Privacy Concerns

According the Recovery Navigator Uniform Program Standards under Confidentiality and Privacy:

Information shall be shared in a way that protects individuals’ confidentiality rights as service and treatment consumers and constitutional rights if involved in legal processes. During Outreach or field-based engagement, a Release of Information (ROI) to share Personal Health Information and identifying data is not necessary to establish relationship. A Consent to Participate is required prior to sharing any identifiable data with the State of Washington Health Care Authority.

If a client does not sign a consent, only non-identifiable data may be shared. The enrolled client needs to have a ROI in place to coordinate services between the Recovery Navigator Program and other agencies providing services.

The Confidentiality Policy is applied to all interactions between individuals, Recovery Navigator personnel and partners.

There are two items to keep in mind when it comes to personal health information (PHI):

Both of these are important and must comply with the Health Insurance Portability and Accountability Act (HIPAA).

For instance, using email to send PHI could run afoul of HIPAA compliance given requirements that data sharing must be end-to-end encrypted and encrypted at rest (backups, storage, etc), as well has made sure security controls only allow access to the proper entities. Sometimes, companies will need to get a Business Associate Agreement when utilizing email services if they will be sharing PHI over said email system. Given that it can be difficult for email systems to meet these requirements, especially when sent to other networks, it can be a HIPAA risk if used improperly.

According to HIPAA Guide:

PHI can be sent via email provided the disclosure is permitted by the Privacy Rule, safeguards are implemented to comply with the Security Rule, and – if the email service is provided by a third party – that a Business Associate Agreement exists with the third party.

Emails can lead to HIPAA violations if they are sent to unauthorized persons, if PHI is disclosed in the email impermissibly, or if an individual is contacted by email after requesting confidential communications via a different channel of communication.

HIPAA compliancy is notoriously difficult and can cause issues for any organization dealing in PHI. Many organizations utilize a portal that meets HIPAA compliancy while allowing appropriate access to the proper parties.

LEAD Program Privacy & Confidentiality

Remember, the Recovery Navigator Program is modeled after the Law Enforcement Assisted Diversion (LEAD) program. There are important differences regarding purpose and scope to keep in mind, but structurally, the programs are the same.

According to the LEAD Bureau:

But when it comes to sharing sensitive information through the use of a multi-party ROI, it is common for LEAD sites to struggle a bit in both theory and practice. Typically, many of the agencies central to LEAD are accustomed to carefully protecting access to the information they gather. Many stakeholders may believe that sharing such information is prohibited by law; others may feel that sharing sensitive information about LEAD participants risks causing them harm.

Emphasis mine:

Many people may fear that sharing information this way violates federal privacy laws, such as HIPAA and the Code of Federal Regulations 42, Part 2 (42 CFR, Part 2). In fact, even though 42 CFR, Part 2 is more restrictive than HIPAA, it nonetheless explicitly permits care providers to share information with other entities for the purposes of care coordination with the participants’ permission.

The fact that a multi-party ROI allows people to share information doesn’t mean people should share every kind of information in every circumstance. Any sharing should be purposeful and intentional, and carefully thought through.

The LEAD First Golden Rule

One of LEAD’s two Golden Rules is that no participant can be worse off because of LEAD. For example, LEAD can do no harm as a result of a participant sharing information with their case manager or a case manager appropriately sharing information with police and prosecutors.

Courts and probation departments cannot substantively supervise the individual progress of the participant. Case managers can confirm that they are working with the individual, can share information about progress pursuant to the multi-party ROI, can share information about barriers and resource limitations, and can help court and probation gain insight about prospects for further progress and interim goals. However, they should not provide any specific information that would or could prompt enforcement or revocation steps. They should at all times be truthful and not create a false impression, but rather than provide specific information about any law violations or problematic activity, the case manager should inform the court that “there is nothing helpful to report at this time.”

So, when an individual decides to engage with RNP, they will sign a multi-party ROI that allows the coordination of their care with other services. This also allows the OWG and PCG to discuss certain aspects of their situation. However, it is not carte blanche access to case management information. Remember, the first golden rule mentions that data sharing is "for the purposes of care coordination".

Monthly Reporting on PHI, Referrals, and Data Sharing

The monthly reports indicate that several of the following issues had been concerns during the Recovery Navigator Program:

The following are some notes found in the monthly reporting (emphasis mine):

July 2022

Met with Gather (Cole) and Great Rivers after OWG to talk about data sharing and options. Also focused on how OWG should be ran, preparing for the policies and procedures to be approved and then how to start enrolling individuals into RNP.

I am not clear about how multi-agency care coordination is occurring. Access to data and referral sources is not available. At this time, we are still working with law enforcement to set up how to refer.

December 2022

One of the barriers the PCG brought up is the Oath of Confidentiality that we use in the OWG. The PCG was concern that it gets agencies in a lot of trouble. The Oath of Confidentiality is not valid, and a ROI can create barriers.

January 2023

There continues to be a concern regarding confidentiality and information shared in the OWG. It has been remarked that too much information is being shared without an ROI and without a Quality Service Agreement in place the Oath will not continue to work. This will limit the ability to share information for coordination.

March 2023

3.28.23—Met with Chief Denham per his request. He verbalized he did not like the new OWG agenda, not being able to see the names and only getting initials. Explained the HIPPA/42CFR Part 2 and the reasons for why we had to switch up the agenda. Continued to encourage participation and verbalized successes that we have had in the last few weeks. Chief Denham continues to verbalize hesitation about program and how it is working. Providing education and managing expectations supports building trust, listening and fostering continued participation/collaboration.

HIPAA and 42 CFR Part 2

The above monthly reports touches on 42 CFR Part 2 which is a more restrictive federal policy regarding PHI in consideration of those being treated for Substance Use Disorder (SUD):

The regulations at 42 CFR part 2 (“Part 2”) protect the confidentiality of substance use disorder (SUD) treatment records. Part 2 protects “records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.” Confidentiality protections help address concerns that discrimination and fear of prosecution deter people from entering treatment for SUD.

My Discovery

As I was compiling data for this report, I ended up reviewing older documents that I had received via several public disclosure requests (PDRs) awhile before. At the time of those requests, I was interested in a different, albeit related, topic. Looking back through those PDRs, I found that I had incidentally snagged several documents that directly related to the Recovery Navigator Program as operated in Lewis County.

More concerning, I discovered that the following information regarding RNP clients had been shared over email to a wide audience of recepients, many of whom fell under jurisdictions where the data could be publicly disclosable:

In another email to Police Chief Stacy Denham, I found details on individuals (including a birth date) who had received a referral from Centralia Police Department.

In all cases, the documents were distributed by RNP Project Management (Cascade Community Healthcare).

While an argument could be made that this information should have been witheld by the municipality fulfilling the public disclosure request, I think there's a bigger issue at play here with how PHI is being handled altogether.

My Concerns

Remember, there are two aspects to this whole thing: HOW and HOW MUCH. One covers the means of distribution that needs to be HIPAA compliant and the other covers how much detail about clients to share with RNP stakeholders. The LEAD program specifically states that sharing of information should be "for the purposes of care coordination". Even if it could be determined that law enforcement should have access to this information, there were multiple recipients of this PHI that I find hard to justify from a care coordination perspective including but not limited to Lewis County Commissioners, The Salvation Army, Chehalis Tribe, etc.

While some of these recipients operate services where there should obviously be coordination of care, I can't imagine all parties should receive information on all participants as was widely disseminated.

Reviewing the monthly reports and Centralia Police Chief Stacy Denham's own testimony, data sharing stands out as a very particular source of frustration. The question now seems to me, was Gather Church refusing to share information or simply following legal requirements and not sharing the data over improper channels and not sharing more than is permitted by the program and law?

I want to take a moment to focus on Denham and a statement he made in his recorded testimony at the BOCC Wrap-Up Meeting:

There's been several meetings with Gather where people have asked for stats. They need statistics. They need to know where people are at, what they're doing. Maybe not even so much where they're at or what they're doing to violate HIPAA, but just give stats, stats or not. And there was excuses.

This is a very interesting statement from Denham for several reasons:

  1. The Uniform Program Standards for RNP specifically indicates that project management "Facilitates data collection, data reporting, and program evaluation efforts". And who is the project management for RNP? Cascade Community Healthcare. NOT Gather Church.
  2. In fact, one responsibility of Gather Church according to their role in RNP was "Collect and provide data points related to the individuals referred to the program and provides data to the Project Manager." The wording is a little clunky but in short, Gather collects and provides the data to the project manager, who then facilitates reporting.
  3. I find it striking that a stakeholder (Denham) who sat in both OWGs and PCGs for the Recovery Navigator Program apparently didn't understand whose responsibility it was to provide said stats AND
  4. Apparently didn't utilize the provided opportunities of being a part of the OWG and PCG to specifically work this issue out with all parties present

It only gets more confusing when one notes that he had been receiving stats and RNP client information from project management. This is literally the data I stumbled across in my former PDRs.

Furthermore, I, a simple man of simple means, a private citizen, someone not involved in the OWG and PCG for RNP, was able to procure RNP data directly through Great Rivers by simply asking for it. How is it that Denham seemed to lay all of this at the feet of Gather Church when he operated as a stakeholder within a program that had multiple avenues of resources that could provide him the necessary data including but not limited to just asking Great Rivers?

It's hard to understand Denham's frustration here. On one hand, I've found that data sharing in fact did occur, too much I would argue. On the other hand, Denham is publicly denouncing Gather Church for something that is arguably not their responsibility.

I understand that a certain amount of data sharing is required for the program to function. My concern is that the data sharing for Recovery Navigator Program might have exceeded that which is needed to coordinate care, especially considering law enforcement and politician access, and that so many of the political players in this situation may have felt they had a right to case management data under the guise of "accountability".

Conclusion

In short, I have concerns that the Recovery Navigator Program as operated in Lewis County may have been providing too much PHI to too many parties over systems with too little discretion. Furthermore, I feel that Centralia Police Chief Stacy Denham either willingly or mistakenly misrepresented the responsbilities of RNP in a public meeting in an effort to have Gather Church's contract removed.

Similar to my conclusions found in the Political Concerns part of the report, I can't help but wonder what Great Rivers was doing during all of this? As the entity entrusted with oversight of RNP, and supposedly receiving the monthly reports filed by the project manager, that issues continued to be ongoing indicates they were also perhaps not being addressed.

Postscript: Cascade and Gather

Admittedly, the following is going to be entirely speculative on my part and can be dismissed as much. Caveat emptor. Having said that, there did seem to be something of a recurring theme with Cascade Community Healthcare if one is willing to read between the lines a bit.

Going back to the KELA interview with Chad Taylor and Sean Swope, in one of the many accusations Commissioner Swope makes, he says the following:

"So we've got a person now that works in our jails that, uh, that, that helped to get people well, that go through the jail system. And something that is very concerning is that when they talk to people that are addicts that are going through, that we're helping to hopefully by the time they get out of jail, that they are clean and ready to start on a new, new path forward. But they keep saying things like this, that intensive outpatient... something a service that Gather has been telling these people that they offer just to hold on, hold on. They're getting paid for this service, but they're telling them, hold on, hold on. We're still trying to get it together. They're collecting money for this, but they're keeping people in a state of addiction and not really getting them services while getting paid for services. And this isn't, this, this conversation hasn't just been had with one or two people, but we're talking about six plus people that have said the same thing that have gone through the jail that have an, uh, addiction problem that has been at Blakeslee junction or is in a homeless situation that has gone through."

Now, I've already addressed these accusations both in a previous episode on the topic and under Political Concerns so I'm not going to re-hash that but I would like to draw attention to the unamed source that is apparently providing Commissioner Swope with information. The quote indicates they are someone who works in the jail at some capacity and has interaction with those who are dealing with addiction. Given that Cascade Community Healthcare provides medically assisted treatment (MAT) services at the jail, I don't think it would be stretch to assume that the source works for Cascade Community Healthcare.

If I'm correct, this could indicate an interesting point of collusion. Not only is Swope receiving apparent information regarding inmates, he's receiving enough detail to know that that they are somehow being promised and billed for services not rendered (a service by the way that Gather still does not offer). I'd just like to remind my audience that it has been over a year since all of these accusations were made and to date, nothing has happened that would validate the veracity of these claims.

Now let's turn our attention to some comments that Denham made during his specially recorded testimony:

So there's other issues that have also come up, and a lot of it deals with the intensive outpatient program... A person approached me that is in the know, and they don't want to be acknowledged, and so I'm going to apologize for that, that they have known four people that were directed to go to intensive outpatient services. They went to Great, or to Gather Church, and requested some assistance to get to that point. At that time, they were told, "Wait, just hold on. We're almost there... our program's almost up and running. We're looking at it ourselves."

Again, I'm not quite sure why that would be happening, because one, currently, Gather Church doesn't have an outpatient, intensive outpatient program. So why would they be put on hold? If they need it, they need it now. Their job is to navigate people to locations, not back to themselves.

A person can find a lot of similarities between the information shared by Commissioner Swope and Denham. In fact, I think this gives perhaps more weight to the inference that both are receiving their information from someone at Cascade.

If I'm right, we now have two points of collusion between Cascade and certain officials. It gets a little weirder as Denham goes on:

Another interesting thing is, why has Cascade Mental Health never received one referral?

This is not only a huge claim, it doesn't seem to be something the Police Chief of Centralia would know on their own. How does Denham know this? How could he know this? Given his misunderstanding of the basics of RNP data reporting, is there a reason this should be accepted as is without some proof? My argument is no but that isn't even my point. I assume he received this information from the source I likely think is at Cascade but there's perhaps another avenue he may have received it from: RNP Project Management. Who would be, by the way, an employee of Cascade.

It's also interesting to note that a referral as mentioned here would not be a RNP referral into the program but most likely a referral that would come from an individual's case management. Something LE arguably shouldn't have knowledge of.

Is it that everybody that's ever been part of Recovery Navigator does not need mental health services? I don't think that's the case. Not to mention that Cascade Mental Health also has a substance use program where you can actually check somebody into there so they can detox.

That has never happened. So again, I ask, why is it these things continue to happen? And the answer I keep coming back to is, I don't know. I don't know why they're not happening.

I have a very direct view of certain things that happen. And of course, again, there's HIPAA laws that we have to follow, and I respect that.

My point here is not to adjudicate the truth of these statements (but I do find them dubious). What I'm finding here appears to be a strong indication that there may have been some ongoing collusion between Cascade, Swope, and Denham. Given that Cascade functioned as the project management of RNP, and later requested Denham's support in applying for the contract that had been removed from Gather, I think it could raise the question of whether the Recovery Navigator Project Manager, Cascade Community Healthcare, was working in good faith with Gather Church.

Perhaps this collusion (as conjectured) is a by-product of the fact that Cascade Community Healthcare receives a significant amount of money in contracted services from Lewis County and it ultimately benefits them to engage in this behavior on behalf of those who have a lot of control over their contracts.

When you also consider that several Cascade representatives publicly supported Commissioner Swope's ordinance regarding syringe service programs, an ordinance that is at odds with best practices in the field, it could indicate a deep animus (or something like that) exists on behalf of Cascade towards Gather Church.

Like I said, this is speculation. Take it or leave it.