25 TAC §§414.1 - 414.8
The Texas Department of Mental Health and Mental Retardation
(TDMHMR) proposes new §§414.1 - 414.8 of Chapter 414, Subchapter
A, concerning protected health information. The repeals of existing §§414.1
- 414.17 of Chapter 414, Subchapter A, concerning client-identifying information,
which the new sections would replace, are contemporaneously proposed in this
issue of the
Texas Register
.
The proposed new rules would require facilities, local authorities, community
centers, and their respective contract providers to comply with all applicable
federal and state statutes, rules and regulations governing privacy of protected
health information and lists 19 applicable federal and state statutes, rules
and regulations. The proposed new rules would also require the Notice of Privacy
Practice of each facility, local authority, and community center to include
information regarding permitted disclosures under Texas Health and Safety
Code, §533.009. Additionally, the new rules would require each facility,
local authority, and community center to include in its Notice of Privacy
Practice a statement that identifies it as a part of the TDMHMR service delivery
system and a statement that individuals may file a complaint with TDMHMR Consumer
Services and Rights Protection/Ombudsman Office by calling 1-800-252-8154
or writing to P.O. Box 12668, Austin, TX 78711.
The proposed new rules also reference TDMHMR's "Interpretative Guidance
on Laws Pertaining to Privacy of Mental Health and Mental Retardation Records
for TDMHMR, its Contractors, and Consumers," which is an interpretation of
the applicable federal and state statutes, rules and regulations listed in
these rules. The new rules require TDMHMR Central Office and all facilities
to comply with the interpretative guidance. Although the new rules do not
require local authorities and community centers to comply with the interpretative
guidance, TDMHMR notes that it will use this guidance in determining whether
TDMHMR contractors (e.g., local authorities) and community centers are in
compliance with applicable federal and state statutes, rules and regulations
governing privacy of protected health information.
Cindy Brown, chief financial officer, has determined that for each year
of the first five years the rules are in effect, enforcing or administering
the rules does not have foreseeable implications relating to cost or revenue
of the state or local governments because the new rules merely require compliance
with existing state and federal statutes as well as recently adopted federal
regulations (i.e., 45 CFR Parts 160 and 164).
Cathy Campbell, director, Legal Services, has determined that, for each
year of the first five years the proposed new rules are in effect, the public
benefit expected is the protection of rights of individuals receiving mental
health, mental retardation, and chemical dependency services from a facility,
local authority, community center, or its respective contract provider with
regard to use and disclosure of their protected health information (PHI) in
compliance with federal and state privacy laws. It is not anticipated that
there will be any additional economic cost to persons required to comply with
the proposed rules because they do not impose additional requirements on such
persons.
It is not anticipated that the proposed new rules will affect a local economy
because the rules do not contain requirements related to employment or a local
economy.
It is anticipated that the proposed new rules will not have an adverse
economic effect on small businesses or microbusinesses because the rules do
not impose requirements on small businesses or microbusinesses that are additional
to those contained in existing state and federal statutes or recently adopted
federal regulations.
A hearing to accept oral and written testimony from members of the public
concerning the proposal has been scheduled for 9:00 a.m., on Friday, February
21, 2003, in TDMHMR Central Office Auditorium in Building 2 at 909 West 45th
Street, in Austin, Texas. Persons requiring an interpreter for the deaf or
hearing impaired should contact the TDMHMR Central Office operator at least
72 hours prior to the hearing at TDD (512) 206-5330. Persons requiring other
accommodations for a disability should notify Sharayla Jones, at least 72
hours prior to the hearing at (512) 206-5283 or at the TDY phone number of
Texas Relay, 1-800-735-2988.
Written comments on the proposal may be sent to Linda Logan, director,
Policy Development, Texas Department of Mental Health and Mental Retardation,
P.O. Box 12668, Austin, Texas 78711-2668, within 30 days of publication.
These rules are proposed under the Texas Health and Safety Code, §532.015,
which provides the Texas Mental Health and Mental Retardation Board (board)
with broad rulemaking authority, and §533.009, which requires the board
to adopt rules governing the exchange of patient and client records without
the patient's or client's consent among department facilities, local mental
health or mental retardation authorities, community centers, other designated
providers, and subcontractees of mental health and mental retardation services.
These proposed rules would affect the Texas Health and Safety Code, §532.015
and §533.009.
§414.1.Purpose.
The purpose of this subchapter is to require facilities, local authorities,
community centers, their respective contract providers, and TDMHMR Central
Office to comply with all applicable privacy laws, rules, and regulations.
§414.2.Application.
This subchapter applies to:
(1)
all facilities of the Texas Department of Mental Health
and Mental Retardation (TDMHMR);
(2)
TDMHMR Central Office;
(3)
all local authorities; and
(4)
all community centers.
§414.3.Definitions.
The following words and terms, when used in this subchapter, have the
following meanings, unless the context clearly indicates otherwise:
(1)
Community center--A center established under the Texas
Health and Safety Code, Title 7, Chapter 534, Subchapter A.
(2)
Contract provider--A person, entity, or organization that
contracts with a facility, local authority, or community center to provide
mental health or mental retardation services, or alcohol or drug abuse treatment.
(3)
Facility--A state mental health facility or a state mental
retardation facility.
(4)
Individual--A person who, voluntarily or involuntarily,
is seeking or receiving, or has sought or received mental health or mental
retardation services, or alcohol or drug abuse treatment from or through a
facility, a local authority, a community center, or its respective contract
providers, or TDMHMR Central Office.
(5)
Local authority--An entity designated by the TDMHMR commissioner
in accordance with the Texas Health and Safety Code, §533.035(a).
(6)
More stringent--In accordance with 45 CFR 160.202, a state
law that meets one or more of the following criteria:
(A)
with respect to a use or disclosure, the law prohibits
or restricts a use or disclosure where the use or disclosure would be permitted
under the federal regulation, except if the disclosure is to the U.S. Department
of Health and Human Services or to the individual;
(B)
with respect to the rights of an individual regarding access
to or amendment of protected health information, the law permits greater rights
of access or amendment;
(C)
with respect to information to be provided to an individual
about a use, a disclosure, rights, and remedies, the law provides a greater
amount of information;
(D)
with respect to consent or authorization for use or disclosure
of protected health information, the law narrows the scope or duration of
the consent or authorization, increases privacy protections, or reduces the
coercive effect of obtaining the consent or authorization; or
(E)
with respect to recordkeeping or accounting of disclosures,
the law provides for the retention or reporting of more detailed information
or for a longer duration.
(7)
Notice of Privacy Practices--Pursuant to 45 CFR §164.501,
a written notice developed and distributed by a covered entity, as defined
in 45 CFR §160.103, that describes:
(A)
the uses and disclosures of protected health information
that may be made by the entity; and
(B)
individuals' rights and the entity's legal duties with
respect to protected health information.
(8)
Protected health information or PHI--
(A)
Any information that identifies or could be used to identify
an individual, whether oral or recorded in any form, that relates to:
(i)
the past, present, or future physical or mental health
or condition of the individual;
(ii)
the provision of health care to the individual; or
(iii)
the payment for the provision of health care to the individual.
(B)
The term includes, but is not limited to:
(i)
an individual's name, address, date of birth, or Social
Security number;
(ii)
an individual's medical record or case number
(iii)
a photograph or recording of an individual;
(iv)
statements made by an individual, either orally or in
writing, while seeking or receiving services from or through a facility, a
local authority, a community center, or its respective contract providers,
or TDMHMR Central Office;
(v)
any acknowledgment that an individual is seeking or receiving
or has sought or received services from or through a facility, a local authority,
a community center, or its respective contract providers, or TDMHMR Central
Office;
(vi)
direct identifiers of relatives, employers, or household
members of an individual; and
(vii)
any information by which the identity of an individual
can be determined either directly or by reference to other publicly available
information.
(C)
The term does not include:
(i)
health information that has been de-identified in accordance
with 45 CFR §164.514(b); and
(ii)
employment records held by an entity as an employer.
(9)
State mental health facility--A state hospital or a state
center with an inpatient component that is operated by TDMHMR.
(10)
State mental retardation facility--A state school or a
state center with a mental retardation residential component that is operated
by TDMHMR.
§414.4.Requirements.
(a)
TDMHMR Central Office and each facility, local authority,
and community center shall comply with all applicable federal and state statutes,
rules and regulations pertaining to privacy of protected health information
(PHI) including, but not limited to, the federal and state statutes, rules
and regulations described in §414.5 of this title (relating to Regulations
and Statutes Governing Confidentiality of Protected Health Information).
(1)
As set forth in 45 CFR Part 160 Subpart B, where a provision
of 45 CFR Part 160 or 164 is contrary to a provision of state law, the federal
regulation preempts the state law unless the provision of state law:
(A)
is more stringent (as defined) than the provision of the
federal regulation;
(B)
provides for the reporting of disease or injury, child
abuse, birth, or death, or for the conduct of public health surveillance,
investigation, or intervention; or
(C)
requires a health plan to report, or to provide access
to, information for the purpose of management audits, financial audits, program
monitoring and evaluation, or the licensure or certification of providers
or persons.
(2)
TDMHMR's "Interpretative Guidance on Laws Pertaining to
Privacy of Mental Health and Mental Retardation Records for TDMHMR, its Contractors,
and Consumers," referenced as Exhibit A in §414.6 of this title (relating
to Exhibits), provides an interpretation of the applicable federal and state
statutes, rules and regulations described in §414.5 of this title (relating
to Regulations and Statutes Governing Confidentiality of Protected Health
Information), applying the preemption provisions described in paragraph (1)
of this subsection. TDMHMR Central Office and all facilities must comply with
the "Interpretative Guidance on Laws Pertaining to Privacy of Mental Health
and Mental Retardation Records for TDMHMR, its Contractors, and Consumers."
(b)
Information to be included in Notice of Privacy Practice.
(1)
Each facility, local authority, and community center shall
include in its Notice of Privacy Practice a statement that disclosures may
be made between facilities, local authorities, community centers, their respective
contract providers, and TDMHMR Central Office for the purpose of treatment,
payment, or health care operations without the individual's consent as permitted
by Texas Health and Safety Code, §533.009.
(2)
TDMHMR Central Office and each facility, local authority,
and community center shall include in its Notice of Privacy Practice a statement:
(A)
that identifies it as a part of the TDMHMR service delivery
system; and
(B)
that individuals may file a complaint with TDMHMR Consumer
Services and Rights Protection/Ombudsman Office by calling 1-800-252-8154
or writing to P.O. Box 12668, Austin, TX 78711.
(c)
Each facility, local authority, and community center is
responsible for ensuring that contracts with its contract providers require
compliance with subsection (a) of this section.
§414.5.Regulations and Statutes Governing Confidentiality of Protected Health Information.
(a)
Federal regulations. The following federal regulations
pertain to privacy of protected health information (PHI):
(1)
Code of Federal Regulations, Title 45, Parts 160 and 164,
Federal Standards for Privacy of Individually Identifiable Health Information
(i.e., Federal Privacy Rule), promulgated by the Secretary of the United States
Department of Health and Human Services;
(2)
Code of Federal Regulations, Title 42, Part 2, Confidentiality
of Alcohol and Drug Abuse Patient Records, promulgated by the Secretary of
the United States Department of Health and Human Services;
(3)
Code of Federal Regulations, Title 34, Part 99, governing
the disclosure of educational records of school-age children, promulgated
by the Secretary of the United States Department of Education; and
(4)
Code of Federal Regulations, Title 42, Part 51, Subpart
D, and Code of Federal Regulations, Title 45, §1386.22, governing access
to PHI by advocates for individuals with mental illness and mental retardation,
promulgated by the Secretary of the United States Department of Health and
Human Services.
(b)
Federal statutes.
(1)
The Health Insurance Portability and Accountability Act
(HIPAA), 42 USC §1320d
et seq.
, provides
the statutory authority for the United States Department of Health and Human
Services to promulgate the Federal Privacy Rule.
(2)
42 USC §10805(a)(4) (Protection and Advocacy for Mentally
Ill Individuals) and 42 USC §15043(a)(2)(I) (Protection and Advocacy
of Individual Rights) provide the authority for access of PHI by Advocacy,
Inc.
(3)
42 USC §290dd-2 provides the statutory authority to
promulgate the federal regulations on confidentiality of alcohol and drug
abuse patient records, referenced in subsection (a)(2) of this section.
(c)
State statutes.
(1)
Texas Health and Safety Code, Chapter 181, governing uses
and disclosures of PHI in the State of Texas, applies portions of 45 CFR Parts
160 and 164 (Federal Privacy Rule) to most entities and persons not covered
by HIPAA.
(2)
Texas Open Records Act, Texas Government Code, Chapter
552, provides that all information collected, assembled, or maintained in
any form by governmental bodies, and agencies operating in part or whole with
state funds, in connection with the transaction of official business is public
information; however, the act does set out certain exceptions. One such exception
is information deemed confidential by law, such as PHI.
(3)
Texas Health and Safety Code, §576.005 and Chapter
611, govern the confidentiality of PHI that relates to MHMR services.
(4)
Texas Health and Safety Code, Chapter 81, Subchapter F,
governs the confidentiality of information related to HIV/AIDS test results.
(5)
The provisions for disclosure of PHI that relates to mental
retardation services are contained in the Persons with Mental Retardation
Act, Texas Health and Safety Code, Chapter 595. The provisions described in §576.005
and Chapters 595 and 611 of Texas Health and Safety Code should be interpreted
together in reaching a determination regarding the use or disclosure of PHI
that relates to mental retardation services.
(6)
Texas Human Resources Code, Chapter 48, establishes authority
for the Texas Department of Protective and Regulatory Services (TDPRS) to
have access to PHI necessary to conduct investigations into allegations of
abuse, neglect, and exploitation of individuals.
(7)
Texas Medical Practice Act, Texas Occupations Code, Chapter
159, governs physician-patient communication.
(8)
Texas Health and Safety Code, §533.009, governs the
exchange of PHI between facilities, local authorities, community centers,
and their respective contract providers.
(9)
Texas Health and Safety Code, §595.005(c), governs
the disclosure of educational records of individuals receiving mental retardation
services.
(10)
Texas Government Code, Chapter 559, provides that persons
have a right to be informed about information that a state governmental body
collects about them, and to have incorrect information that is possessed about
them by a state governmental body corrected.
(11)
Texas Family Code, Chapter 32, governs consent to treatment
of a child by a non-parent or the child.
(12)
Texas Health and Safety Code, Chapter 241, Subchapter
G, governs the disclosure of PHI in hospitals licensed under the chapter.
§414.6.Exhibit.
This subchapter references Exhibit A -- "Interpretative Guidance on
Laws Pertaining to Privacy of Mental Health and Mental Retardation Records
for TDMHMR, its Contractors, and Consumers," copies of which are available
by contacting TDMHMR, Policy Development, P.O. Box 12668, Austin, TX 78711-2668.
§414.7.References.
Reference is made to the following state and federal statutes, rules,
and regulations:
(1)
45 CFR Parts 160 and 164, and §1386.22;
(2)
42 CFR Part 2 and Part 51, Subpart D;
(3)
34 CFR Part 99;
(4)
42 USC §290dd-2, §1320d
et seq.
, §10805(a)(4), and §15043(a)(2)(I);
(5)
Texas Health and Safety Code:
(A)
Chapter 81, Subchapter F;
(B)
Chapter 241, Subchapter G;
(C)
Chapter 534, Subchapter A;
(D)
Chapters 181; 595; and 611; and
(E)
§533.009, §533.035(a), §576.005, and §595.005(c);
(6)
Texas Government Code, Chapters 552 and 559;
(7)
Texas Human Resources Code, Chapter 48;
(8)
Texas Occupations Code, Chapter 159; and
(9)
Texas Family Code, Chapter 32.
§414.8.Distribution.
(a)
This subchapter shall be distributed to:
(1)
members of the Texas Mental Health and Mental Retardation
Board;
(2)
executive, management, and program staff of TDMHMR Central
Office;
(3)
CEOs of all facilities, local authorities, and community
centers; and
(4)
advocacy organizations.
(b)
The CEO of each facility, local authority, and community
center shall disseminate the information contained in this subchapter to all
appropriate staff members and contract providers.
This agency hereby certifies that the proposal has been reviewed
by legal counsel and found to be within the agency's legal authority to adopt.
Filed with the Office of
the Secretary of State on January 24, 2003.
TRD-200300492
Andrew Hardin
Chairman, Texas MHMR Board
Texas Department of Mental Health and Mental Retardation
Earliest possible date of adoption: March 9, 2003
For further information, please call: (512) 206-5216