Protection & Advocacy System, Inc. v. Freudenthal

*1212 FINDINGS OF FACT, CONCLUSIONS OF LAW AND ORDER ALAN B. JOHNSON, Chief Judge. This Court has been asked to decide whether the confidentiality provisions of two federal statutes, the Health Insurance Portability and Accountability Act (HI-PAA), 42 U.S.C. § 1320d to d-8, and the federal Medicaid Act, 42 U.S.C. § 1396a(a)(7), prohibit the Plaintiff from accessing records at the Wyoming State Hospital and the Wyoming State Training School in accordance with the access authority set forth in the Protection and Advocacy for Individuals with Mental Illness Act, (hereinafter the “PAIMI Act”), 42 U.S.C. § 10801 et seq., the Developmental Disabilities Assistance and Bill of Rights Act (hereinafter, “DD Act”), 42 U.S.C. § 15001 et seq., and the Protection and Advocacy for Individual Rights Act (hereinafter, the “PAIR Act”), 29 U.S.C § 794e, (collectively referred to as the “P & A” acts). In its Amended Complaint, Plaintiff asserts that Defendants have denied access to records at the Wyoming State Hospital and Wyoming State Training School in violation of the P & A acts. Defendants raise the issue of the extent to which HI-PAA and the Medicaid Act affect the disclosure requirements in the P & A acts. These concerns create a live case or controversy, as distinguished from the recent protection and advocacy case of Disability Law Center v. Millcreek Health Center, 428 F.3d 992 (10th Cir.2005). The Court holds that neither HIPAA nor the Medicaid Act bars the Plaintiff from accessing records at the Wyoming State Hospital and the Wyoming State Training School as long as the disclosure is required by a P & A act and P & A complies with all requirements set forth in the P & A act. The Court further holds that the access agreement (attached as Appendix A) complies with all current applicable laws. FINDINGS OF FACT I. THE PARTIES The P & A acts authorize creation in each state of a protection and advocacy system for persons with certain disabilities. Understanding the genesis of the protection and advocacy systems is helpful to resolution of this case. In response to the “inhumane and despicable conditions” discovered at a New York institution for persons with developmental disabilities, Congress enacted the DD Act to protect the civil rights of this vulnerable population. Pursuant to the Act, a state cannot receive federal funds for services to persons with developmental disabilities unless it has established a protection and advocacy system. Alabama Disabilities Advocacy Program v. J.S. Tarwater Developmental Center, 97 F.3d 492, 495 (11th Cir.1996). Following hearings in 1985 to examine the care and treatment of persons with mental illness who were residents of institutions, Congress in 1986 enacted the PAI-MI Act to “assure the constitutional and statutory rights of the mentally ill are protected and to assure investigation of abuse and neglect.” Robbins v. Budke, 739 F.Supp. 1479, 1481 (D.N.M.1990). Plaintiff Protection & Advocacy System, Inc., (hereinafter, “P & A”), is the designated system in Wyoming. The PAIMI Act applies to persons with mental illness, and the DD Act applies to persons with developmental disabilities. The Protection and Advocacy of Individual Rights Program (“PAIR”) was created by Congress in an amendment to the Rehabilitation Act of 1973 and is codified at 29 U.S.C. § 794e. PAIR applies to persons with disabilities *1213 who do not have a developmental disability and are not persons with mental illness. These acts and their implementing regulations authorize P & A to investigate allegations of abuse and neglect; to monitor; to provide training on rights and make referrals and to pursue legal, administrative and other remedies. They also authorize P & A to obtain access to records under specific circumstances. The PAIMI Act and DD Act have slightly different access provisions. The PAIR Act authorizes P & A to have the same access rights as the DD Act. 29 U.S.C. § 794e(f)(l)-(2); Iowa Protection and Advocacy Services, Inc. v. Res-Care Premium, Inc. No. 4-02-CV-10112 (S.D.Iowa 2002) and Connecticut Office of Protection and Advocacy for Persons with Disabilities v. Hartford Board of Education, 355 F.Supp.2d 649 at 657-658 (D.Conn.2005). The Wyoming State Hospital (hereinafter, “State Hospital”) is a state institution which was established in 1886. It is the only publicly funded, psychiatric inpatient facility in the State. The State Hospital is an agency within the Wyoming Department of Health, and is a “covered entity,” as that term is defined in the Health Insurance Portability and Accountability Act (hereinafter, “HIPAA”), 42 U.S.C. § 1320d. The Wyoming State Training School (hereinafter, “State Training School”) is a state institution which was opened in 1912, originally as an inpatient facility for persons with developmental disabilities. The State Training School continues to serve individuals with developmental disabilities. It also provides support and services to individuals who are dually diagnosed with developmental disabilities and mental illness. The State Training School also provides inpatient services for persons with traumatic brain injuries. The State Training School is an agency within the Wyoming Department of Health and is a “covered entity,” as that term is defined in HIPAA. The Wyoming Medicaid program pays for services to some of the patients of the State Training School. II. ISSUES The parties agree that the P & A acts authorize P & A to obtain patient and other records from the State Hospital and State Training School in certain circumstances. However, Defendants question the extent to which HIPAA and the Medicaid Act affect those rights of access. Thus, the parties have asked the Court to rule on the interplay between the P & A acts, which confer a right to access patient records under certain circumstances, and HIPPA and the Medicaid Act, which safeguard protected health information. The parties, through negotiations, have established a mutually acceptable access agreement (Appendix A), but it cannot be implemented if HIPAA or the Medicaid Act bar disclosure of the records to P & A. CONCLUSIONS OF LAW The issue of P & A’s access to records requires the Court to consider other federal statutes which impose confidentiality requirements to protect individual records. The requirements regarding access and confidentiality rights relevant to this case are set forth in the PAIMI, DD and PAIR acts; in HIPAA, 42 U.S.C. § 1320d to d-8; and in the federal Medicaid confidential data standards, as established by § 1902(a)(7) of the Social Security Act (hereinafter, “Medicaid”), 42 U.S.C. § 1396a(a)(7). I. RELEVANT ACCESS AND CONFIDENTIALITY LAWS A. P & A Statutes on Access to Records In order for P & A to carry out its statutory mandate to investigate allega *1214 tions of abuse and neglect and to pursue appropriate administrative, legal and other remedies, it is critical that P & A be able to obtain access to facilities, residents, staff and records as provided under the acts. As the Eleventh Circuit Court of Appeals said with regard to the DD Act, “[I]t is clear the Act provides express authority for P & A’s to gain broad access to records, facilities and residents to ensure that the Act’s mandates can be effectively pursued.” Alabama Disabilities Advocacy Program v. J.S. Tarwater Developmental Center, supra, at 97 F.3d at 497, citing Mississippi Protection and Advocacy System, Inc. v. Cotten, 929 F.2d 1054, 1058-59 (5th Cir.1991) (facilities have an affirmative duty to implement policies and practices which promote effective P & A access); Robbins v. Budke, 739 F.Supp. 1479, 1485-1489 (P & A’s must have meaningful access to carry out their protection mandate). The DD Act applies to persons with developmental disabilities, as defined at 42 U.S.C. § 15002(8). It authorizes disclosure of individual patient records to P & A at 42 U.S.C. § 15043(a)(2)(I), which specifically provides for access in the following circumstances: (i) any individual with a developmental disability who is a client of the system if such individual, or the legal guardian, conservator, or other legal representative of such individual, has authorized the system to have such access; (ii) any individual with a developmental disability, in a situation in which- (I) the individual, by reason of such individual’s mental or physical condition, is unable to authorize the system to have such access; (II) the individual does not have a legal guardian, conservator, or other legal representative, or the legal guardian of the individual is the State; and (III)a complaint has been received by the system about the individual with regard to the status or treatment of the individual or, as a result of monitoring or other activities, there is probable cause to believe that such individual has been subject to abuse or neglect; and (iii)any individual with a developmental disability in a situation in which- (I) the individual has a legal guardian, conservator, or other legal representative; (II) a complaint has been received by the system about the individual with regard to the status or treatment of the individual or, as a result of monitoring or other activities, there is probable cause to believe that such individual has been subject to abuse or neglect; (III) such representative has been contacted by such system, upon receipt of the name and address of such representative; (IV) such representative has failed or refused to act on behalf of the individual. In addition, the DD Act also authorizes disclosure of individual patient records to P & A at 42 U.S.C. § 15043(a)(2)(J) as follows: (i) have access to the records of individuals described in subparagraphs (B) and (I), and other records that are relevant to conducting an investigation, under the circumstances described in those sub-paragraphs, not later than 3 business days after the system makes a written request for the records involved; and (ii) have immediate access, not later than 24 hours after the system makes such a request, to the records without consent from another party, in a situation in which services, supports and oth *1215 er assistance are provided to an individual with a developmental disability- (I) if the system determined there is probable cause to believe that the health or safety of the individual is in serious and immediate jeopardy; or (II) in any case of death of an individual with a developmental disability. The DD regulations at 45 C.F.R. § 1386.22 provide further examples of the records which P & A is authorized to obtain. The PAIMI Act applies to persons with mental illness, as defined at 42 U.S.C. § 10802(4). It specifically provides at 42 U.S.C. § 10805(a)(4) for access in the following circumstances: (A) any individual who is a client of the system if such individual, or the legal guardian, conservator, or other legal representative of such individual, has authorized the system to have such access; (B) any individual (including an individual who has died or whose whereabouts are unknown);— (i) who by reason of the mental or physical condition of such individual is unable to authorize the system to have such access; (ii) who does not have a legal guardian, conservator, or other legal representative, or for whom the legal guardian is the State; and (iii) with respect to whom a complaint has been received by the system or with respect to whom as a result of monitoring or other activities (either of which result from a complaint or other evidence) there is probable cause to believe that such individual has been subject to abuse or neglect; and (C) any individual with a mental illness, who has a legal guardian conservator or other legal representative, with respect to whom a complaint has been received by the system or with respect to whom there is probable cause to believe the health or safety of the individual is in serious and immediate jeopardy, whenever- (i) such representative has been contacted by such system upon receipt of the name and address of such representative; (ii) such system has offered assistance to such representative to resolve the situation; and (iii) such representative has failed or refused to act on behalf of the individual; In addition to individual patient records, the PAIMI Act also authorizes P & A to obtain access to other “records,” defined at 42 U.S.C. § 10806(b)(3)(A) to include: “reports prepared by any staff of a facility rendering care and treatment or reports prepared by an agency charged with investigating reports of incidents of abuse, neglect and injury occurring at such facility that describe incidents of abuse, neglect, and injury occurring at such facility and the steps taken to investigate such incidents, and discharge planning records.” The PAIMI regulations at 42 C.F.R. § 51.41(c)(d) and (e) also address records which may be accessed. The PAIR Act, 29 U.S.C. § 794e, applies to persons with disabilities who are not eligible under the DD Act, PAIMI Act, or P & A’s Client Assistance Program, which is authorized by 29 U.S.C. § 732. The PAIR Act grants P & A the same access rights as the DD Act. 29 U.S.C. § 794e(f)(l)-(2). Some patients at the State Hospital or State Training School may be eligible for services under the PAIR statute. P & A is required to “maintain the confidentiality of such records to the same extent as is required of the provider of such services.” 42 U.S.C. § 10806(a), 42 C.F.R. § 51.45, and 45 C.F.R. § 1386.22(e), Robbins v. Budke, 739 *1216 F.Supp. 1479, 1488 (D.N.M.1990), Pennsylvania Protection and Advocacy, Inc. v. Houstoun, 228 F.3d 428 at 427 (3rd Cir.2000). B. The Health Insurance Portability and Accountability Act (HIPAA) and the Medicaid Act Congress enacted HIPAA, 42 U.S.C. § 1320d to d-8, in part, to address concerns about the confidentiality of individually identifiable health information, particularly in an era of electronic communication. Effective as of April 14, 2003, the U.S. Department of Health and Human Services, (hereinafter “DHHS”), promulgated a Privacy Rule protecting all individually identifiable health information held or transmitted by a covered entity or its business associate in any form or media. The Privacy Rule calls this information “protected health information.” 45 C.F.R. § 160.103. HIPAA defines terms and imposes requirements for exchanging health information and provides civil and criminal penalties for violations. 42 U.S.C. § 1320d-5 to d-6. The parties agree that both the State Hospital and State Training School, agencies within the Wyoming Department of Health, are covered entities under HIPAA and the Privacy Rule, as defined in the regulations at 45 C.F.R. § 160.103. The drafters of the Privacy Rule clearly anticipated its potential conflict with other federal laws and addressed the issue in the preamble to the rule. The Court will consider the drafters’ comments at length, as an agency’s interpretation of its own regulations is entitled to substantial deference. Wyoming Outdoor Council v. U.S. Forest Service, 165 F.3d 43, 53 (D.C.Cir.1999), citing Thomas Jefferson University v. Shalala, 512 U.S. 504, 512, 114 S.Ct. 2381, 129 L.Ed.2d 405 (1994) and National Trust for Historic Preservation v. Dole, 828 F.2d 776, 782 (D.C.Cir.1987). “[T]he agency’s construction of its own regulation is controlling ‘unless it is plainly erroneous or inconsistent with the regulation.’ ” Wyoming Outdoor Council v U.S. Forest Service, supra, at 165 F.3d at 44, citing United States v. Larionoff, 431 U.S. 864, 872, 97 S.Ct. 2150, 53 L.Ed.2d 48 (1977) (quoting Bowles v. Seminole Rock Co., 325 U.S. 410, 414, 65 S.Ct. 1215, 89 L.Ed. 1700 (1945).) The preamble to the Privacy Rule states, under the heading of “Relationship to Other Federal Laws:” “[C]overed entities subject to these rules are also subject to other federal statutes and regulations.” Further, the preamble advised that “covered entities will need to determine how the privacy regulation will affect their ability to comply with other federal laws.” 65 Fed.Reg. 82481 (December 28, 2000). The Privacy Rule was intended to develop a procedure for handling protected health information and not to create or change substantive law, as indicated in the following statement in the preamble to the rule: Many apparent conflicts will not be true conflicts. For example, if a conflict appears to exist because a previous statute or regulation requires a specific use or disclosure of protected health information that the rules below appear to prohibit, the use or disclosure pursuant to that statute or regulation would not be a violation of the privacy regulation because § 164.512(a) permits covered entities to use or disclose protected health information as required by law. 65 Fed.Reg. 82481-82482 (December 28, 2000). The drafters did not intend the Privacy Rule to interfere with the operation of P & A acts where access to records is required, as illustrated in the following comment and response in the preamble: *1217 Comment: One commenter urged HHS [Health and Human Services] to ensure that the regulation would not impede access to individually identifiable health information to entities that are part of the Protection and Advocacy System to investigate abuse and neglect as authorized by the Developmental Disabilities Bill of Rights Act. Response: The Developmental Disabilities Assistance and Bill of Rights Act of 2000 (“DD Act”) mandates specific disclosures of individually identifiable health information to Protection and Advocacy systems designated by the chief elected official of the states and territories. Therefore covered entities may make these disclosures under § 164.512(a) without first obtaining an individual’s authorization, except in those circumstances in which the DD Act requires the individual’s authorization. Therefore, the rules below will not impede the functioning of the existing Protection and Advocacy System. 65 Fed.Reg. 82594 (December 28, 2000). The Privacy Rule provision governing disclosures “required by law” is 45 C.F.R. § 164.512(a)(1), which states as follows: A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of law. DHHS has designated its Office of Civil Rights, (hereinafter “OCR”), as the agency to enforce the Privacy Rule. OCR operates a web site on which it provides information and answers to questions about the Privacy Rule. The web site reports the OCR was asked the following question: May a covered entity disclose protected health information to a Protection and Advocacy system where the disclosure is required by law? The Office of Civil Rights responded, in the affirmative, stating, in part: Yes. The Privacy Rule permits a covered entity to disclose protected health information (PHI) without the authorization of the individual to a state-designated Protection and Advocacy (P & A) system to the extent ■ that such disclosure is required by law and the disclosure complies with the requirements of that law. http://answers.hhs. gov. In the case at hand, the Court has quoted extensively from the preamble to the Privacy Rule because there is apparently only one case in which a court has considered the interplay between HIPAA and the P & A acts. The case is Ohio Legal Rights Service v. Buckeye Ranch, Inc., 365 F.Supp.2d 877 (S.D.Ohio 2005). Although the court based its decision on Ohio state law, the opinion is helpful for its interpretation of the HIPAA regulation on disclosures required by law. 45 C.F.R. § 164.512(a). The case involved two parallel investigations by Ohio Legal Rights Service (hereinafter, “OLRS”), a designated protection and advocacy system. In relevant part, OLRS was investigating the possible abuse of a 13-year old whose wrist was apparently fractured during a restraint at Buckeye Ranch, a residential facility for children with mental illness. The Buckeye Ranch refused P & A access to the records arguing that HIPAA prohibited it from disclosing the records and that Buckeye Ranch would face civil and criminal penalties if it released individually identifiable health information. This is the same concern the State Hospital and State Training School have raised in this case. The court found that the HIPAA Privacy Rule did not bar disclosure of records to P & A, but that Buckeye Ranch acted appropriately in refusing to produce the records because P & A had not asserted *1218 probable cause as required under the PAI-MI Act: The Court is certainly aware of OLRS’s important mission of defending mentally ill individuals from abuse and neglect. Nonetheless, OLRS’s requests for the seclusion and restraint logs were not based on a finding of probable cause... Buckeye Ranch cannot be faulted for refusing to produce the logs when it did not know OLRS had probable cause to believe that incidents of abuse and neglect had occurred. Id. In addressing the Privacy Rule’s “required by law” provision at 45 C.F.R. § 164.512(a)(1), the court stated: Subparagraph (1) is an exception that stands on its own, allowing a covered entity to make a disclosure otherwise prohibited by HIPAA if that disclosure is required by another law. In disclosing the information, the covered entity must simply comply with the requirements of the other law-HIPAA imposes no further conditions. Ohio Legal Rights Service v. Buckeye Ranch, Inc., supra, at 365 F.Supp.2d at 886. The court supported its interpretation of the Privacy Rule provision by quoting from the commentary to the HIPAA rule, stating in part: A reading of the final commentary accompanying the HIPAA regulations confirms that the Court’s interpretation is correct. The commentary notes that the phrase ‘required by law’ is intended to be read broadly to include the full array of binding legal authority, such as constitutions, statutes, rules, regulations .... It encompasses federal, state or local actions with legally binding effect. ... 65 Fed.Reg. 82462, 82668. Ohio Legal Rights Service, Id. at 365 F.Supp.2d at 886. In the case at hand, the Court, in interpreting 45 C.F.R. § 164.512(a)(1), adopts the reasoning of DHHS and of the court in Ohio Legal Rights Service v. Buckeye Ranch, Inc., supra. Accordingly, the Court specifically finds as a matter of law that the HIPAA Privacy Rule does not bar the State Hospital and State Training School from disclosing “protected health information” without the authorization of the individual to P & A if such disclosure is required by a P & A act, and that P & A complies with the requirements set forth in the act. Medicaid is a program that pays for medical assistance for certain individuals and families with low incomes and resources. The program became law in 1965 and is jointly funded by the federal and state governments to assist states in providing assistance for long-term medical care to people who meet certain eligibility criteria. Medicaid is the largest source of funding for medical and health-related services for people with limited income. The federal Medicaid confidential data standard, as established by § 1902(a)(7) of the Social Security Act (Medicaid), contains requirements for disclosure of records. 42 U.S.C. § 1396a(a)(7). Records may be released pursuant to 42 C.F.R. § 431.302 for purposes which are directly related to State plan administration, including: (a) Establishing eligibility; (b) Determining the amount of medical assistance; (c) Providing services for recipients; and (d) Conducting or assisting an investigation, prosecution, or civil or criminal proceeding related to the plan. The Wyoming State Medicaid program pays for services to some patients at the State Training School. The Wyoming *1219 State Medicaid program considers a request from P & A for records as falling within subsection (d) of § 431.302 because it regards P & A as investigating whether or not the facility provided adequate services or adequate safeguards for its clients. The Court adopts the Wyoming State Medicaid interpretation of 42 C.F.R. § 431.302(d). Accordingly, the Court specifically finds as a matter of law that the State Hospital and the State Training School do not violate the confidentiality provisions of the Medicaid act and regulations by disclosing records to P & A so long as the disclosure is authorized by a P & A act, and the requirements for disclosures are met. II. DISCLOSURE OF RECORDS The parties have reached agreement on a protocol to govern P & A’s access to records of the State Hospital and State Training School. (Appendix A.) The DD Act at 42 U.S.C. § 15043(a)(2)(B) grants P & A “authority to investigate incidents of abuse and neglect of individuals with developmental disabilities if the incidents are reported to the system or if there is probable cause to believe the incidents occurred.” The PAIMI Act at 42 U.S.C. § 10805(a)(1)(A) grants P & A “authority to investigate incidents of abuse and neglect of individuals with mental illness if the incidents are reported to the system or if there is probable cause to believe the incidents occurred.” In its investigation of alleged abuse and neglect, P & A is entitled to access a broad range of records. The DD Act and its implementing regulations authorize access at 42 U.S.C. § 15043(c) and 45 C.F.R. § 1386.22; these provisions apply as well to requests under the PAIR Act. 29 U.S.C. § 794e(f)(l)-(2). The PAIMI Act and its implementing regulations authorize access to records at 42 U.S.C. § 10805(a)(1)(A) and 42 C.F.R. § 51.41. The DD and PAIMI acts delineate the circumstances under which P & A is authorized to obtain individual patient records. 42 U.S.C. § 15043(a)(2)(l)(i) and 42 U.S.C. § 10805(a)(4)(A). As the statutes provide, P & A sometimes requests records on the basis of probable cause to believe that a person with a disability has been subjected to abuse or neglect. The law is well established that in requesting records, P & A makes the decision as to whether probable cause exists. As the court stated in a 2003 case in Connecticut: .. .it is now a settled principle that the P. & A is the ‘final arbiter of probable cause for triggering its authority to access all records for an individual that may have been subject to abuse or neglect.’ Arizona Center for Disability Law v. Allen, 197 F.R.D. 689, 693 (D.Ariz.2000). Such a position has been overwhelmingly agreed with by other courts. See; e.g., Center For Legal Advocacy v. Earnest, 188 F.Supp.2d at 1257 (D.Colo.2002), reversed on other grounds, 320 F.3d 1107 (10th Cir.2003) Iowa Protection and Advocacy Services, Inc. v. Rasmussen, 206 F.R.D. 630 (S.D.Iowa 2001); Iowa Protection and Advocacy Services, Inc. v. Gerard Treatment Programs, LLC, 152 F.Supp.2d at 1159 (N.D.Iowa 2001); J.S. Tarwater Developmental Ctr, 97 F.3d at 494-95; Maryland Disability Law Center, Inc. v. Mt. Washington Pediatric Hospital, Inc., 106 Md.App. 55, 664 A.2d 16 (1995). Protection and Advocacy for Persons with Disabilities v. Armstrong, 266 F.Supp.2d 303, 318 (D.Conn.2003). P & A is entitled to access an individual’s records upon a finding of probable cause so long as the other requirements set forth at 42 U.S.C. § 15043(a)(2)(I)(ii) and (iii); 42 U.S.C. § 15043 (a)(2)(J)(ii)(I) *1220 and (II); or 42 U.S.C. § 10805(a)(4)(B) or (C) are met. Where a release of records is specifically allowed under the PAIMI or DD acts, HIPAA does not bar disclosure since such records are produced based on the “as required by law” exception to HIPAA. If there is no probable cause, HIPAA would prohibit facilities from disclosing incident reports that contain protected health information without the authorization of the individual. The primary purpose of HIPAA’s Privacy Rule is to safeguard the privacy of medical protected health information. However, these incident reports contain information which can be helpful to P & A in monitoring compliance with patients’ rights and in determining whether there is probable cause to believe that abuse or neglect has occurred. The analysis of the release of the incident reports must take into account these different interests. The Court finds that the purpose of all statutes can be met by providing the incident reports to P & A with names and identifying information redacted. If P & A, after its review of the reports, determines there is probable cause to believe that a patient has been subject to abuse or neglect or that the health or safety of the individual is in serious or immediate jeopardy, it can make an appropriate request for more information. The State Hospital can then provide an unredacted report pursuant to 42 C.F.R. § 51.41(c)(2)(I): (2) Reports prepared by an agency charged with investigating abuse, neglect, or injury occurring at a facility rendering care or treatment, or by or for a facility itself, that describe any of the following: (i) Abuse, neglect or injury occurring at the facility. The State Training School can then provide an unredacted report pursuant to 45 C.F.R. § 1386.22(b): (2) Reports prepared by an agency charged with investigating incidents of abuse or neglect, injury or death occurring in the facility or while the individual with a developmental disability is under the care of a member of the staff of a facility, or by such a facility that describe any or all of the following: (i) Abuse, neglect, injury or death; P & A can then proceed with the requirements set forth in 42 U.S.C. § 10805(a)(4) and 42 U.S.C. § 15043(a)(2)(I) or (J). The Court specifically finds that this protocol for disclosing incident reports does not violate the HIPAA Privacy Rule or the Medicaid regulations on confidentiality. The DD Act at 42 U.S.C. § 15043(a)(2)(J) requires P & A to have access to records no later than three business days after it makes a written request, but that P & A shall have immediate access, no later than twenty-four hours after it makes a request without consent from another party, if P & A determines there is probable cause to believe the “health or safety of the individual is in serious or immediate jeopardy” or in any case of death of a person with a developmental disability. Neither the PAIMI Act nor its regulations establishes specific deadlines for production of records. The PAIMI regulations at 42 C.F.R. § 51.41(a) merely say, “[A]ccess to records shall be extended promptly to all authorized agents of a P & A system.” The Court finds that the parties may use the deadlines in the DD Act as a guideline for requests under the PAIMI Act, but, this approach should reflect a good faith analysis of the nature and extent of the *1221 request. A narrow request for a small number of records should not require the full three days allowed under DD Act, while a very broad and time intensive request should be allowed some leeway. The Court finds that the access agreement complies with the current and controlling law and will be the authoritative and enforceable document regarding P & A’s access to information and records at the State Hospital and State Training School until or unless the laws and controlling legal precedents change. If the relevant laws are amended, additional relevant laws are passed, or controlling case law deems any provision illegal, the parties will revise the access agreement accordingly. ORDER WHEREFORE, THE COURT ORDERS: 1. The HIPAA Privacy Rule does not bar the State Hospital or State Training School from disclosing “protected health information” without the authorization of the individual to P & A so long as the disclosure is required by a P & A act and P & A meets all requirements under the act. 2. The Medicaid confidentiality provision does not bar the State Hospital or State Training School from disclosing records to P & A so long as the disclosure is authorized by a P & A act and P & A meets all requirements under the act. 3. The process set forth in this Order and the Access Agreement shall govern the release of records to P & A subject to changes in applicable laws. 4. As the parties have resolved the main substantive issue in this case and have informed this Court that they no longer wish to pursue residual issues in this case, the Plaintiff’s case for retaliation is dismissed with prejudice and the Defendant’s claim for copying costs is dismissed with prejudice. 5.The above-captioned case is dismissed with prejudice and each party shall bear its own costs and fees. APPENDIX A ACCESS AGREEMENT BETWEEN WYOMING PROTECTION AND ADVOCACY SYSTEM, INC. AND THE WYOMING DEPARTMENT OF HEALTH, WYOMING STATE HOSPITAL AND WYOMING STATE TRAINING SCHOOL ACCESS AGREEMENT BETWEEN PROTECTION & ADVOCACY SYSTEM, INC. AND THE WYOMING STATE HOSPITAL AND WYOMING STATE TRAINING SCHOOL Preamble Protection and advocacy agencies are federally mandated to provide legal and other advocacy services on behalf of persons with disabilities, including persons with mental illness and persons with developmental disabilities. They are authorized to investigate potential abuse or neglect impacting such persons and to monitor their health and safety in both institutional and community settings. They are also authorized to pursue legal, administrative and other remedies and other approaches to ensure the protection of the rights of persons with disabilities. These authorities are conferred under federal statutes, including the Protection and Advocacy for Individuals with Mental Illness Act (“the PAIMI Act”), 42 U.S.C. § 10801 el seq., and its implementing regulations at 42 C.F.R. Part 51; the Developmental Disabilities Assistance and Bill of Rights Act of 2000, 42 U.S.C. § 15001 et. seq. and its implementing regulations at 45 C.F.R. Parts 1385 and 1386; and the Protection and Advocacy for Individual Rights Act, 29 U.S.C. § 794e and its implementing regulations at 34 C.F.R. Part 381. These stat *1222 utes will be referred to collectively as “the P & A acts.” The Wyoming State Hospital (“State Hospital”) is a state institution and is the only publicly funded, psychiatric inpatient facility in the state. The Wyoming State Training School (“State Training School”) is a state institution which opened originally as an inpatient facility for persons with developmental disabilities. It also provides support and services to persons who are dually diagnosed with developmental disabilities and mental illness. It also provides inpatient services for persons with traumatic brain injuries. Section 1: Introduction A. Parties to this Agreement: 1. Protection & Advocacy System, Inc. (“P & A”) is the protection and advocacy system which is designated by the State of Wyoming and authorized under federal law, including specifically the PAIMI, DD and PAIR acts, to protect and advocate for the legal and civil rights of persons with disabilities. 2. The Wyoming State Hospital is the state institution which offers inpatient psychiatric services. 3. The Wyoming State Training School is the state institution which offers inpatient services to persons with developmental disabilities, persons with a dual diagnosis of developmental disabilities and mental illness and persons with traumatic brain injury. B. Purposes of this Agreement: 1. Promote the mutual goal of protecting the human and legal rights of persons with disabilities. 2. Facilitate P & A’s access to the Wyoming State Hospital and Wyoming State Training School, their staff, patients, and to records to the fullest extent allowed under the P & A acts as they are currently formulated and as they may be amended from time to time by the United States Congress. C. Dissemination of Agreement: 1. The parties agree to disseminate copies of this agreement to their respective staff members. 2. The parties also agree to make copies of this agreement available, upon request, to persons with disabilities, their families, and the general public. D. Written Notice: Any time that a written notice is required pursuant to this Agreement, an e-mail or fax copy shall be sufficient. E. Notice to P & A: Notices to P & A shall be mailed to its Cheyenne office located at 320 West 25th Street, 2nd Floor, Cheyenne, WY 82001; by fax to (307) 638-0815; or by e-mail to wypanda@vcn.com. F. Notice to Facilities: Notice to the facilities shall be directed to the State Hospital at its Evanston mailing, fax or e-mail addresses and to the State Training School at its Lander mailing, fax or e-mail addresses. Section 2: Access to Facilities, Clients, Patients, and Staff A. Access to Facilities: 1. P & A shall have reasonable access to the Wyoming State Hospital and to the Wyoming State Training School (hereinafter “facilities”). P & A shall have access to investigate when it has received a report or complaint; when it has probable cause to believe that abuse or neglect has occurred; or when it determines there is or may be imminent *1223 danger of abuse or neglect. No advance notice is required under this paragraph. a) “Reasonable access” shall be defined as access between the hours of 8:00 a.m. and 5:00 p.m., Monday through Friday, or during the regular business hours of the facility, or such other times as may be necessary to correct or prevent an instance of serious abuse or neglect. b) “Reasonable access” also means unaccompanied access to those areas of the facility, to facility staff and clients as may be involved in the incident or threatened incident of abuse or neglect. c) Such access shall be afforded upon request by the P & A system when: (1) An incident is reported or a complaint is made to the P & A system; (2) The P & A system determines there is probable cause to believe that an incident has or may have occurred; or (3) The P & A system determines that there is or may be imminent danger of serious abuse or neglect to a patient in the facility. 2.P & A shall also have reasonable unaccompanied access to the facilities to provide information and training on and referrals to programs addressing the needs of persons with disabilities; to provide information and training on individual rights and on P & A services; and to monitor compliance with respect to the rights and safety of patients, subject to the limitations in paragraph 2.C.3 below. Except in the case of an emergency, P & A shall make its requests in writing, not less than two business days prior to the intended visit. B. Arrival and Departure: P & A staff will check in with the facility superintendent or designee upon arrival and departure. Any time they enter the facility pursuant to this Agreement, P & A staff shall present identification sufficient to verify that they are currently affiliated with P & A. The facility may provide an identification tag for P & A staff. C. On Premises: 1. P & A staff will not interfere with any patient’s treatment and will honor a patient’s right to speak privately and the patient’s right to terminate any interview. 2. If requested, the facility shall provide a private place for P & A staff to meet with a patient. 3. When P & A is conducting an investigation of abuse or neglect or monitoring, it shall have unaccompanied access to interview facility staff, except when a facility staff member asks to terminate the interview or asks that the superintendent of the facility or his/her designee be present. 4. When it is not conducting an investigation or monitoring, P & A shall notify the superintendent or his/her designee prior to interviewing any staff regarding patient issues, concerns and problems, and the superintendent or his/her designee may be present during the interview. 5. P & A staff may accompany a patient to any meeting in which the patient may participate, if the patient or his/her guardian so requests and if P & A staff believe it is in the best interests of the patient. *1224 Section 3: Access to Records A. Statutory Authorization for Access: 1. In accordance with current federal law, and as that law may be amended from time to time by the United States Congress, facilities shall provide P & A with access to the records of any of the following individuals with mental illness: a. an individual if authorized by that individual or the legal guardian, conservator or other legal representative; b. an individual, including an individual who has died or whose whereabouts are unknown, to whom all of the following conditions apply: (1) the individual because of his/her mental or physical condition is unable to authorize P & A to have access; (2) the individual does not have a legal guardian, conservator or other legal representative, or the individual’s guardian is the State or one of its political subdivisions; and (3) P & A has received a report or complaint and has determined that there is probable cause to believe the individual has been or may be subject to abuse or neglect; c. an individual who has a legal guardian, conservator or other legal representative whenever all of the following conditions exist: (1) P & A has received a complaint or report or has determined there is probable cause to believe the health or safety of the individual is in serious and immediate jeopardy; (2) P & A has made a good faith effort to contact the representative upon prompt receipt of the representative’s name and address; (3) P & A has made a good faith effort to offer assistance to the representative to resolve the situation; and (4)the representative has failed or refused to act on behalf of the individual. 2. In accordance with current federal law, and as that law may be amended from time to time by the United States Congress, facilities shall provide P & A with access to the records of any of the following individuals with developmental disabilities or individuals who qualify for P & A services under the PAIR Act: a. an individual if authorized by that individual or the legal guardian, conservator or other legal representative; b. An individual in a situation in which— (1) the individual, by reason of such individual’s mental or physical condition, is unable to authorize the system to have such access; (2) the individual does not have a legal guardian, conservator, or other legal representative, or the legal guardian is the State; and (3) P & A has received a complaint regarding the status or treatment of the individual or, as a result of monitoring and other activities, P & A has determined there is probable cause to believe that such person has been subject to abuse or neglect; and c. an individual in a situation in which— (1) the individual has a legal guardian, conservator or other legal representative; (2) P & A has received a complaint regarding the status or treatment of the individual or, as a result of monitoring and other activities, P & A has determined there is probable *1225 cause to believe such individual has been subject to abuse or neglect; (3) P & A has made a good faith effort to contact the representative upon prompt receipt of the representative’s name and address; (4) P & A has offered assistance to the representative to resolve the situation; and (5) the representative has failed or refused to act on behalf of the individual. B. Deadlines 1.P & A shall have access to records referred to in paragraphs 3.A.2 within three business days after it makes a written request, except that P & A shall have immediate access, not later than 24 hours after it makes such a request without consent from another party if P & A determines that there is probable cause to believe that the health or safety of a patient is in serious and immediate jeopardy, or in any case of the death of a patient. The facilities will use the deadlines in the DD Act as a guideline for requests under the PAIMI Act, but this approach should reflect a good faith analysis of the nature and extent of the request. A narrow request for a small number of records should not require the full three days allowed under the DD Act, while a very broad and time intensive request should be allowed some leeway. C. Procedure for Requesting Records: 1.In order to access records, P & A will make a written request to the facility superintendent or his/her designee, which request shall reasonably identify the patient and/or institutional records being sought. The written request will only be issued after P & A complies with the criteria in the P & A acts, as set forth in sections 3.A.1 or 3.A.2. 2. When P & A asks the facility whether the patient has a guardian, conservator or legal representative and/or P & A asks for the name, address and telephone number of the guardian, conservator, or legal representative, the facility shall provide the information by telephone, in writing, in electronic form, or in person, whichever is the most prompt and efficient manner, but in no event later than two business days of the receipt of P & A’s request. If the facility does not have the requested guardian contact information, it will so notify P & A within the two business days deadline. D.On-Site Review: 1. P & A will have reasonable access to review records on site, in accordance with the criteria set forth in sections 3.A.1 and 3.A.2. Under no circumstances will P & A remove any part of the original record or make any changes to it. 2. P & A will maintain the confidentiality of such records to the same extent as required of the facilities by the laws of both the State of Wyoming and the United States of America. 3. At the same time access to records is granted, the mental health professional responsible for supervising mental health services to the patient may give P & A a written determination that the disclosure of the information to the patient would be detrimental to the patient’s health. In that case, in accordance with federal regulations, P & A will not disclose the information to the patient unless another mental health professional determines that disclosure would not be detrimental to the patient’s health. *1226 4. The facilities will provide space for P & A to set up its own copier or scanner on site. Facilities will not charge P & A for the space they provide or for copies made on P & A’s copier or scanner. In those instances in which P & A uses the facility copier, P & A will pay five cents a page. 5. If the facility denies access to records, the facility superintendent or designee will give P & A a written explanation for the denial. The written explanation shall be provided to P & A within two business days after the expiration of the deadline for the release of records, as established in Section 3.B above. E. Incident Reports: 1.On a regular basis, the facilities will give P & A copies of all incident reports, with the patient’s name redacted. After reviewing the redacted incident reports, P & A may determine that probable cause exists to investigate. If so, P & A will request a copy of the unredacted report in order to obtain the patient’s name. At that time, the facility will also give P & A contact information for the patient or for the patient’s guardian, conservator or legal representative. Section 4: Cooperative Efforts A.Information on Contacting P & A: 1. The facilities agree to distribute and post P & A informational brochures and other written materials on its services, activities, and scheduled events. 2. P & A will pay for and provide informational material on its programs for distribution to patients, family members, guardians and other legally authorized representatives of patients. 3.The facilities agree to post the toll free P & A telephone number near each public telephone in its facility. B. Policies and Procedures Made Available: Upon request, P & A will provide the facility with a copy of its policies and procedures formulated pursuant to P & A statutes and regulations. Upon request, the facilities will provide P & A with copies of their policies and procedures. C. Training Sessions on Client Rights: 1. The facilities will schedule periodic meetings at the facility for P & A to present training sessions on client rights and responsibilities and to hear patient concerns. Facility staff may attend the classes. 2. As its resources allow, P & A may also train facility staff on client rights and responsibilities and may sponsor educational seminars by experts in the field. D. Training Sessions on the Access Agreement: 1. The parties may sponsor joint training sessions on this Access Agreement to be attended by both P & A and facility staff. E. Dispute Resolution: The parties mutually agree to resolve disputes whenever possible through non-adversarial means, including negotiation, mediation or conciliation. Any complaint will be immediately brought to the attention of the facility superintendent and the executive director of P & A to resolve as expeditiously and informally as possible and at the lowest appropriate level. If they cannot resolve the dis *1227 pute, it will be referred to the Director of the Wyoming Department of Health. If the dispute is not resolved within a reasonable time, the parties may pursue other remedies. Section 5: Modification of Agreement This Agreement is effective from the date of the last signature, and it may at any time be amended by mutual written agreement signed by the parties. Signed this Uh day of January 2006. PROTECTION & ADVOCACY SYSTEM, INC. By: Jeanne A. Thobro Executive Director Signed this 5th day of January 2006. WYOMING DEPARTMENT OF HEALTH By: Brent D. Sherard M.D. Director APPROVED AS TO FORM: Patrick J. Crank Attorney General By: Misha Westby Senior Assistant Attorney General By:Kathleen M. Karpan Attorney for Protection & Advocacy System, Inc.