HIPAA & Protected Health Information (PHI)
What does HIPAA stand for?
Health Insurance Portability and Accountability Act.
What is COPE’s policy on releasing client information?
Client information is confidential and can only be released with written authorization or when legally required.
What does VAWA stand for?
Violence Against Women Act.
What should COPE staff do if served a subpoena for a client’s records?
Do not accept the subpoena—direct it to the Executive Director and seek legal guidance.
A COPE staff member receives a call from a hospital asking if a patient is at the shelter.
We can neither confirm nor deny the presence of any individual at this facility." (This applies to both staff and mental health professionals.)
What type of information is protected under HIPAA?
Protected Health Information (PHI), which includes names, medical records, addresses, and billing information.
Can COPE staff confirm whether a client is staying at the shelter?
No, staff must respond with: "We can neither confirm nor deny the presence of any individual at this facility."
What key confidentiality protection does VAWA provide?
VAWA mandates that victim-identifying information cannot be disclosed without written, informed, and time-limited consent.
Under COPE policy, who has the authority to handle legal document requests?
The Executive Director or a designated representative.
A mental health professional at COPE learns a client is suicidal. What must they do?
They must follow duty to warn and protect laws, meaning they may breach confidentiality if the client is at immediate risk. (COPE staff must escalate this to the Executive Director or emergency services.)
Who must comply with HIPAA regulations?
Healthcare providers, insurers, business associates, and any entities handling medical data.
What are the four primary reasons COPE may breach confidentiality?
Duty to warn (harm to self/others), child/elder abuse reporting, legal court orders, and health emergencies.
Can a victim be required to sign a release to receive services under VAWA?
No, victims cannot be required to sign a release as a condition of service.
What should COPE staff do if law enforcement arrives with an arrest warrant?
Contact the Executive Director immediately. Do not confirm or deny the client's presence.
A staff member overhears a conversation where a client discloses past child abuse. What should they do?
Report the information to the proper authorities under mandatory reporting laws. (Both staff and mental health professionals must report suspected child or elder abuse.)
What is the main purpose of the HIPAA Privacy Rule?
To protect individuals' medical records and limit access to health information without proper authorization.
How should COPE staff handle visitor inquiries about clients?
eny disclosing any client information and follow the confidentiality protocol.
What three exceptions allow a grantee to disclose personally identifiable information (PII) under VAWA?
Written victim consent, a statutory mandate, or a court order.
Can COPE release client information to auditors or funders?
Only if they sign a confidentiality agreement and no client-identifying information is disclosed.
A mental health professional is subpoenaed for therapy notes. Can they release them?
They must consult legal counsel and only release records if legally compelled and with client consent when possible. (COPE staff must direct all subpoenas to the Executive Director.)
Under what circumstances can PHI be disclosed without consent?
Mandatory reporting (child/elder abuse), legal subpoenas, law enforcement investigations, and medical emergencies.
What steps should staff take if a visitor refuses to leave after being denied client information?
Contact the Executive Director or law enforcement if necessary, and document the incident.
How should a COPE staff member respond if law enforcement asks for client information in a missing persons case?
Staff should say, "COPE can neither confirm nor deny the presence of any individual at this facility."
What is the difference between a subpoena and a court order in terms of COPE’s legal obligations?
A subpoena requests information, but a court order mandates compliance. COPE must seek legal review before responding to either.
A COPE staff member wants to discuss a client’s case with a mental health professional for better care coordination. What must be done first?
They must obtain client consent before sharing any protected information, as mental health professionals follow strict confidentiality under HIPAA.