If staff believe it is necessary to disclose PHI for a non-treatment-related purpose for a family member or a child not in our custody, an Authorization for Disclosure of Health Information by DSS is required. All such authorizations obtained from the client must be filed in the client’s case file. Two examples are as follows:
- Staff have information regarding a father’s psychiatric diagnosis of Obsessive-Compulsive Disorder (OCD). The client has severe financial, utility and rent problems. Staff calls a private charitable organization and advises the organization of the client’s financial problems to include the immediate need for funds to cover the cost of psychotropic medication to treat his OCD diagnosis. Disclosure of the identifiable medical information (OCD diagnosis and prescription medication information) to the organization violates HIPAA unless the client completed the Authorization for Disclosure of Health Information by DSS. In this example, staff should have obtained the client’s authorization or withheld the PHI.
- The Children’s Service Worker has been providing Family Centered Services to a family. The mother in the family has been diagnosed with depression and is under treatment with a psychiatrist and individual therapist. One of the mother’s children, an 8-year old boy, has been tardy 10 times and absent 11 days in the past quarter. The worker has been invited to participate in Crisis Team meeting at the boy’s school. During the course of the meeting the team explores possible reasons behind the boy’s school attendance difficulties. Although the worker is aware that the mother’s depression is interfering with her ability to get the boy up and ready to catch the school bus, the worker refrains from sharing information regarding the mother’s diagnosis and treatment. Disclosure of the medical information (diagnosis of depression and treatment/therapy) violates HIPAA unless the client completed the Authorization for Disclosure of Health Information by DSS. NOTE: The Authorization for Disclosure of Health Information by DSS is not necessary when: (1) Protected Health Information is shared with juvenile courts, law enforcement and prosecutors per current policy and procedures, which are based on existing law; (2) for children who are in CD custody; (3) when Protected Health Information is shared for treatment, payment or health care operations; or (4) shared with other divisions of the Department of Social Services, as all of DSS is considered a “single covered entity”.
If it is necessary to disclose PHI in order to protect either the individual or the health and safety of others, CD staff must document to whom information is given, the reason the information was given, and the contact /clearance with supervisory staff using the PHI Disclosure Tracking Log, MO 886-4452.