Supermax Prisons and the Constitution: Liability ... - Supermaxed

30Supermax Prisons and the Constitution: LIABILITY CONCERNS IN THE EXTENDED CONTROL UNITliving unit, check with inmates who have knownmedical problems, and give other inmates opportunitiesto discuss medical concerns.Custody officers can provide valuable feedback tomedical and mental health providers regarding thecondition of inmates. By including custody officersin periodic medical/mental health staffreviews of inmate/patient progress, health-careproviders can gain valuable information theymight not otherwise have. Such communicationwith custody staff may be an example of howsharing some otherwise confidential informationabout an inmate’s medical or mental healthcondition with nonmedical staff may be justifiedby a legitimate penological interest.Health Insurance Portabilityand Accountability Act(HIPAA)The provisions of HIPAA have resulted in threesets of regulations from the U.S. Department ofHealth and Human Services. The first set 52 dealswith transactions, code sets, and identifiers, i.e.,standardized means of identifying such things asdiagnostic information and health-care providers.The second set 53 covers privacy of medical information.The third set 54 deals with security of protectedhealth-care information. The second setof regulations, relating to privacy, promises to bethe most problematic for ECUs.The critical threshold question with the HIPAAprivacy regulations is whether they even applyto corrections agencies. Because this question5245 C.F.R. § 162.1000.53Id. Parts 160 and 164.54Id. Parts 160, 162, 164.55Id. § 160.103.56Id. § 164.512(k)(5).concerns the entire agency, not just a single institutionor unit within the agency, it is outside thescope of this monograph. Suffice it to say that therules apply to a health-care provider (and othertypes of health organizations) engaging in theelectronic transmission of certain types of “transaction”information. 55 Note that two requirementsmust be met: the “health care provider” criteriaand engaging in the electronic transmission oftransaction information. “Transactions” relateprimarily to financial matters, such as paymentand remittance.Permission To Share Medical InformationIf a corrections agency and an ECU within it are“covered entities,” the HIPAA privacy regulationsimpose several requirements. The most significantpertain to circumstances under which “protectedhealth-care information” (which is not limited toelectronically transmitted information) can beshared. The general rule is that, except for limitedpurposes, such information cannot be sharedwithout the patient’s specific permission.A major exception to the disclosure permissionrule exempts corrections agencies from the rulewhen they certify that disclosure is necessary forproviding health care to the inmate, for ensuringthe health and safety of other inmates and staff,and for other similar reasons. 56 This generalexception also applies to covered entities that providemedical care to inmates but are not part ofthe corrections agency or institution, such as outsidehospitals.Because a hospital outside the prison systemfocuses on HIPAA requirements for the general