I. PURPOSE: To ensure the agency and CCSS staff members are committed to protecting the confidentiality of information about its consumers, and to assume a protective role regarding the disclosure of confidential information.  The expectations for following this identified policy are specified in the procedures mentioned below.

II. POLICY: It is the policy of the agency to provide CCSS staff members with procedures for ensuring the confidentiality and privacy of all consumers, and disclosure of confidential information.

III. SCOPE: This policy applies to all CCSS employees/contractors.

IV. PROCEDURES:   

             Confidentiality & Privacy Protections:

1. CCSS ensures consumers’ confidentiality by having policies, procedures, and practices addressing all applicable confidentiality laws and regulations including but not limited to

1. Laws and regulations governing information about mental health consumers’.

• Victims of domestic violence.

• Drug and alcohol treatment; and/or

• HIV/Aids.

• CCSS informs consumers’ and/or their Legal guardian/Health care Power of Attorney (if applicable) of the disclosure of private information, and about circumstances in which the agency may be legally or ethically required to release such information with or without consent.  The information includes confidentiality protection laws and regulations governing information about mental health consumers, victims of domestic violence, drug and alcohol treatment, and HIV/Aids.  This is accomplished by:

1. Reviewing and explaining Consumer Rights and Confidentiality when the consumer first seeks services and/or at intake.

• Reviewing with the consumer the Notice of Privacy Practices and completing the Acknowledgement of Receipt of Notice of Privacy Practices; and

• Completing and explaining the Consent to Treatment form.

• The items listed above are completed with the consumer and/or their Legal guardian/Health care Power of Attorney (if applicable) and Intake Team Member prior to or during the intake meeting.  In addition, the Notice of Privacy Practices handouts are available to all consumers’, and/or their Legal guardian/Health care Power of Attorney (if applicable).

•  A facility director may disclose confidential information if in the best interest of the individual, in order to file a petition for competency/guardianship purposes.

• .When the agency receives a request to release confidential information  related to a CCSS consumer, or when the release of confidential information is necessary for the provision of services, prior to releasing such information, CCSS will:

1. Determine if the request is valid; and

• Obtain the consumers’, and/or their Legal guardian/Health care Power of Attorney (if applicable) informed written authorization to release the information on the CCSS Release of information form.

• Consultation with Legal Counsel:

The Chief Executive Officer (CEO) consult with appropriate Legal counsel regarding the confidentiality of information contained in the consumers’ Cumulative Medical Record, and the conditions under which they may be subpoenaed.  Legal counsel for the Chief Executive Officer (CEO) may seek additional Legal counsel with expertise in this area, as necessary.

• Release of Confidential Information with Consumer Consent:

In order to release confidential consumer information, the CCSS Release of Information Form must be completed in full and must include the following elements:

1. Consumers’ name.

• Consumers’ date of birth.

• Consumers’ Medical Record.

• Name of Program releasing information.

• Name of the individuals/Program receiving the confidential information (Blanket releases are not acceptable);

• Specific information to be released;

• Purpose for which the information is to be used, except where disclosure is mandated by law, or the consumer is receiving services under court supervision or directive;

• The date the authorization is signed, and therefore takes effect;

• The date the authorization to release Protected Health Information (herein thereafter referred to as PHI for the purposes of this policy only) expires (not to exceed 90 days if it is a onetime release of PHI, and not to exceed 1 year if it is related to ongoing service provision);

1. A statement that the consent is subject to revocation at any time except to the extent that action has already be taken in reliance on the consent;

1. Signature of the consumer and/or their Legal guardian/Health care Power of Attorney (if applicable) to provide informed authorization to release the identified information;

1. Signature of CCSS staff member witnessing the signing of the consent by the consumer, and/or their Legal guardian/Health care Power of Attorney (if applicable); and

1. A statement that the consumer, and/or their Legal guardian/Health care Power of Attorney (if applicable) may withdraw the consent at any time.

• Unless revoked sooner by the CCSS consumer, and/or their Legal guardian/Health care Power of Attorney (if applicable), or dated an earlier date by agreement with the CCSS staff member, the consent is valid for a period not to exceed one year, except under the following conditions:

1. Consent to continue financial benefits is considered valid until benefits are terminated; and

• Consent for release of information to the North Carolina Division of Mental Health, Developmental Disabilities and Substance Abuse Services (NCDMHHS), North Carolina Division of Motor Vehicles, the Court(s), or the North Carolina Department of Corrections is valid during a consumers’ course of treatment needed to reinstate a consumers’ driving privilege until such driving privilege is reinstated.

1. The following individuals may sign the CCSS Release of Information form:

1. A competent adult consumer;

• The consumers’ Legal guardian/ Health care Power of Attorney if the consumer is a minor or adult deemed incompetent to sign said release;

• A minor under the following conditions:  

• When seeking services for venereal disease or other diseases reportable  under applicable State regulations, pregnancy, abuse of controlled substances or alcohol or emotional disturbance;

• When married or divorced;

• When emancipated by a decree issued by a court of competent jurisdiction;

• When a member of the armed forces; or

• When consenting for release of information to the consumers’ own attorney; and

• The personal representative of a deceased consumer if the consumers’ estate is being settled, or the next of kin of a deceased consumer if the consumers’ estate is not being settled.

• Prior to obtaining a CCSS Release of Information Form, the CCSS staff member will inform the consumer and/or their Legal guardian/Health care Power of Attorney (if applicable) that the provision of, or continuation of services, is not contingent upon providing consent for release of information requested.  The consent of the consumer and/or their Legal guardian/Health care Power of Attorney (if applicable), must, in all cases is given voluntarily.  
  • Professionals may disclose Advance Directives for mental health treatment or confidential information from an Advance Directives to a physician, psychologist, or other QP when it is determined that disclosure is necessary to give effect to or provide treatment in accordance with the Advance Directives.
  • Upon obtaining a signed CCSS Release of Information Form, all CCSS staff members have delegated authority to release confidential information with the consumers’, and/or their Legal guardian/Health care Power of Attorney (if applicable) consent in accordance with this policy.  This delegation is in writing, and maintained in the consumers’ Cumulative Medical Record.  When confidential information is released with this consent, the CCSS staff member with delegated authority to release confidential information ensures that;

1. A copy of the CCSS Release of Information Form is provided;

• The documentation of the CCSS Release of Information Form is placed in the consumers’ Cumulative Medical Record;

• A corresponding fax cover sheet indicates the information being released is confidential material; and

• A notification is included to the recipient of the information that re-disclosure of the information, without a new consumer authorization for release (and all applicable signatures), is prohibited.

• A consent for release of confidential information received from an individual or agency not covered by, or subject to the State administrative rules on confidentiality does not have to be on a form utilized by State agencies or facilities so long as the content of the PHI form conforms to the requirements set forth in the applicable rules.

• A clear and legible photocopy of the authorization will be considered as valid as the original authorization.

• Whenever the validity of an authorization is in question, the CCSS staff member will contact the consumer, and/or their Legal guardian/Health care Power of Attorney (if applicable) to confirm the authorization is valid.  This determination of the validity of the authorization is documented in the consumers’ Cumulative Medical Record.  If there is still question(s) regarding the validity or appropriateness of releasing the requested PHI, the CCSS staff member will consult with the Program Manager(s) or the Compliance Officer(s).  If there is still question(s) over the validity of the information to be released, the CCSS staff member will consult with the Chief Executive Officer (CEO) who will consult with appropriate Legal Counsel regarding the matter.
  • Release of Information without Consumer Consent:

Information may be requested that does not require a CCSS consumer, and/or their Legal guardian/Health care Power of Attorney (if applicable) permission to release such information.  The circumstance(s) in which this may occur includes but is not limited to:

1. When providing required information to the regulatory agencies that have statutory authority granted by the State in which the program is operating for the purposes of tracking of consumer services and billing purposes as well as reviewing consumers’ Cumulative Medical Records as part of an audit of CCSS operations;

• Agents of CCSS conduct internal quality assurance audits and reviews;

• Department of Social Services (and Guardian Ad Litem when involved) in the case of suspected abuse or neglect of a minor child, an elderly adult, or a disabled adult;

• Attorneys or the court after the issuance of a subpoena and court order ordering the agency to release the requested information; and/or

• When in the opinion of the CCSS staff member and in conjunction with the Chief Executive Officer (CEO) and Clinical Director or Program manager, or another responsible professional (e.g. emergency room physician), determine there is imminent danger to the safety of the consumers or other individuals due to the consumers’ behaviors/threats, or there is a likelihood of the commission of a felony or violent misdemeanor.
• When the CEO or a member of the CCSS Executive Committee determines that it is in the best interest of the consumer, in order to file a petition for competency/guardianship purposes.
• Professionals at CCSS may exchange confidential information with a physician or other health care provider who is providing emergency medical services to a CCSS consumer. Disclosure of the information is limited to that necessary to meet the emergency as determined by CCSS professional.
• CCSS may provide confidential information to the Department of Corrections (DOC) when requested, regarding a CCSS consumer who is incarcerated, when the inmate has been determined by the DOC to be in need of treatment for MH/DD/SA concerns. The consent of this consumer or inmate shall not be required in order for this information to be provided and the information shall be provided despite objection by the consumer or inmate. Confidential information provided is prohibited from further disclosure.
• The Physician or other staff member of CCSS responsible for the evaluation, management, supervision, or treatment of individuals examined or committed for outpatient therapy may request, receive, and disclose confidential information to the extent necessary to enable them to fulfill their responsibilities.
• CCSS may disclose confidential information to a provider of support services under written agreement in which the provider acknowledges that he/she will safeguard and not further disclose the information.
• Disclosure of financial information is permitted when there is reason to believe that a CCSS consumer is eligible for financial benefits through a facility in order to establish financial benefits. After receiving benefits, the consent of the consumer or legally responsible person is required for further release of confidential information.
•  Employees, students, consultants or volunteers at CCSS involved in the care of a consumer, may exchange confidential information as needed for the purpose of carrying out their responsibility in serving the consumer.
• Professional staff at CCSS may release confidential information to the referring physician or psychologist.
• Professional staff at CCSS shall provide the next of kin/family member/designee with notification of the consumer’s diagnosis, the prognosis, the medications prescribed (dosage and side effects) and the progress of the consumer, provided that the consumer or his/her legally responsible person has consented in writing or orally in the presence of a witness selected by the consumer, prior to the release of this information. Both the consumer’s and legally responsible person’s consent and the release of information shall be documented in the consumer’s service record. This consent shall be time limited and is subject to revocation by the consenting individual.
• CCSS may disclose admission/discharge of a consumer to the consumer’s next of kin when determined that the disclosure is in the best interest of the consumer. The professional staff at CCSS shall notify next of kin/ family member/designee after the request of the consumer, notification of admission to a facility, transfer to another facility, decision to leave the facility against medical advice, discharge, and referrals/appointments.
• In response to a written request of the next of kin/family member/designee who has a legitimate role in the therapeutic services offered, the provider at CCSS shall: (1)  Provide the information requested based upon determination that providing this information will be to the consumer’s  therapeutic benefit, and provided that the consumer or his or her legally responsible party has consented in writing to the release of the information requested; or (2)  Refuse to provide the information requested based upon the responsible professional’s determination that providing this information will be detrimental to the therapeutic relationship between the consumer and professional; or (3)  Refuse to provide the information requested based upon the responsible professional’s determination that the next of kin/family member/designee does not have a legitimate need for the information requested.
• CCSS may disclose confidential information to persons responsible for conducting general research or clinical, financial, or administrative audits if there is a justifiable documented need for this information.  A person receiving the information may not directly or indirectly identify any consumer in any report of the research or audit or otherwise disclose a consumer’s identity in any way.
•  CCSS may contact and consult with a consumer advocate.
• CCSS shall disclose confidential information of a consumer to an attorney upon the request of the competent adult or the legally responsible person.
• CCSS may share confidential information regarding a consumer with the assigned MCO regarding treatment, payment, and healthcare operations when necessary.
• CCSS may share confidential information regarding a consumer with the assigned MCO regarding treatment, payment, and healthcare operations lodged by consumers receiving services, evaluating practitioner and provider performance, auditing functions, on-site monitoring, conducting satisfaction studies, and collecting and analyzing performance data.

• Imminent danger is considered to be any situation where the CCSS consumer is exhibiting dangerous behaviors or threats of direct harm to themselves or others, and has the means of implementing such threats readily available for his/her use.  In this event, the agency is required to act to protect the CCSS consumer from self-harm and/or to protect others being threatened by the consumer.  This protection includes but is not limited to:

1. Notification of law enforcement personnel;

• Notification of family and support systems;

• Notification of the individual(s) being threatened; and/or

• Initiation of involuntary commitment proceedings per State regulations.

• The follow CCSS staff members are authorized to release confidential consumer information without the consumers’ consent in the situations and circumstances listed above:

1. CCSS staff members after consultation with their immediate supervisor, Program Manager(s), and Chief Executive Officer (CEO);

• Chief Executive Officer (CEO);

• Director of Operations and/or

• Compliance Officer(s).

• Whenever confidential information is released without consent in the circumstances listed above (in sections A &B of Release of Information without Consumers’ Consent) the release of the identified information is to be documented in the consumers’ Cumulative Medical Record.  This documentation must include:

1. Name of the recipient of the information;

• Extent of the information disclosed;

• Specific reasons for the disclosure;

• Date of the disclosure; and

• Full and legible signature of the CCSS staff member disclosing the information as well as their title.
  • The CCSS consumer, and/or their Legal guardian/Health care Power of Attorney (if applicable) is to be notified of the release of information, and to whom the information was released.

• Confidential consumer information may be released to the Compliance Committee members under the following circumstances:

1. When such members are engaged in fulfilling their functions as set forth in applicable State regulations; and

• When involved or being consulted in connection with the training or treatment of a consumer.

• The CCSS CEO or their designee may have access to confidential information only with written consent of the consumer, and/or their Legal guardian/Health care Power of Attorney (if applicable) or pursuant to other exceptions to confidentiality specified in applicable State regulations.  However they may only have access non-identifying information.
  • A facility may provide confidential information to the Department of Correction (DOC) when requested regarding any individual of that facility when the inmate has been determined by the DOC to be in need of treatment for MH/DD/SA concerns.  The consent of the individual or inmate shall not be required in order for this information to be provided and the information shall be provided despite objection by the individual or inmate. Confidential information disclosed is restricted from further disclosure.

• Education on Confidentiality and Privacy Protection:

All CCSS staff members are responsible for the protection of CCSS consumer confidentiality and privacy.  Training is provided upon hire and assures the following:

1. All new CCSS staff members, external contractors, etc. sign and Assurance of Confidentiality Form prior to providing services to consumers.  The expectations contained in this form are explained to the individual prior to signature.  The signed and dated Agreement is then maintained in the staff members Human Resources File; and

• The Program Manager(s)/Compliance Officer(s)/Human Resources Manager/Chief Executive Officer (CEO) is responsible for insuring CCSS staff members, external contractors, etc. are informed of possible penalties for violating confidentiality laws, administrative rules and CCSS policies.  Penalties may include dismissal. Suspension, or other internal disciplinary action as well as possible prosecution under State and Federal law.

• All confidential information relative to CCSS staff member personnel files and CCSS consumer files are kept in the CCSS administrative office and will be secured in a fire resistant file cabinet.  In additional all confidential records will be double locked unless monitored by appropriate CCSS personnel.