Confidentiality Agreements

All MCOs encountered during our study require their staff to sign statements upon hire to document understanding of confidentiality policies, as well as agreement to adhere to them. However, the amount of detail and extent of repercussion for breaches in privacy were highly variable. Worst practices, again, were vague or lacking relevant policies. The best practices included:

• Signed statements that policies had been read and were understood;

• Agreement to participate in orientation and ongoing training sessions on confidentiality;

• Reiteration of applicable state and federal laws;

• Contact information for the executive responsible for addressing any questions or areas of uncertainty; and

• Notice that breaches are grounds for termination and liability under state and federal law.

Training

Unfortunately, not all MCOs conduct staff training about privacy. In addition, the language we were able to obtain about such efforts is too vague to determine the quality of the activities. Thus the following are potentially best practices, depending upon the content and comprehensiveness of the training.

• "All Service Line, Program and Department Directors shall ensure that new employees, volunteers, or students who work within the program are instructed regarding the need to protect the patient's right to confidentiality."

• "New employees are expected to participate in training and orientation…This process is repeated annually at the time of the employee's annual performance review."

• "Education regarding the patient's right to confidentiality is mandatory for all employees."

"Top 10" Key Findings and Recommendations

Methodology

NMHA Standards for Responsible Management of Consumer Information (Position Statement P-34)

Maintenance of Consumer Information

Medical Records and Session Notes

Managed Care Staff Policies

Protocols For Clinicians and Their Staff

Special Populations and Circumstances