.

.

Michigan: Bills paid with Ryan White CARE Act funds disclose the patient's HIV status.

Question: Our HIV clinic provides care to patients using Ryan White CARE Act funds, and that sometimes involves referring the patients to other health care providers. How do we make sure that our clients understand and agree that in order to get their care subsidized, people in our billing, scheduling and other administrative departments as well as the staff of the providers that we send them to will know their status by the fact that their care is being covered under Ryan White?

Response: HIPAA, the Health Insurance Portability and Accountability Act, is a new federal law makes it clear that a health care provider (HCP) can use or disclose "protected health information" in the process of getting paid - that is, for accounting, billing and reimbursement processes. In this way, HIPAA creates an exception to the confidentiality protections for health and medical information so that HCPs can get paid by insurance companies and other payers. This makes sense - without this exception, the entire health care system would grind to a halt.

HIPAA also makes clear, tho, that if a state law is more strict about health information than HIPAA is, then the state law continues to govern what an HCP can do with it. Here in Michigan, the HIV confidentiality law and the Mental Health Code are both more strict than HIPAA. This means that tho HIPAA creates this payment exception (it is okay for your doctor to reveal your diagnosis to your insurance company so that she can get paid) there is no such exception for HIV-related information.

That means that if a private doctor runs an HIV test while doing my annual physical, she actually has to get my specific permission to bill my health insurance company for the HIV test. Does she know that? Hmm. Doubt it. That's why the Patient's Privacy Notice to Physicians seems like such a good idea. (see link at left)

In the same way, a clinic within a health care system that provides HIV-specific care, or coordinates care for its patients with other clinics within the health system, absolutely does need specific permission to disclose to those clinics (and to their own accountants and billing department) that the patient is HIV-positive. And if the clinic in question ONLY provides care to people who are HIV-positive, then stating that the person is a patient of the HIV clinic ACTUALLY IS a disclosure of HIV status. Such an act, no matter how harmlessly intended, requires specific permission under Michigan's HIV confidentiality law, MCL 333.5131.

This should be easy enough to remedy, since I can't imagine that anyone believes for a second that a clinic or doctor will treat them without attempting to get paid for it. Whether a patient will realize that they are "outed" every time the HIV clinic refers them to another clinic or doctor is less clear.

So written permission is a good idea: to protect the clinic from liability and to protect the patient from misunderstanding or not recognizing the risk of disclosure. That written permission should be requested at the very moment of intake into the HIV clinic's practice. Since every treatment thereafter needs to be paid for, this makes sense. Just include in the intake paperwork a separate specific Authorization that says something really clever like this:

"I understand that being a patient of this clinic discloses protected health information about me and discloses that I am a person living with HIV. I understand that such information is disclosed when this clinic refers me to another health care provider, or when this clinic submits claims for payment for my care. I authorize this clinic to disclose the minimum amount of protected health information necessary for the purposes of seeking payment or reimbursement for my care, or referring me to another health care provider in or out of this health system. This authorization expires at the close of my case with this clinic, or when I revoke this authorization in writing."

That's it, really. Plain English, and simple: the idea is just to make clear to the patient that their status will be revealed by the simple fact that they are a patient of the HIV clinic. Or, as in the original question, by the simple fact that their care is reimbursed with Ryan White funds. And the reason that it is important to do this is because it is respectful. Whether it is strictly required under the law, which it is in Michigan, or whether not doing it could result in the clinic losing a lawsuit, which it might not, is not important. It is respectful and caring, and The Right Thing To Do.

Also note that the authorization can be good for more than a year: Michigan law does not specify a time limit, so in this regard HIPAA controls and HIPAA allows for an Authorization to run until either some amount of time passes or some event happens.

 Answered by Kendra S. Kleber JD

back to Ten Minute Trainings

Explaining HIV/AIDS-related legal rights and responsibilities in support of the self-sufficiency, independence and quality of life of people living with HIV/AIDS.

NOTE: The information on this site and in this message is not legal advice, and does not create or imply an attorney-client relationship or an offer to form such a relationship. It is just an opinion. Follow it, ignore it - your choice. But it is not legal advice upon which you can or should rely without consulting an attorney to advise you on your particular situation based on your particular facts and circumstances.