within the State statute. Hence, State law applies.
In some cases, communication with the individual may be substantially impaired, or there may be emergency medical circumstances, which, under the original HIPAA final rules, would permit use/disclosure of PHI for treatment purposes without patient consent/authorization, if an attempt to obtain such consent was made. This would have required a change in current practice. The 8/02 amendments, however, remove the requirement to obtain patient consent to use/disclose PHI for treatment, payment, or health care operations purposes, so this is no longer a concern, and the use/disclosure is permitted without patient consent for treatment purposes. |
| Transport for evaluation; powers of approved mobile crisis outreach teams
MHL §9.58
(a) A physician or qualified mental health professional who is a member of an approved mobile crisis outreach team shall have the power to remove, or pursuant to subdivision (b) of this section, to direct the removal of any person to a hospital…..pursuant to subdivision (a) of section 9.39 or section 31.27 of this chapter for purpose of evaluation for admission if such person appears to be mentally ill and is conducting him/herself in a manner which is likely to result in serious harm to the person or others.
(b) If the team physician or qualified mental health professional determines that it is necessary to effectuate transport, he or shall shall direct peace officers, ….or police officers….to take into custody and transport any such person. Upon the request of such physician or qualified mental health professional……an ambulance service…is authorized to transport any such person. Such person may then be evaluated for admission in accordance with the provisions of section 9.27, 9.39, 9.40, or other sections of this article…. |
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.512(j): A covered entity may, consistent with applicable law and standards of ethical conduct, use/disclose PHI if it believes, in good faith, that the use/disclosure (i)(A) is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (B) is to a person(s) reasonably able to prevent/lessen the threat. |
No preemption: State law applies; the use/disclosure by health professionals pursuant to this section of law are authorized to lessen or prevent a serious threat to the health/safety of the person with mental illness, due to the "likely to result in serious harm to the person or others" criterion within the State statute. Hence, State law applies |
| "Kendra's Law" - Assisted Outpatient Treatment
MHL §9.60
(a)(1): "assisted outpatient treatment" (AOT) means categories of outpatient services which have been ordered by the court pursuant to this section. Such treatment shall include case management services or assertive community treatment team services to provide care coordination, and may also include any of the following categories of services: medication, periodic blood tests or urinalysis to determine compliance with prescribed medications; individual/ group therapy; day/partial day programming activities; educational/ vocational training/ activities; chemical dependence treatment/counseling and periodic tests for the presence of alcohol/ illegal drugs for persons with a history of chemical dependence; supervision of living arrangements; and any other services within a local/unified services plan developed pursuant to article 41…, prescribed to treat the person's mental illness and to assist the person in living and functioning in the community, or to attempt to prevent a relapse or deterioration that may reasonably be predicted to result in suicide or the need for hospitalization.
(c) Criteria for AOT. A patient may be ordered to obtain AOT if a court finds that: (1) the patient is 18 years of age or older; (2) the patient is suffering from a mental illness; and (3) the patient is unlikely to survive safely in the community without supervision, based on a clinical determination; and (4) the patient has a history of lack of compliance with treatment for mental illness that has: (i) at least twice within the last 36 months been a significant factor in necessitating hospitalization in a hospital, or receipt of services in a forensic or other mental health unit of a correctional facility….not including any period during which the person was hospitalized or incarcerated immediately preceding the filing of the petition; (5) the patient is, as a result of his/her mental illness, unlikely to voluntarily participate in the recommended treatment pursuant to the treatment plan; and (6) in view of the patient's treatment history and current behavior, he/she is in need of AOT in order to prevent a relapse or deterioration which would be likely to result in serious harm to the patient or others…and (7) it is likely that the patient will benefit from AOT; and
(8) if the patient has executed a health care proxy, the terms of the proxy will be taken into consideration by the court in determining the written treatment plan.
(e) Petition to the court. (1) A petition for an order authorizing AOT may be filed in the supreme court or county court…..A petition… may only be authorized by the following persons: (i) any person over age 18 with whom the subject of the petition resides; (ii) the parent, spouse, sibling or child of the patient 18 years of age or older; (iii) the director of a hospital in which the subject is hospitalized; (iv) the director of any public or charitable organization, agency, or home providing mental health services to the subject…; (v) a qualified psychiatrist who is either treating the subject; (vi) the director of community services/designee…; (vii) a parole/probation officer assigned to supervise the subject. (2) The petition shall state: (i) each of the criteria for AOT; (ii) facts which support the belief that the criteria have been met; (iii) the subject is reasonably believed to be present in the county where the petition is filed. (3) The petition shall be accompanied by an affidavit/affirmation of a physician that states either the patient has been examined by him/her and AOT is recommended; or the subject refuses to submit to the examination.
(f) Service. The petitioner shall cause written notice of the petition to the subject and also to the mental hygiene legal service, health agent (if known), the appropriate program coordinator and the director of community services…
(h)Hearing.(1)….the court shall hear testimony and, if advisable, examine the subject in or out of court. (2) The court shall not order AOT unless an examining physician testifies in person at the hearing…(4) a physician who testifies….shall state the facts which support the allegation that the person requires AOT….
(i). Written treatment plan. (1) The court shall nor order AOT unless an examining physician provides to the court a written treatment plan…In developing such plan, the physician shall provide the subject, the treating physician, and an individual designated by the patient, at the patient's request, to participate in developing the plan. (2) The court shall not order AOT unless a physician testifies to explain the written treatment plan.
(j) Disposition. (1) …if the court finds by clear and convincing evidence the subject meets the criteria for AOT…..the court is authorized to order the subject to receive AOT…..the order shall state the categories of AOT and may also order treatment included in the written treatment plan…..(5) If the petitioner is the director of a hospital, the court order shall direct the hospital to provide/arrange for all categories of AOT. For all other persons, the order shall require the director of community services….to provide/arrange for all categories of AOT.
(n) Failure to comply with AOT. Where in the clinical judgment of a physician, the patient has failed to comply with the court ordered AOT…..and in the physician's clinical judgment the person may be in need of involuntary commitment….such physician may request …..to direct the removal of such person to an appropriate hospital to determine if such person is in need of involuntary commitment……if such person refuses to take medications as required by the court order…. or fails to take court ordered tests….such physician may take such information into consideration when determining if the involuntary commitment examination is necessary. Peace/police officers may be directed to take into custody/transport such person to a hospital for such examination. |
§164.501: Required by law: a mandate contained in law that compels a covered entity to make a use/disclosure of PHI and that is enforceable in a court of law; includes, but is not limited to, court orders and court ordered warrants, subpoenas or summons issued by a court, grand jury, a gov'tal…inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation…; and statutes/ regulations that require the production of information, including statutes/ regulations that require such information if payment is sought under a government program providing public benefits.
§164.506(a)(3)(i)(A),(B),(C) : In emergency treatment situations, if the covered health care provider is required by law to treat the individual, or if a covered health care provider is unable to obtain consent due to substantial barriers to communication and the covered health provider determines, in its professional judgment, that the patient's consent is inferred by the circumstances, and the covered health care provider attempts to obtain such consent but is unable to obtain such consent, a covered health care provider may use/disclose PHI to carry out treatment, payment, or health care operations without patient consent.
§164.506(c):(1) A covered entity may use/disclose PHI for its own treatment, payment, or health care operations. (2) A covered entity may disclose PHI for treatment activities of a health care provider. (3) A covered entity may disclose PHI to another covered entity or health care provider for the payment activities of the entity that receives the information…. revised 8/02
§164.512(a): A covered entity may use/ disclose PHI to the extent that such use/ disclosure is required by law and the use/ disclosure complies with and is limited to the relevant requirements of such law.
§164.512(e): PHI can be released w/out patient consent in the course of any judicial or administrative proceeding(1)in response to an order of a court or administrative tribunal, provided release is limited to that PHI expressly to a subpoena, discovery request, or other lawful process if the covered entity has made reasonable efforts to give the patient notice of the request or the covered entity is assured that reasonable efforts have been made to secure a qualified protective order.
§164.512(j):A covered entity may use/disclose PHI (consistent with law & professional conduct) if it believes in good faith that the disclosure is necessary to prevent or lessen a serious & imminent threat to the health or safety of a person (per preamble, consistent with Tarasoff) or the public and is being made to a person or persons reasonably able to prevent or lessen the threat or is necessary for law enforcement authorities to identify/apprehend an individual. If disclosure is to be made to one other than the target, the information cannot have been obtained in the course of treatment to affect the propensity to commit the criminal conduct or through a request by the person to initiate or be referred to treatment. |
No preemption: State law applies to all of the uses/disclosures of PHI provided for in this statute:
1. Because the uses/disclosures required to develop a petition for AOT are necessary in order to become the foundation for a court order (or dismissal of the petition),such uses/disclosures without patient consent or authorization are permitted by HIPAA under the "required by law" and "in the course of a judicial proceeding" exceptions to consent/authorization.
2. Uses/disclosures by physicians in the course of providing required testimony are authorized by "in the course of a judicial proceeding" exception to consent/authorization. The requirements set forth to notify and involve the subject of the petition in the hearing are consistent with the requirements set forth in §164.512(e)(1)(ii) which mandate satisfactory assurances of the individual's notification of the request for the use/disclosure of his/her PHIin the course of the judicial proceeding.
3. Under the original final HIPAA rule, uses/disclosures back to the court or between and among providers of court ordered services are permitted without patient consent/authorization under the "treament required by law," and "use/disclosure of PHI required by law" exceptions to HIPAA; furthermore, the recent amendments to HIPAA eliminate the need to attempt to obtain consent, since patient consent is not be required to use/disclose PHI for treatment purposes.
4. Because of the essential criteria required to initiate and sustain an AOT petition, uses/disclosures by health professionals pursuant to this section of law are authorized to lessen or prevent a serious threat to the health/safety of the person with mental illness, due to the "likely to result in serious harm to the person or others" criterion within the State statute. Hence, State law applies |
