Hipaa Laws: Do They Apply To Sober Living Environments?

Confidentiality is a major concern for people seeking treatment for drug and alcohol addiction. Many worry about the impact that going to rehab could have on their future job prospects, and some are afraid of what their friends and family might think. Fortunately, there are laws in place to protect the privacy of those in recovery. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that protects sensitive patient health information from being shared without a patient's consent or knowledge. This includes a patient's current health status, where they are receiving care, how they paid for their care, and what kind of care they are receiving. But do these laws apply to sober living homes?

What is a covered entity?

A covered entity is an individual, business, or agency that is subject to HIPAA laws. Covered entities are required to comply with the Rules' requirements to protect the privacy and security of health information and provide individuals with certain rights regarding their health information.

Covered entities are defined in the HIPAA rules as:

• Health plans
• Health care clearinghouses
• Health care providers

However, not all health care providers are considered covered entities. To be a covered entity, a health care provider must electronically transmit any health information in connection with transactions for which the U.S. Department of Health and Human Services (HHS) has adopted standards. These transactions typically concern billing and payment for services or insurance coverage. For example, hospitals, academic medical centers, physicians, and other health care providers who electronically transmit claims transaction information directly or through an intermediary to a health plan are covered entities.

Covered entities can be institutions, organizations, or persons. Any single legal entity may elect to be a hybrid entity if it performs both covered and noncovered functions as part of its business operations. In such cases, the covered entity must designate the health care components within its organization.

If a covered entity engages a business associate to help carry out its health care activities, it must have a written contract or arrangement that establishes the specific tasks the business associate has been engaged to do and requires them to comply with the Rules' requirements to protect the privacy and security of protected health information.

Examples of business associates include:

• Third-party administrators that assist with claims processing
• Consultants that perform utilization reviews
• Health care clearinghouses that translate claims from a non-standard format into a standard transaction
• Independent medical transcriptionists that provide transcription services to physicians

What is PHI?

PHI stands for Protected Health Information. It is any information in the medical record or designated record set that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service such as diagnosis or treatment.

PHI is protected by the HIPAA Privacy Rule, which provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information. Covered entities include health plans, health care clearinghouses, and healthcare providers that conduct electronic transactions for which the Department of Health and Human Services (HHS) has published standards.

PHI includes an individual's health, treatment, or payment for treatment information, as well as any information maintained in the same data set that could identify the individual. This can include demographic information such as names, addresses, dates, phone numbers, email addresses, social security numbers, medical record numbers, health plan beneficiary numbers, and more.

It's important to note that not all healthcare providers are subject to HIPAA, and there may be variations in how PHI is defined and protected under state privacy regulations.

Do sober living homes provide treatment?

Sober living homes provide a safe, sober environment for people in recovery to transition back into their community using their recovery skills. They are different from halfway houses, which are transitional living spaces for people who have been incarcerated. Choosing to stay in a sober living home is often a voluntary decision made by someone who is transitioning from an inpatient treatment setting or for a person in the community who may be struggling with continued sobriety and would benefit from a sober environment to avoid the chance of relapse.

There are four levels of sober living:

• Level 1: Fully peer-run
• Level 2: Monitored with at least one paid staff
• Level 3: Supervised with certified staff
• Level 4: Clinical and administrative supervision with credentialed staff

The level of structure and monitoring varies across these levels. Level 1 sober living homes, for example, have little structure and monitoring and are often run by a peer in long-term recovery. In contrast, level 4 sober living homes have the most structure and monitoring, with staff with credentials offering on-site clinical services.

Regardless of the level, sober living homes provide a strong support network and community to help residents navigate triggers and tough spots they may encounter. They also provide residents with the time and space to practice living a sober lifestyle and develop new habits and routines. Residents are expected to attend 12-step programs, create sober fellowships, foster positive friendships, and undergo drug screenings, among other things.

Research shows that sober living homes produce positive outcomes. A study in the Alcohol Treatment Quarterly journal found that residents of sober living homes exhibited abstinence at the 18-month follow-up, improvements in mental health, higher employment rates, reduction in substance misuse, higher self-confidence, and increases in support group attendance.

How do HIPAA laws interact with the Florida model of addiction treatment?

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law that protects sensitive patient health information from being shared without a patient's consent or knowledge. Under HIPAA, a "covered entity" refers to a health care provider that "furnishes, bills or receives payment" for health care and sends "covered transactions" electronically.

HIPAA laws apply to addiction treatment centers, which must adhere to the legislation closely. Sober living homes, on the other hand, have more flexibility regarding resident privacy. If a sober living home only bills for room and board, it may not be considered a "covered entity" and thus may not be subject to HIPAA laws. However, if the sober living home provides and bills for addiction treatment counselling, coordinates care with other healthcare providers, or bills public or private health insurance providers for services, it may be considered a "covered entity" and fall under HIPAA regulations.

The Florida model of addiction treatment involves business owners operating both a sober living home and an addiction treatment facility. Patients typically reside in the sober living home at night and attend outpatient programs at the treatment facility during the day. The patient's insurance is billed for the day treatment, while the resident or their family is responsible for room and board payments at the sober living home.

In the context of the Florida model, the interaction between HIPAA laws and sober living homes becomes more intricate. The determining factor is often how the sober living home business is structured in relation to the addiction treatment business. Florida model operators should consult legal experts to clarify how HIPAA laws apply to their specific circumstances.

Overall, the interaction between HIPAA laws and the Florida model of addiction treatment is complex and dependent on the specific details of each case. Operators of sober living homes and addiction treatment facilities in Florida must carefully consider their business structures and seek legal advice to ensure compliance with HIPAA regulations and protect resident privacy.

What are some ways sober living homes violate HIPAA laws?

Whether or not HIPAA laws apply to sober living homes depends on whether the home is considered a "covered entity". A "covered entity" is defined as a health care provider that "furnishes, bills or receives payment" for health care and sends "covered transactions" electronically.

Sober living homes that only bill for room and board—things that are not typically considered "health care"—may not be subject to HIPAA laws. However, if a sober living home provides and bills for addiction treatment counselling, coordinates care with other healthcare providers, or bills public or private health insurance providers for services, it may be considered a "covered entity" and therefore subject to HIPAA laws.

• Transmitting Protected Health Information (PHI) to a third party without the resident's written consent. PHI includes a person's demographics, health status, where they received care, and how they paid for their care.
• Including PHI in a non-encrypted email to a patient or a patient's family.
• Confirming or denying a resident's occupancy at the sober living home to a MAT program's admissions department.
• Releasing PHI to government agencies or community groups to prove the disability status of residents to invoke FHA protections for the sober living home.

Frequently asked questions