NASW PRINCIPLES AND STANDARDS TO BE INCLUDED IN PRIVACY LEGISLATION

March 19, 1999

Legislation that addresses the need for national standards that protect the privacy and confidentiality of health records information should contain the following provisions:

GROUP A

• It must establish an individual's right to privacy with respect to individually identifiable health information, with special protections for mental health and other sensitive health care information. It must prohibit the use or disclosure of individually identifiable health information without an individual's informed consent, except for very limited and exceptional circumstances. It must guarantee an individual the right to review his or her own health information and to supplement such information. It must protect individual privacy rights without impeding important clinical and medical research and important public health activities.
• It must contain strong language protecting the confidentiality of health care information as it relates to electronic transfer of such information.

GROUP B

• It must establish strong and effective remedies for violations of privacy protections. It must establish a floor, not a ceiling, for the protection of individual privacy rights and thereby not preempt any other federal or state law or regulation that is more protective of an individual's right to privacy or access to individually identifiable health information.
• It must clearly recognize the privilege granted to psychotherapy records as a result of Jaffe v. Redmond, 116S. Ct. 1923 (1996).

GROUP C

• It must contain language that provides for civil and/or criminal sanctions where such violations are clearly willful, intentional, or represent egregious act for commercial or monetary gain It must contain language that clarifies that the disclosure of protected health information under emergency circumstances is limited to licensed, certified, or registered health care providers
• It must contain language that protects the release of health care information provided for oversight purposes, public health purposes, and health research by requiring that it be provided in a non-identifying coded format.