Sensitive Information Overview

Individual health information is protected by both state and federal laws that govern the use, disclosure, and safeguarding of such information. Access to patient health information through Connie is available to healthcare organizations that (a) have a data sharing agreement with Connie; and (b) have a relationship with the patient for either treatment, health care operations, or payment purposes. Consistent with HIPAA and Connecticut state policy, consent is not required for health information sharing through Connie except for certain particularly sensitive types of health information. If a patient does not want their health information shared through Connie, they can opt-out. If a patient opts out of Connie, they are opted out of every aspect of data sharing that is not otherwise required by law. Opt-out enables the patients to have their (a) historic electronic health information deleted from Connie and (b) future electronic health information blocked from being uploaded by Connie across all participating health care organizations. For more information about the specific instances that opt-out does not cover, see our frequently asked questions.

In Connecticut, certain types of substance use disorder (SUD) treatment, mental health, and HIV/AIDS information have additional protections. Connie refers to health information with enhanced protections under state law as “sensitive information.” Before sensitive information is sent to Connie to be shared through the HIE, state and federal laws often require patients to provide affirmative consent. Typically, affirmative consent occurs at the provider’s office with the patient. It allows the provider to share sensitive information with the patient’s care team that contains important clinical context for patient care coordination. Nevertheless, the typical consent process can be challenging in providing whole-person care for patients with diagnoses that include sensitive information.

Connie’s SUD Treatment Consent Tool

Connie is launching a consent tool which enables SUD treatment providers who have executed a qualified service organization agreement (QSOA) with Connie to share SUD treatment information protected by 42 CFR Part 2 through the HIE upon patient consent. This tool aims to improve care coordination between SUD treatment providers and other health care providers, strengthen continuity of care for patients throughout SUD treatment levels, and ease workflow burden when obtaining consent and disclosing information.

Currently the consent tool is limited to SUD information covered by 42 CFR Part 2. Future efforts will include consent tools for sharing certain mental health and HIV/AIDS information.

Affirmative Consent Process

Sharing SUD Treatment Information: An SUD treatment provider that has already completed the necessary legal agreements with Connie, including the Qualified Service Organization Agreement (QSOA) enabling SUD treatment information to be shared with Connie. The SUD treatment provider then sends patient SUD treatment information to Connie, which will be stored in a separate data repository awaiting patient consent.

Registering Consent: Any of the patient’s providers that participate with Connie can register the patient’s consent to share sensitive health information from any SUD treatment provider that has shared such information with Connie. Providers have the option to register a new consent or search for an existing consent on file. New consents will automatically override an existing consent on file. Providers can view past registered consents in the consent history log. To register a new consent, the provider will complete the “Patient Consent to Disclose Substance Use Disorder Treatment Information Form” to document patient consent for sharing SUD treatment information.

• On the form, the patient will indicate their consent preferences and will electronically sign the consent form.
• The provider must attest to providing patient education and verifying patient identity before registering consent.
• Once the form is complete, the provider can submit the form and, if desired, print and save a copy of the consent form for their files.

Interested in Utilizing the Tool?

If your site would be interested in a consent tool demonstration, please contact your Connie account manager, or email info@conniect.org.

FAQs for Providers:

Is my organizations allowed to send information about my patients with substance use disorders to health information exchanges (HIEs)?

Yes. The Part 2 Rules permit Programs to disclose patient information to HIEs. However, to meet the requirements of the Part 2 Rules, a Program must either obtain patient consent before disclosing patient SUD records to the HIE or execute a Qualified Service Organization Agreement (QSOA) with the HIE (see § 2.11 and § 2.12(c)(4)).

What is a Qualified Service Organization Agreement (QSOA)?

A qualified service organization (QSO) is an individual or entity who provides services to a Part 2 Program, such as data processing, bill collecting, laboratory analyses, legal, accounting, medical staffing, or an HIE.

A Part 2 Program and a QSO must enter into an agreement under which the QSO: (i) Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the Part 2 Program, it is fully bound by the Part 2 Rules; and (ii) if necessary, will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment except as permitted by 42 CFR Part 2. We refer to such agreement as a QSOA.

In the HIE context, a Program and an HIE could sign a QSOA acknowledging that the HIE is providing information exchange services to the Program and is bound by the requirements of the Part 2 Rules. Because the HIE is considered a QSO, the Part 2 Program would not need patient consent to disclose patient information to the HIE. However, the HIE would be restricted from re-disclosing patient identifying information to participating providers without the patient’s consent.

How do I access the Consent tool?

Providers can access the Consent Tool through the Connie Portal. If you do not currently have access to the portal, please reach out to your HIE admin. If you do not know your HIE admin, you can find out by emailing info@conniect.org with your organization’s name and your contact information.

What SUD treatment information will be shared?

Connie will only share SUD treatment information once a patient has registered a consent via the Consent Tool. This includes both the patient’s attribution to a 42 CFR Part 2 provider, and/or associated information about their treatment. Patients have the option to select whether they want to limit disclosure to only the SUD treatment provider information or all SUD treatment information. All SUD treatment information displayed in Connie will be accompanied by a notice that such information may not be redisclosed per 42 CFR Part 2 requirements. Patient consent to share SUD treatment information may be updated or revoked at any time.

Who will see this SUD treatment information?

The provider consent form allows members of the patient’s healthcare team who are participating in Connie and other CRISP Shared Services affiliate Health Information Exchanges (HIEs), to view your patient’s SUD treatment information. CSS affiliate Health Information Exchanges (HIEs) include in Maryland, DC, West Virginia, Connecticut, Alaska and any additional HIE affiliates in the future. Providers could include hospital providers, primary care providers, and specialists such as cardiologists, pharmacists, and dentists. The SUD treatment information is only shared with healthcare providers with a treatment relationships with the patient in their practice or at the hospital. For a current list of Connie’s participating organizations see: https://conniect.org/for-organizations/.

Will Connie share my patient’s SUD treatment information with law enforcement or with the court system without my patient’s consent?

Connie does not share SUD treatment information with law enforcement or the court system unless required by law. In the case of sharing data with law enforcement, Connie would only disclose SUD data to law enforcement in the event of a court order. Additionally, Connie may be required to disclose information to government oversight agencies. For example, if an agency was conducting a state or federal compliance audits or Medicare/Medicaid audit of a 42 CFR Part 2 program or provider.

When does the consent expire?

The patient may choose an expiration date at the bottom of the form. If the patient does not choose a date, the consent will not be confirmed. The patient is free to choose any date up to 5 years from the date of consent registration.

Can my patient revoke consent? What happens if they revoke consent?

Your patient can revoke their consent at any time by asking you to log-on to Connie and deactivate the consent form. Connie will immediately stop sharing their SUD treatment information. This will not apply to SUD treatment information that was shared while your patient’s consent was active that a provider recorded in their own system.

What are the benefits of my patient sharing their SUD treatment information through Connie?

When your patient shares their SUD treatment information, members of their healthcare team will be aware that they are currently in SUD treatment or that they have been in the past. Sharing this information can improve patient care coordination and enable providers to better support their patient in recovery.

What risks are posed by sharing my patient’s SUD treatment information through Connie?

A patient who consents to the sharing of their SUD treatment information through Connie cannot specify which providers can or cannot access or view their SUD treatment information. Patients should then be aware that they are not able to limit access to only specific providers.

Can I share information about my patient directly with other providers if we don’t submit this form?

This consent form is used only for your patient to allow their SUD treatment information to be shared through Connie. You may have other consent or release of information forms for your patient to complete to share information directly with others.