TITLE:

USES AND DISCLOSURES OF HIV/AIDS INFORMATION

POLICY:
Columbia University Medical Center will use and disclose HIV/AIDS information in accordance with its extremely confidential nature as required by city, state, and federal laws and regulations, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

PURPOSE :
HIV/AIDS information is Protected Health Information (PHI) and, as such, is protected by city, state, and federal laws and regulations. However, because of its extremely sensitive nature, if HIV/AIDS information is improperly used or released, the patient's privacy, healthcare, or other interests may be irreparably damaged. This Policy describes how, when, and by and to whom HIV/AIDS information at Columbia University Medical Center will be used and disclosed.

PROCEDURES:

1. Definitions.



1. "AIDS" means Acquired Immune Deficiency Syndrome.



2. "HIV" means Human Immunodeficiency Virus, or any other related virus identified as a probable causative agent of AIDS.



3. "HIV-related test" means a any laboratory test or series of tests for any virus, antibody, antigen, or etiologic agent whatsoever thought to cause or to indicate the presence of AIDS.



4. "Protected Health Information" or "PHI" is information about a patient, including demographic information that may identify a patient, that relates to the patient's past, present or future physical or mental health or condition, related health care services or payment for health care services.



5. "Capacity to consent" means the individual's ability, determined without regard to the individual's chronological age to understand and appreciate:
1. the nature and consequences of a proposed health care service, treatment, or procedure; or



2. a proposed disclosure of confidential HIV-related information; and



3. to make an informed decision concerning the service, treatment, procedure, or disclosure.


6. "Contact" means:
1. an identified spouse or sex partner of the HIV/AIDS patient;



2. a person identified as having shared hypodermic needles or syringes with the HIV/AIDS patient; or



3. a person who the HIV/AIDS patient may have exposed to HIV under circumstances that present a risk of transmission of HIV.



2. Conducting HIV/AIDS tests. Prior to conducting any HIV-related test of an individual patient, the patient's health care provider will obtain a written, informed consent from the patient provided the patient has the capacity to consent.
1. If the individual patient does not have the capacity to consent, the patient's health care provider will obtain a written informed consent from the person legally authorized to consent to health care for the patient prior to performing the HIV-related test.



2. Within the order for an HIV-related test, the health care provider will certify that the patient's written informed consent for the test has been received.



3. The informed consent for an HIV-related test will include at least the following elements:
1. an explanation of the test, including its purpose, the meaning of its results, and the benefits of early diagnosis and medical intervention;



2. an explanation of the procedures to be followed, including that the test is voluntary, that consent may be withdrawn at any time, and a statement advising the patient that anonymous testing is available; and



3. an explanation of the confidentiality protections afforded confidential HIV-related information including the circumstances under which and classes of persons to whom disclosure of such information may be required, authorized, or permitted by law.



4. A prior written informed consent need not be obtained if the HIV-related test will be performed:
1. by a health care provider or facility in relation to procuring, processing, distributing, or using a human body or body part for medical research or therapy;



2. for the purposes of research provided the test is performed in a manner by which the identity of the test patient is not known and may not be retrieved by the researcher; or



3. on a deceased person when the test is performed to determine the cause of death or for epidemiological purposes.


3. Limited use of HIV/AIDS information. A patient's HIV/AIDS information may be used only:
1. for assessing or managing the patient's health;



2. for purposes of providing treatment to, including counseling, or receiving payment for such treatment of the patient;



3. for purposes of maintaining or managing medical records on behalf of the health care provider; or



4. if the patient has signed an informed written consent to participate in an approved research study, for research.



4. Limited disclosure of HIV/AIDS information.
1. A patient's HIV/AIDS information will not be disclosed except to the following:
1. the patient himself/herself or, when the patient lacks the capacity to consent, a person legally authorized to consent to health care for the patient.



2. any person pursuant to a valid, written authorization signed by the patient;



3. another health care provider or facility when knowledge of the HIV/AIDS information is necessary to provide appropriate care or treatment to the patient, a child of the patient, a contact of the patient, or a person authorized to consent to health care for a contact of the patient;



4. a health care facility or health care provider in relation to the procurement, processing, distribution, or use of a human body or body part for use in medical education, research, therapy, or transplantation;



5. a medical staff committee or accreditation or oversight review organization provided the recipient of the HIV/AIDS information will not further disclose the confidential information except as required by law;



6. a federal, state, county, or local health officer when such disclosure is required by federal or state law;



7. an authorized foster care or adoption agency, provided, however, such agency agrees not to further disclose the information except as required by law;



8. pursuant to a court order;



9. to an employee or agent of the Parole Division, Probation and Correctional Alternatives Division, or the Commission of Correction, or a Medical Director of a local correctional facility; or



10. a legal guardian appointed by a court to represent a minor with respect to the minor's HIV information.



2. Disclosures of HIV/AIDS information to the patient's contacts.
1. The physician is required to notify the public health officer of the patient's status as an HIV/AIDS patient.



1. It is the responsibility of the public health officer to notify the patient's contacts.



2. The patient's physician may provide the public health officer with information (i.e., the names, addresses, etc.) about the patient's contacts, if known.



3. If the patient's physician has undertaken any efforts to notify the patient's contacts (see 4(b)(2) below), the patient's physician will report the efforts taken to notify the patient's contacts to the public health officer.



2. The patient's physician may, but is not required to, disclose the patient's HIV/AIDS information to the patient's contacts under the following conditions:



1. the disclosure is made directly to a contact of the patient; or



2. the physician believes disclosure is medically appropriate and there is a significant risk of infection to the contact; and



3. the physician has counseled the patient regarding the need to notify the contact; and



4. the physician has informed the patient of the physician's intent to make such disclosure to the contact.


3. A physician may, upon the consent of a parent or guardian, disclose HIV/AIDS information to a health officer for the purpose of reviewing the medical history of a child to determine the fitness of the child to attend school.



5. Documentation.
1. Any disclosure of a patient's HIV/AIDS information will be documented in the patient's medical record.



2. All documentation relating to HIV/AIDS information will be maintained for a minimum of six (6) years.



6. Questions. Questions about whether use or disclosure of HIV/AIDS information is proper should be directed to the HIPAA Privacy Officer.

RESPONSIBILITY:         HIPAA Privacy Officer, Departments