HIV/AIDs - Page 2


Counseling the HIV client Despite substantial advances in the treatment of human immunodeficiency virus (HIV) infection, the estimated number of annual new HIV infections in the United States has remained at 40,000 for over 10 years. HIV prevention in this country has largely focused on persons who are not HIV infected, to help them avoid becoming infected. However, further reduction of HIV transmission will require new strategies, including increased emphasis on preventing transmission by HIV-infected persons. HIV-infected persons who are aware of their HIV infection tend to reduce behaviors that might transmit HIV to others. Nonetheless, recent reports suggest that such behavioral changes often are not maintained and that a substantial number of HIV-infected persons continue to engage in behaviors that place others at risk for HIV infection .

Reversion to risky sexual behavior might be as important in HIV transmission as failure to adopt safer sexual behavior immediately after receiving a diagnosis of HIV. Unprotected anal sex appears to be occurring more frequently in some urban centers, particularly among young men who have sex with men (MSM). Bacterial and viral sexually transmitted diseases (STDs) in HIV-infected men and women receiving outpatient care have been increasingly noted, indicating ongoing risky behaviors and opportunities for HIV transmission. Further, despite declining syphilis prevalence in the general U.S. population, sustained outbreaks of syphilis among MSM, many of whom are HIV infected, continue to occur in some areas; rates of gonorrhea and chlamydial infection have also risen for this population . Rising STD rates among MSM indicate increased potential for HIV transmission, both because these rates suggest ongoing risky behavior and because STDs have a synergistic effect on HIV infectivity and susceptibility. Studies suggest that optimism about the effectiveness of highly active antiretroviral therapy (HAART) for HIV may be contributing to relaxed attitudes toward safer sex practices and increased sexual risk-taking by some HIV-infected persons.

Injection drug use also continues to play a key role in the HIV epidemic; at least 28% of AIDS cases among adults and adolescents with known HIV risk category reported to CDC in 2000 were associated with injection drug use. In some large drug-using communities, HIV seroincidence and seroprevalence among injection drug users (IDUs) have declined in recent years. This decline has been attributed to several factors, including increased use of sterile injection equipment, declines in needle-sharing, shifts from injection to noninjection methods of using drugs, and cessation of drug use (31--33). However, injection-drug use among young adult with sexual behaviors, changes to less risky behaviors may be difficult to sustain.

Clinicians providing medical care to HIV-infected persons can play a key role in helping their patients reduce risk behaviors and maintain safer practices and can do so with a feasible level of effort, even in constrained practice settings. Clinicians can greatly affect patients' risks for transmission of HIV to others by performing a brief screening for HIV transmission risk behaviors; communicating prevention messages; discussing sexual and drug-use behavior; positively reinforcing changes to safer behavior; referring patients for such services as substance abuse treatment; facilitating partner notification, counseling, and testing; and identifying and treating other STDs. These measures may also decrease patients' risks of acquiring other STDs and bloodborne infections (e.g., viral hepatitis). Managed care plans can play an important role in HIV prevention by incorporating these recommendations into their practice guidelines, educating their providers and enrollees, and providing condoms and educational materials. In the context of care, prevention services might be delivered in clinic or office environments or through referral to community-based programs. Some clinicians have expressed concern that reimbursement is often not provided for prevention services and note that improving reimbursement for such services might enhance the adoption and implementation of these guidelines.

This report provides general recommendations for incorporating HIV prevention into the medical care of all HIV-infected adolescents and adults, regardless of age, sex, or race/ethnicity. The recommendations are intended for all persons who provide medical care to HIV-infected persons (e.g., physicians, nurse practitioners, nurses, physician assistants). They may also be useful to those who deliver prevention messages (e.g., case managers, social workers, health educators). Special considerations may be needed for some subgroups (e.g., adolescents, for whom laws and regulations might exist governing providing of services to minors, the need to obtain parental consent, or duty to inform). However, it is beyond the scope of this report to address special considerations of subgroups. Furthermore, the recommendations focus on sexual and drug-injection behaviors, since these behaviors are responsible for nearly all HIV transmission in the United States. Separate guidelines have been published for preventing perinatal transmission.

These recommendations were developed by using an evidence-based approach. The strength of each recommendation is indicated on a scale of A (strongest recommendation for) to E (recommendation against); the quality of available evidence supporting the recommendation is indicated on a scale of I (strongest evidence for) to III (weakest evidence for), and the outcome for which the recommendation is rated is provided. The recommendations are categorized into three major components: 1) screening for HIV transmission risk behaviors and STDs, 2) providing brief behavioral risk-reduction interventions in the office setting and referring selected patients for additional prevention interventions and other related services, and 3) facilitating notification and counseling of sex and needle-sharing partners of infected persons.

This report was developed by CDC, the Health Resources and Services Administration (HRSA), the National Institutes of Health (NIH), and the HIV Medicine Association (HIVMA) of the Infectious Diseases Society of America (IDSA). The recommendations will evolve as results from ongoing behavioral intervention trials become available.

Risk Screening

Risk screening is a brief assessment of behavioral and clinical factors associated with transmission of HIV and other STDs.  Risk screening can be used to identify patients who should receive more in-depth risk assessment and HIV risk-reduction counseling, other risk-reduction interventions, or referral for other services (e.g., substance abuse treatment). Risk screening identifies patients at greatest risk for transmitting HIV so that prevention and referral recommendations can be focused on these patients. Screening methods include probing for behaviors associated with transmission of HIV and other STDs, eliciting patient reports of symptoms of other STDs, and laboratory testing for other STDs. Although each of these methods has limitations, a combination of methods should increase the sensitivity and effectiveness of screening. In conducting risk screening, clinicians should recognize that risk is not static. Patients' lives and circumstances change, and a patient's risk of transmitting HIV may change from one medical encounter to another. Also, clinicians should recognize that working with adolescents may require special approaches and should be aware of and adhere to all laws and regulations related to providing services to minors.

Screening for Behavioral Risk Factors

Clinicians frequently believe that patients are uncomfortable disclosing personal risks and hesitant to respond to questions about sensitive issues, such as sexual behaviors and illicit drug use. However, available evidence suggests that patients, when asked, will often disclose their risks and that some patients have reported greater confidence in their clinician's ability to provide high-quality care if asked about sexual and STD history during the initial visits.

Screening for behavioral risk factors can be done with brief self-administered written questionnaires; computer-, audio-, and video-assisted questionnaires; structured face-to-face interviews; and personalized discussions. Screening questions can be either open-ended or closed (directed)). Use of open-ended questions avoids simple "yes" or "no" responses and encourages patients to discuss personal risks and the circumstances in which risks occur. Open-ended questions also help the clinician gather enough detail to understand potential transmission risks and make more meaningful recommendations. However, although well received by patients, the open-ended approach may initially be difficult for clinicians schooled in directed questioning, who tend to prefer directed screening questions. Directed questions are probably useful for identifying patients with problems that should be more thoroughly discussed. Among directed approaches, technical tools like computer-, audio-, and video-assisted interviews have been found to elicit more self-reported risk behaviors than did interviewer-administered questionnaires, particularly among younger patients (41,51--53,55). Studies suggest that clinicians who receive some training, particularly that including role-play and feedback concerning clinical performance, are more likely to perform effective risk screening (46--49).

Sex-related behaviors important to address in risk screening include whether the patient has been engaging in sex; number and sex of partners; partners' HIV serostatus (infected, not infected, or unknown); types of sexual activity (oral, vaginal, or anal sex) and whether condoms are used; and barriers to abstinence or correct condom use (e.g., difficulty talking with partners about or disclosing HIV serostatus, alcohol and other drug use before or during sex). Also, because the risk for perinatal HIV transmission is high without appropriate intervention, clinicians are advised to assess whether women of childbearing age might be pregnant, are interested in becoming pregnant, or are not specifically considering pregnancy but are sexually active and not using reliable contraception. Women who are unable to become pregnant because of elective sterilization, hysterectomy, salpingo-oophorectomy, or other medical reasons might be less likely to use condoms because of a lack of concern for contraception; these women should be counseled regarding the need for use of condoms to prevent transmission of HIV. Patients who wish to conceive and whose partner is not infected also might engage in risky behavior. Patients interested in pregnancy, for themselves or their partner, should be referred to a reproductive health specialist.

Injection-drug--related behaviors important to address in screening include whether the patient has been injecting illicit drugs; whether the patient has been sharing needles and syringes or other injection equipment; how many partners the patient has shared needles with; whether needle-sharing partners are known to be HIV infected, not infected, or of unknown HIV serostatus; whether the patient has been using new or sterilized needles and syringes; and what barriers exist to ceasing illicit drug use or, failing that, to adopting safer injection practices (e.g., lack of access to sterile needles and syringes).

Approaches to Screening for Behavioral Risk Factors

The most effective manner for screening for behavioral risk factors is not well defined; however, simple approaches are more acceptable to both patients and health-care providers. Screening tools should be designed to be as sensitive as possible for identifying behavioral risks; a more detailed, personalized assessment can then be used to improve specificity and provide additional detail. The sensitivity of screening instruments depends on obtaining accurate information. However, accuracy of information can be influenced by a variety of factors: recall, misunderstanding about risk, legal concerns, concern about confidentiality of the information and how the information will be used, concern that answers may affect ability to receive services, concern that answers may affect social desirability (i.e., the tendency to provide responses that will avoid criticism), and the desire for social approval (the tendency to seek praise). Interviewer factors also influence the accuracy of information. Surveys indicate that patients are more likely to discuss risk behaviors if they perceive their clinicians are comfortable talking about stigmatized topics such as sex and drug use and are nonjudgmental, empathetic, knowledgeable, and comfortable counseling patients about sexual risk factors. These factors need to be considered when interpreting responses to screening questions. To the extent possible, screening and interventions should be individualized to meet patient needs. Examples of two screening approaches are provided).

Incorporating Screening for Behavioral Risk Factors into the Office Visit

Before the patient is seen by the clinician, screening for behavioral risks can be done with a self-administered questionnaire; a computer-, audio-, or video-assisted questionnaire; or a brief interview with ancillary staff; the clinician can then review the results on the patient's medical record. Alternatively, behavioral risk screening can be done during the medical encounter (e.g., as part of the history); either open-ended questions or a checklist approach with in-depth discussion about positive responses can be used. Because, given patients' immediate health needs, it can be difficult in the clinical care setting to remember less urgent matters such as risk screening and harm reduction, provider reminder systems (e.g., computerized reminders) have been used by health-care systems to help ensure that recommended procedures are done regularly. Multicomponent health-care system interventions that include a provider reminder system and a provider education program are effective in increasing delivery of certain prevention services. Risk screening might be more likely to occur in managed care settings if the managed care organization specifically calls for it.

Screening for Clinical Risk Factors

Screening for STDs

Recommendations for preventive measures, including medical screening and vaccinations, that should be included in the care of HIV-infected persons (16,2,54,61--69) have been published previously. This report is not intended to duplicate existing recommendations; it addresses screening specifically to identify clinical factors associated with increased risk for transmission of HIV from infected to noninfected persons. In this context, STDs are the primary infections of concern for three reasons. First, the presence of STDs often suggests recent or ongoing sexual behaviors that may result in HIV transmission. Second, many STDs enhance the risk for HIV transmission or acquisition. Early detection and treatment of bacterial STDs might reduce the risk for HIV transmission. Third, identification and treatment of STDs can reduce the potential for spread of these infections among high-risk groups (i.e., sex or drug-using networks).

Screening and diagnostic testing serve distinctly different purposes. By definition, screening means testing on the basis of risk estimation, regardless of clinical indications for testing, and is a cornerstone of identifying persons at risk for transmitting HIV to others. Clinicians should routinely ask about STD symptoms, including urethral or vaginal discharge; dysuria; intermenstrual bleeding; genital or anal ulcers or other lesions; anal pain, pruritus, burning, discharge, or bleeding; and, for women, lower abdominal pain with or without fever. Regardless of reported sexual behavior or other epidemiologic risk information, the presence of such symptoms should always prompt diagnostic testing and, when appropriate, treatment. However, clinical symptoms are not sensitive for identifying many infections because most STDs are asymptomatic ; therefore, laboratory screening of HIV-infected persons is an essential tool for identifying persons at risk for transmitting HIV and other STDs.

Laboratory Testing for STDs

Identification of syphilis requires direct bacteriologic (i.e., dark-field microscopy) or serologic testing. However, noninvasive, urine-based nucleic acid amplification tests (NAATs) have greatly simplified testing for Neisseria gonorrhoeae and Chlamydia trachomatis. Although they are more costly than other screening tests, their ease of use and sensitivity---similar to the sensitivity of culture for detection of N. gonorrhoeae and substantially higher than the sensitivity of all other tests for C. trachomatis (including culture)---for detecting genital infection are great advantages. Detection of rectal or pharyngeal gonorrhea still requires culture. Pharyngeal infection with C. trachomatis is uncommon, and routine screening for it is not recommended). NAATs have not been approved for use with specimens collected from sites other than the urethra, cervix, or urine. Recommended screening strategies and diagnostic tests for detecting asymptomatic STDs are described cal and state health departments have reporting requirements, which vary among states, for HIV and other STDs. Clinicians need to be aware of and comply with requirements for the areas in which they practice; information on reporting requirements can be obtained from health departments. CEU

Screening for Pregnancy

Women of childbearing age should be questioned during routine visits about the possibility of pregnancy. Women who state that they suspect pregnancy or have missed their menses should be tested for pregnancy. Early pregnancy diagnosis would benefit even women not receiving antiretroviral treatment because they could be offered treatment to decrease the risk for perinatal HIV transmission.

Behavioral Interventions

Behavioral interventions are strategies designed to change persons' knowledge, attitudes, behaviors, or practices in order to reduce their personal health risks or their risk of transmitting HIV to others. Behavioral change can be facilitated by environmental cues in the clinic or office setting, messages delivered to patients by clinicians or other qualified staff on-site, or referral to other persons or organizations providing prevention services. Because behavior change often occurs in incremental steps, a brief behavioral intervention conducted at each clinic visit could result in patients, over time, adopting and maintaining safer practices. Behavioral interventions should be appropriate for the patient's culture, language, sex, sexual orientation, age, and developmental level). In settings where care is delivered to HIV-infected adolescents, for example, approaches need to be specifically tailored for this age group. Also, clinicians should be aware of and adhere to all laws and regulations related to providing services to minors.

Structural Approaches To Support and Enhance Prevention

Clinic or office environments can be structured to support and enhance prevention. All patients, especially new patients, should be provided printed information about HIV transmission risks, preventing transmission of HIV to others, and preventing acquisition of other STDs. Information can be disseminated at various locations in the clinic; for example, posters and other visual cues containing prevention messages can be displayed in examination rooms and waiting rooms. These materials usually can be obtained through local or state health department HIV/AIDS and STD programs or from the National Prevention Information Network (NPIN) (1-800-458-5231;). Additionally, condoms should be readily accessible at the clinic. Repeating prevention messages throughout the patient's clinic visit reinforces their importance, increasing the likelihood that they will be remembered.

Interventions Delivered On-Site

Prevention Messages for All Patients

All HIV-infected patients can benefit from brief prevention messages emphasizing the need for safer behaviors to protect both their own health and the health of their sex or needle-sharing partners. These messages can be delivered by clinicians, nurses, social workers, case managers, or health educators. They include discussion of the patient's responsibility for appropriate disclosure of HIV serostatus to sex and needle-sharing partners. Brief clinician-delivered approaches have been effective with a variety of health issues, including depression, smoking, alcohol abuse, weight and diet, and physical inactivity. This diverse experience with other health behaviors suggests that similar approaches may be effective in reducing HIV-infected patients' transmission risk behaviors. For patients already taking steps to reduce their risk of transmitting HIV, hearing the messages can reinforce continued risk-reduction behaviors. These patients should be commended and encouraged to continue these behaviors.

General HIV Prevention Messages

Patients frequently have inadequate information regarding factors that influence HIV transmission and methods for preventing transmission. The clinician should ensure that patients understand that the most effective methods for preventing HIV transmission remain those that protect noninfected persons against exposure to HIV. For sexual transmission, the only certain means for HIV-infected persons to prevent sexual transmission to noninfected persons are sexual abstinence or sex with only a partner known to be already infected with HIV. However, restricting sex to partners of the same serostatus does not protect against transmission of other STDs or the possibility of HIV superinfection unless condoms of latex, polyurethane, or other synthetic materials are consistently and correctly used. Superinfection with HIV has been reported and appears to be rare, but its clinical consequences are not known. For injection-related transmission, the only certain means for HIV-infected persons to prevent transmission to noninfected persons are abstaining from injection drug use or, for IDUs who are unable or unwilling to stop injecting drugs, refraining from sharing injection equipment (e.g., syringes, needles, cookers, cottons, water) with other persons. Neither antiretroviral therapy for HIV-infected persons nor postexposure prophylaxis for partners is a reliable substitute for adopting and maintaining behaviors that guard against HIV exposure).

Identifying and Correcting Misconceptions

Patients might have misconceptions about HIV transmission (98), particularly with regard to the risk for HIV transmission associated with specific behaviors, the effect of antiretroviral therapy on HIV transmission, or the effectiveness of postexposure prophylaxis for nonoccupational exposure to HIV.

Risk for HIV Transmission Associated with Specific Sexual Behaviors. Patients often ask their clinicians about the degree of HIV transmission risk associated with specific sexual activities. Numerous studies have examined the risk for HIV transmission associated with various sex acts. These studies indicate that some sexual behaviors do have a lower average per-act risk for transmission than others and that replacing a higher-risk behavior with a relatively lower-risk behavior might reduce the likelihood that HIV transmission will occur. However, risk for HIV transmission is affected by numerous biological factors (e.g., host genetics, stage of infection, viral load, coexisting STDs) and behavioral factors (e.g., patterns of sexual and drug-injection partnering), and per-act risk estimates based on models that assume a constant per-contact infectivity could be inaccurate. Thus, estimates of the absolute per-episode risk for transmission associated with different activities could be highly misleading when applied to a specific patient or situation. Further the relative risks of becoming infected with HIV, from the perspective of a person not infected with HIV, might vary greatly according to the various choices related to sexual behavior.

Effect of Antiretroviral Therapy on HIV Transmission. High viral load is a major risk factor for HIV transmission. Among untreated patients, the risk for HIV transmission through heterosexual contact has been shown to increase approximately 2.5-fold for each 10-fold increase in plasma viral load. By lowering viral load, antiretroviral therapy might reduce risk for HIV transmission, as has been demonstrated with perinatal transmission and indirectly suggested for transmission via genital secretions (semen and cervicovaginal fluid). However, because HIV can be detected in the semen, rectal secretions, female genital secretions, and pharynx of HIV-infected patients with undetectable plasma viral loads and because consistent reduction of viral load depends on high adherence to antiretroviral regimens, the clinician should assume that all patients who are receiving therapy, even those with undetectable plasma HIV levels, can still transmit HIV. Patients who have treatment interruptions, whether scheduled or not, should be advised that this will likely lead to a rise in plasma viral load and increased risk for transmission. Another concern related to adherence to antiretroviral therapy is the development of drug-resistant mutations with subsequent transmission of drug-resistant viral strains. Several reports suggest that transmission of drug-resistant HIV occurs in the United States. Recent reports suggest that drug-resistant HIV strains might be less easily transmitted than wild-type virus, but these data are limited and their significance is unclear.

Effectiveness of Postexposure Prophylaxis for Non occupational Exposure to HIV. Although the U.S. Public Health Service recommends using antiretroviral drugs to reduce the likelihood of acquiring HIV infection from occupational exposure (e.g., accidental needle sticks received by health care workers), limited data are available on efficacy of prophylaxis for nonoccupational exposure. Observational data suggesting effectiveness have been reported; however, postexposure prophylaxis might not protect against infection in all cases, and effectiveness of these regimens might be further hindered by lack of tolerability, potential toxicity, or viral resistance. Thus, avoiding exposure remains the best approach to preventing transmission, and the potential availability of postexposure prophylaxis should not be used as justification for engaging in risky behavior.

Tailored Interventions for Patients at High Risk for Transmitting HIV

Interventions tailored to the individual patient's risks can be delivered to patients at highest risk for transmitting HIV infection and for acquiring new STDs. This includes patients whose risk screening indicates current sex or drug-injection practices that may lead to transmission, who have a current or recent STD, or who have mentioned items of concern in discussions with the clinician. Any positive results of screening for behavioral risks or STDs should be addressed in more detail with the patient so a more thorough risk assessment can be done and an appropriate risk-reduction plan can be discussed and agreed upon.

Although the efficacy of brief clinician-delivered interventions with HIV-infected patients has not been studied extensively, substantial evidence exists for the efficacy of provider-delivered, tailored messages for other health concerns (151--155). An attempt should be made to determine which of the patient's risk behaviors and underlying concerns can be addressed during clinic visits and which might require referral.

At a minimum, an appropriate referral should be made and the patient should be informed of the risks involved in continuing the behavior. HIV-infected persons who remain sexually active should be reminded that the only certain means for preventing transmission to noninfected persons is to restrict sex to partners known to be already infected with HIV and that they have a responsibility for disclosure of HIV serostatus to prospective sex partners. For mutually consensual sex with a person of unknown or discordant HIV serostatus, consistent and correct use of condoms made of latex, polyurethane, or other synthetic materials can substantially reduce the risk for HIV transmission. Also, some sex acts have relatively less risk for HIV transmission than others). For HIV-infected patients who continue injection drug use, the provider should emphasize the risks associated with sharing needles and should provide information regarding substance abuse treatment and access to clean needles. Examples of targeted motivational messages on condom use and needle sharing are provided), and providers can individualize their own messages using these as a guide.

Clinician Training

Clinicians can prepare themselves to deliver HIV prevention messages and brief behavioral interventions to their patients by 1) developing strategies for incorporating HIV risk-reduction interventions into patients' clinic visits; 2) obtaining training on speaking with patients about sex and drug-use behaviors and on giving explanations in simple, everyday language 3) becoming familiar with interventions that have demonstrated effectiveness ; 4) becoming familiar with the underlying causes of and concerns related to risk behaviors among HIV-infected persons (e.g., domestic violence; and 5) becoming familiar with community resources that address risk reduction. Free training on risk screening and prevention can be obtained at CDC-funded STD/HIV Prevention Training Centers and HRSA-funded AIDS Education and Training Centers, which also offer continuing medical education credit for this training. Ongoing training will help clinicians refine their counseling skills as well as keep current with prevention concerns at the community level, thus increasing their ability to appropriately counsel and provide support to patients.

Ongoing Delivery of Prevention Messages

Prevention messages can be reinforced by subsequent longer or more intensive interventions in clinic or office environments by nurses, social workers, or health educators. Advantages of a multidisciplinary approach are that skill sets vary among staff members from various disciplines and that a patient may be more receptive to discussing prevention-related issues with one team member than with another. For HIV-negative persons or persons of unknown HIV serostatus, randomized controlled trials provide strong evidence for the efficacy of short, one- or two-session interventions and for longer or multisession interventions in clinics for individuals and groups. For example, for persons who continue to engage in risky behaviors, CDC recommends client-centered counseling, a specific model of HIV prevention counseling, Evidence for the efficacy of multisession interventions for HIV-infected patients, individually or in groups, in clinical settings is limited to a few randomized, controlled trials and other studies that might not have assessed behavioral outcomes. The studies of single-session interventions for individual HIV-infected patients in clinical settings have not been randomized controlled trial.

Referrals for Additional Prevention Interventions and Other Services

Types of Referrals

Certain patients need more intensive or ongoing behavioral interventions than can feasibly be provided in medical care settings). Many have underlying problems that impede adoption of safer behaviors (e.g., homelessness, substance abuse, mental illness), and achieving behavioral change is often dependent on addressing these concerns. Clinicians will usually not have time or resources to fully address these issues, many of which can best be addressed through referrals for services such as intensive HIV prevention interventions (e.g., multisession risk-reduction counseling, support groups), medical services (e.g., family planning and contraceptive counseling, substance abuse treatment), mental health services (e.g., treatment of depression, counseling for sexual compulsivity), and social services (e.g., housing, child care and custody, protection from domestic violence). For example, all patients should be made aware of their responsibility for appropriate disclosure of HIV serostatus to sex and needle-sharing partners; however, full consideration of the complexities of disclosure, including benefits and potential risks, may not be possible in the time available during medical visits. Patients who are having, or are likely to have, difficulty initiating or sustaining behaviors that reduce or prevent HIV transmission might benefit from prevention case management. Prevention case management provides ongoing, intensive, one-on-one, client-centered risk assessment and prevention counseling, and assistance accessing other services to address concerns that affect patients' health and ability to change HIV-related risk-taking behavior. For HIV-seronegative persons, randomized controlled trials provide evidence for the efficacy of HIV prevention interventions delivered by health departments and community-based organizations. For HIV-infected persons, efficacy studies of such interventions are limited to a few randomized controlled trials, only one of which documented change in risk-related behavior, and to other studies, the majority of which did not assess behavioral outcomes.

Referrals for IDUs

For IDUs, ceasing injection-drug use is the only reliable way to eliminate the risk of injection-associated HIV transmission; however, most IDUs are unable to sustain long-term abstinence without substance abuse treatment. Several studies have examined the effect of substance abuse treatment, particularly methadone maintenance treatment, on HIV risk behaviors among IDUs (208--210). These include controlled and noncontrolled cohort studies, case-control studies, and observational studies with controls, and collectively they provide evidence that methadone maintenance treatment reduces risky injection and sexual behaviors and HIV seroconversion. Thus, early entry into substance abuse treatment programs, maintenance of treatment, and sustained abstinence from injecting are crucial for reducing the risk for HIV transmission from infected IDUs. For those IDUs not able or willing to stop injecting drugs, once-only use of sterile syringes can greatly reduce the risk for injection-related HIV transmission. Substantial evidence from cohort, case-control, and observational studies indicates that access to sterile syringes through syringe exchange programs reduces HIV risk behavior and HIV seroconversion among IDUs. Physician prescribing and pharmacy programs can also increase access to sterile syringes. Disinfecting syringes and other injection equipment by boiling or flushing with bleach when new, sterile equipment is not available has been suggested to reduce the risk for HIV transmission); however, it is difficult to reliably disinfect syringes, and this practice is not as safe as using a new, sterile syringe. Information on access to sterile syringes and safe syringe disposal can be obtained through local health departments or state HIV/AIDS prevention programs.

Engaging the Patient in the Referral Process

When referrals are made, the patient's willingness and ability to accept and complete a referral should be assessed. Referrals that match the patient's self-identified priorities are more likely to be successful than those that do not; the services need to be responsive to the patient's needs and appropriate for the patient's culture, language, sex, sexual orientation, age, and developmental level. For example, adolescents should be referred to behavioral intervention programs and services that work specifically with this population. Discussion with the patient can identify barriers to the patient's completing the referral (e.g., lack of transportation or child care, work schedule, cost). Accessibility and convenience of services predict whether a referral will be completed. The patient should be given specific information regarding accessing referral services and might need assistance (e.g., scheduling appointments, obtaining transportation) in completing referrals. The likelihood that referrals will be completed successfully could possibly be increased if clinicians or other health-care staff assist patients with making appointments to referral services. When a clinician does not have the capacity to make all appropriate referrals, or when needs are especially complex, a case manager can help make referrals and coordinate care. Outreach workers, peer counselors or educators, treatment advocates, and treatment educators can also help patients identify needs and complete referrals successfully. Health department HIV/AIDS prevention and care programs can provide information on accessing these services. Assessing the success of referrals by documenting referrals made, the status of those referrals, and patient satisfaction with referrals will further assist clinicians in meeting patient needs. Information obtained through follow-up of referrals can identify barriers to completing the referral, responsiveness of referral services to patient needs, and gaps in the referral system, and can be used to develop strategies for removing the barriers.

Referral Guides and Information

Preparation for making patient referrals includes 1) learning about local HIV prevention and supportive social services, including those supported by the Ryan White CARE Act; 2) learning about available resources and having a referral guide listing such resources; and 3) contacting staff in local programs to facilitate subsequent referrals. Referral guides and other information usually can be obtained from local and state health department HIV/AIDS prevention and care programs, which are key sources of information about services available locally. Health departments and some managed care organizations are also a source of educational materials, posters, and other prevention-related material. Health departments can provide or suggest sources of training and technical assistance on behavioral interventions. A complete listing of state AIDS directors and contact information is available from the National Alliance of State and Territorial AIDS Directors (NASTAD) at. In addition, information can be obtained from local health planning councils, consortia, and community planning groups; local, state, and national HIV/AIDS information hotlines and Internet websites; and community-based health and human service providers).

Examples of Case Situations for Prevention Counseling

1. A patient with newly diagnosed HIV infection comes to your office for initial evaluation. Of the many things that must be addressed during this initial visit (e.g., any emergent medical or psychiatric problems, education about HIV, history, physical, initial laboratory work [if not already done]), how does one address prevention? What is the minimum that should be done, and how can it be incorporated into this visit?

Assuming no emergent issues preclude a complete history and physical examination during this visit, the following should be done:

  • During the history, question how the patient might have acquired HIV, current risk behaviors, current partners and whether they have been notified and tested for HIV, and current or past STDs.
  • During the physical examination, include genital and rectal examinations, evaluation and treatment of any current STD, or, if asymptomatic, appropriate screening for STDs.
  • Discuss current risk behavior, at least briefly. Emphasize the importance of using condoms; address active injection-drug use.
  • Discuss the need for disclosure of HIV serostatus to sex and needle-sharing partners, and discuss potential barriers to disclosure.
  • Note issues that will require follow-up; e.g., risk behavior that will require continuing counseling and referral and partners who will need to be notified by either the patient or a health department.

2. A patient with chronic, stable HIV comes to you with a new STD. What prevention considerations should be covered in this visit?

For the patient who has had a stable course of disease, a new STD can be a sign of emerging social, emotional, or substance abuse problems. These potential problems should be addressed in addition to the STD.

  • During the history, cover topics related to acquisition of the new STD---number of new partners, number of episodes of unsafe sex, and types of unsafe sex.
  • Address the personal risks associated with high-risk behavior, e.g., viral superinfection and HIV/STD interactions.
  • Address personal or social problems (including substance abuse and domestic violence) that might have led to a change in behavior resulting in the acquisition of the new STD; refer to social services, if necessary.
  • Address other issues (e.g., adherence to HAART) that may be affected by personal or social problems. Check viral load if nonadherence is evident or is suspected.
  • During the physical examination, include a careful genital and rectal examination and screen for additional STDs, such as syphilis, trichomoniasis, (for women), chlamydial infection (for sexually active women aged <25 years and selected populations of men and women), and gonorrhea (for selected populations of men and women).
  • Discuss the need for partner notification and referral for counseling and testing.
  • Note in the chart that risk behavior should be addressed in future visits and that tailored counseling may be needed for the patient.

3. A patient with chronic, stable HIV has been seen regularly in a health care setting. What should be included in this patient's routine clinical care?

Discussion of sexual and needle-sharing practices should be integrated into a routine part of clinical care.

  • Periodically (e.g., annually) screen for STDs. STDs to be included in screening should be determined by patient's sex, history of high-risk behavior, and local epidemiology of selected STDs.
  • Reiterate general prevention messages and patient education regarding partner notification, high-risk behaviors associated with transmission, prevention of transmission, or condom use, as deemed appropriate by the clinician.

4. A patient who has been treated with HAART for 2 years comes to you. At the time of treatment initiation, CD4+count was 200 cells/µL and the viral load was 50,000 copies/ml. The response to therapy was prompt; CD4+ count increased to 500 cells/µL, and the viral load has been undetectable since soon after treatment began. The patient now has mildly elevated cholesterol, some mild lipodystrophy, and facial wasting. He states that he would like to stop HAART because of the side effects. What should you tell this patient?

  • Inform the patient that upon stopping HAART, CD4+ count and viral load will likely return to pretreatment levels with risk for opportunistic infections and progression of immune deficiency.
  • Inform the patient that increase in viral load to pretreatment levels will likely result in increased infectiousness and risk for transmission of HIV to sex or needle-sharing partners.
  • Counsel the patient regarding the option of changing the HAART regimen to limit progression of metabolic side effects.
Partner Counseling and Referral Services, Including Partner Notification

HIV-infected persons are often not yet aware of their infection; thus, they cannot benefit from early medical evaluation and treatment and do not know that they may be transmitting HIV to others. Reaching such persons as early after infection as possible is important for their own health and is a critical strategy for reducing HIV transmission in the community. Furthermore, interviews of HIV-infected persons in various settings suggest that >70% are sexually active after receiving their diagnosis, and many have not told their partners about their infection (188). Partner counseling and referral services (PCRS), including partner notification, are intended to address these problems by 1) providing services to HIV-infected persons and their sex and needle-sharing partners so the partners can take steps to avoid becoming infected or, if already infected, to avoid infecting others and 2) helping infected partners gain earlier access to medical evaluation, treatment, and other services. A key element of PCRS involves informing current partners (and past partners who may have been exposed) that a person who is HIV infected has identified them as a sex or needle-sharing partner and advising them to have HIV counseling and testing (235--238).

Informing partners of their exposure to HIV is confidential; i.e., partners are not told who reported their name or when the reported exposure occurred. It is voluntary in that the infected person decides which names to reveal to the interviewer. Studies have indicated that infected persons are more likely to name their close partners than their more casual partners. Limited reports of partner violence after notification suggest a need for caution, but such violence seems to be rare. When asked, 92% of notified partners reported that they believe the health department should continue partner notification services. No studies have directly shown that PCRS prevents disease in a community. However, studies have demonstrated that quality HIV prevention counseling can reduce the risk of acquiring a new STD and that persons who become aware of their HIV infection can take steps to protect their health and prevent further transmission; in addition, before--after studies have suggested that partners change their behavior after they are notified. Finally, compelling arguments have been offered regarding partners' rights to know this information that is important to their health.

Laws and Regulations Related to Informing Partners

The majority of states and some cities or localities have laws and regulations related to informing partners that they have been exposed to HIV. Certain health departments require that, even if a patient refuses to report a partner, the clinician report to the health department any partner of whom he or she is aware. Many states also have laws regarding disclosure by clinicians to third parties known to be at high risk for future HIV transmission from patients known to be infected (i.e., duty to warn). Clinicians should know and comply with any such requirements in the areas in which they practice. With regard to PCRS, clinicians should also be aware of and adhere to all laws and regulations related to providing services to minors.

Approaches to Notifying Partners

Partners can be reached and informed of their exposure by health department staff, clinicians in the private sector, or the infected person. In the only randomized controlled trial that has been conducted to date, 35 HIV-infected persons were asked to notify their partners themselves, and 10 partners were notified. Another 39 HIV-infected persons were assigned to health department referral; and for these, 78 partners were notified. Thus, notification by the health department appears to be substantially more effective than notification by the infected person. Other studies, with less rigorous designs, have demonstrated similar results. Some persons, when asked, prefer to inform their partners themselves. This could have a benefit if partners provide support to the infected person. However, patients frequently find that informing their partners is more difficult than they anticipated. Certain health departments offer contract referral, in which the infected person has a few days to notify his or her partners. If by the contract date the partners have not had a visit for counseling and testing, they are then contacted by the health department. In practice, patients' difficulties in informing their partners usually means notification is done by the health department.

Although clinicians might wish to take on the responsibility for informing partners, one observational study has indicated that health department specialists were more successful than physicians in interviewing patients and locating partners. Health departments have staff who are trained to do partner notification and skilled at providing this free, confidential service. These disease intervention specialists can work closely with public and private sector clinicians who treat persons with other STDs. With regard to partner notification, the clinician should be sensitive to concerns of domestic violence or abuse by the informed partner. CEU

All partners should be notified at least once. Persons who continue to have sex with an HIV-infected person despite an earlier notification may have erroneously concluded that someone else was the infected partner. Thus, renotification might be important, although no research is available on renotification.

Counseling Sessions

To establish initial rapport with the patient, the counselor will need to convey positive regard, genuine concern, and an empathic response toward the patient. This connection will help build trust and will set the tone for the rest of the session. The counselor must be professional and respectful toward the patient and recognize that issues of sex and drug use behaviors may be sensitive and difficult for the patient to discuss. The patient should be helped to feel comfortable with the clinic procedures, understand the role of the counselor, and be clear about the content and purpose of the session. If the patient is clear about the expectations and the process, the counselor has reduced the patient’s anxiety and increased the patient’s ability to focus on the session. This clear delineation of the session serves to model for the patient a rational and responsible approach to addressing the challenging issues of behavior change. It is important that the counselor conducts the session, to the extent possible, as described to the patient. Ifthe counselor must deviate from what he/she has indicated will occur in the session, this change should beexplained to the patient.

The counselor should convey confidence in being able to understand the patient’s risk behavior and in the patient’sability to initiate a risk reduction process. Also, the counselor should communicate an appropriate sense ofurgency and concern relative to the patient’s HIV/STD risks. In this component of the session, the counselorshould establish the collaborative nature of the session and the mutual commitment of both counselor and patient to earnestly address risk reduction issues.

The counselor is attempting to focus the patient’s attention on his/her behavior and the corresponding risk ofacquiring HIV. The counselor’s approach to this component of the session will shift based on the patient’sparticular issues in addressing HIV risk: 1. Enhance self-perception of risk;2. Address dissonance (examples whenbeliefs and behavior are at odds) and ambivalence (mixed feelings) about risk reduction; 3. Increase self-efficac (belief in one’s power or ability to do something);4. Invoke peer and community norms. The patient’s presence in the clinic and request for STD services is the starting point from which the counselor addresses these issues. Inthis section, the counselor is attempting to use the patient’s STD concerns to encourage him/her to examine HIVissues. The link between STD and HIV risk should be emphasized. The process is intended to help the patientbecome motivated and invested in addressing HIV issues and concerns with the counselor. At the completion ofthis component of the session, the counselor’s aim is to have the patient fully engaged in the session and invested in reducing HIV/STD risk.

The counselor should have an open and inquisitive approach to this portion of the session. This approach willstimulate the patient’s curiosity and encourage him/her to self-reflect and examine his/her own behaviors. Theexploration of the risk behavior should be specific. A thorough discussion of the most recent risk behavior helpsthe patient clarify how the risk behavior occurred. What may have initially seemed like an accident or an unusualincident begins to have concrete circumstances that contributed to the patient’s decision to engage in high-riskbehavior. This process can demystify the risk behavior for the patient. The questions asked by the counselor aredirected at eliciting the entire range of factors that may have contributed to the risk behavior. The counselor shouldbe aware that emotions, recent life events, substance use, self-esteem, and other patient characteristics and issuesmay influence a particular risk incident or pattern of risk behavior. The counselor and patient should be workingtogether to understand the context of the risk behavior. If the patient’s risk behavior is episodic or chronic, thecounselor is trying to discover and clarify the characteristic patterns that contribute to the patient’s risk behavior.

The counselor should explore any changes initiated by the patient to reduce his/her HIV risk(s). This provides thecounselor with an essential opportunity to support and reinforce the patient. The counselor should note all of thepatient’s intentions, communication, and actions concerning HIV risk reduction. The counselor should elicitobstacles encountered by the patient in considering or attempting behavior change. The counselor should gentlyand sensitively discuss the challenges the patient has encountered or perceived. It is important to acknowledge thatbehavior change is a complex and challenging process. It is helpful, particularly if the patient has difficultyarticulating his experiences with risk reduction, to explore his/her perception of community and peer normsconcerning HIV prevention. Further, encouraging the patient to articulate his/her attitudes and beliefs about HIVrisk behavior may provide additional insight. This process allows the patient to verbalize the extent to which he/shehas addressed HIV issues and provides the counselor with insight into the patient’s strengths and difficulties in

initiating and sustaining behavior change. During this portion of the session the counselor may educate and clarifymisinformation for the patient, as needed.

The purpose of this component of the session is to enable the patient to gain an understanding of the complexity offactors that influence his/her risk behavior. The counselor summarizes to the patient the inter-related factorsinfluencing risk. This summary provides the patient with an organized perspective of his/her narrative. Thecounselor’s approach to this should be empathic and non-judgmental, which will help the patient understand his/herown behavior with compassion. This process enhances the counselor and patient’s collaboration in reducing thepatient’s risk of acquiring HIV/STD. It may seem paradoxical, but the counselor must simultaneously convey asense of urgency in understanding this behavior and be clear about the consequences should the patient fail toprioritize and respond to this situation. This component of the session provides the foundation on which the riskreduction plan will be developed. The counselor should use this summary of the session to transition to the riskreduction component of the session.

The risk reduction plan is a fundamental component of the prevention counseling session. The counselor shouldassist the patient in identifying a behavior that corresponds to his/her risk and that he/she is invested in changing. Itis essential that the plan match the patient’s skills and abilities with his/her motivation to change a specificbehavior. The counselor should challenge the patient to go beyond what he/she has previously attempted in termsof risk reduction. The plan must be specific in that it describes the who, what, where, when and how of the riskreduction process. It must be concrete in that it details the successive actions required of the patient to implementand complete the risk reduction plan. Finally, it must be incremental in that it is directed at a single aspect of therisk behavior or one particular factor/issue that contributes to that risk behavior. The counselor should avoidsupporting risk reduction plans that involve unreasonable or radical changes in the patient’s life. The patient mayexperience a “flight to health” as a result of the STD clinic experience, the anxiety from the testing process, or thequality of the counseling interaction. Global risk reduction messages such as “always wear condoms,” “remainmonogamous,” or “abstain from sex” do not meet the criteria for an appropriate risk reduction plan. The counselorshould ensure that the patient agrees with the plan and is committed to its implementation. The patient should beasked to critique the plan and identify problems with the plan. The counselor may even quiz the patient on the planor provide plausible examples of obstacles the patient may encounter in initiating the plan. These obstacles shouldbe problem-solved with the patient and may require revising the plan. The process of developing a plan representsthe patient’s movement toward risk reduction. In fact, it is the second step in reducing risk (the first being thepatient’s participation in the study), for which he/she should be provided encouragement and considerable support.

The counselor should acknowledge that the plan is a challenge and assure the patient that you will review withhim/her the outcome of the plan at the next session. Explain to him/her that together you can renegotiate the plan,if necessary, in the posttest session.

This component of the session is intended to identify or develop for the patient, peer and community support forHIV risk reduction, as well as to provide referral to professional services to address specific issues the patientmay have identified. If during the course of the session the counselor or patient has identified a need for referralsto professional services (e. g. , drug treatment, support group, mental health counseling, etc. ), then the counselorshould be prepared to provide specific provider names and phone numbers to the patient. Referrals in this contextare particularly important because the referral services may enhance the risk reduction process. The counselorshould confirm that the referral is something the patient is willing to consider. To the extent possible, thecounselor should try to provide referrals consistent with that patient’s readiness to receive the services, comfortwith the setting in which the service is provided, and interest in accessing the services. The counselor should becautious not to overwhelm the patient with numerous referrals. A single appropriate referral is often better thanseveral referrals to generic types of support services. The referral may augment the risk reduction plan, but unlessit is the only alternative, completion of the referral by the patient should not be the primary objective of the riskreduction plan.

Second Session

In preparation for the test results and prevention counseling session, the counselor should review the notes fromthe previous session. The counselor should remind him/herself of the specific details of the risk reduction planand the patient’s particular issues and vulnerabilities in attempting behavior change related to HIV/STD risks. Thecounselor should also review the patient’s STD clinic chart and know whether the patient was diagnosed or treatedfor an STD. The HIV test results should be available in the counseling room.

The counselor should be aware that the patient may be very anxious to receive his/her results upon returning to theclinic. The counselor should greet the patient warmly and then proceed with the session. Based on the counselor’ssense of the patient, he/she should determine whether to ask if the patient has concerns or questions prior toproviding the test results. Generally, providing the results expediently and directly is advised. The counselorshould review the patient’s experience of and reactions to the previous STD assessment, clinical exam/diagnosisand, as appropriate, incorporate this information into the counseling session. This second session should build onwork started in the first session.

If the patient’s HIV test results are positive, the counselor should follow their clinic’s standard protocol forproviding HIV positive test results. The guidance in this section pertains to providing results to HIV negative

RESPECT-2 patients.

The counselor should provide the initial test result in simple terms, avoiding technical jargon. The patient may bevery relieved at receiving the negative test result. The counselor should allow the patient to experience his/herpleasure at not being infected while underscoring the need for behavior change in order for him/her to remainnegative. The counselor should cautiously explore the patient’s feelings and beliefs about his/her negative testresult, specifically in the context of the risk behavior described by the patient in the previous session. Thecounselor should be alert to the possibility that the patient may experience disinhibition (i. e. , feel more inclinedto engage in risky behavior) in response to the results. The patient may believe the test result is an indication thathe/she has, thus far, made the “right choices. ”It is often helpful for the counselor to underscore the fact that thenegative test result does not mean that the patient’s sex/needle-share partner(s) are not infected. Nor does it meanthat the patient is immune to HIV, or that his/her behavior is less risky than addressed in the initial session.

There is a slight possibility that a recent risk behavior (especially in the last 6 to 12 weeks) may have resulted inthe patient becoming infected without the infection being indicated in this test result. However, both counselor andpatient should be reminded that the current result represents all other, sometimes years’, previous risk behavior.

Counselors must be very careful with their “retest message. ”If there is not a significant risk in the previous 3months, then no additional test is indicated unless the patient has a later exposure to HIV. If there is a very recentand significant risk exposure, there is a small chance that the patient could have been infected by that exposure.

The counselor should remember that the risk of infection from a single exposure, when the partner is known to beinfected, is relatively small (<1 – 8%). The counselor should avoid technical discussions of this information andrecommend, when necessary, a specific time for possible retest linked to a specific previous date of exposure. Insummary, a brief explanation of the possible need for retesting is sometimes, with some patients, important, butthis should not be over-emphasized. Too much attention to retesting takes away attention from the risk reductionprocess and often inaccurately diminishes the meaning of the HIV negative result.

The counselor may briefly inquire about how the week went for the patient and his/her thoughts and reactions fromthe previous session. However, the focus of this session will be to discuss the step(s) taken by the client to reducehis/her HIV risk behavior as negotiated in session one. Regardless of whether the patient is resolved to changehis/her behavior or is struggling to find the resolve, a sense of urgency concerning addressing risk behavior shouldbe conveyed by the counselor. It is important to review with the patient both the successes and challenges inimplementing the plan. The counselor should listen for an opportunity to provide support and reinforcement to thepatient. The counselor should have a copy of the plan available and, if necessary, provide reminders to the patientabout specific details of the plan.

The counselor will encourage the patient to attempt an additional, perhaps more challenging, step toward reducingrisk. If the patient encountered difficulty with the previous plan, then the counselor should help him/her revise theplan. The counselor and the client should refine the plan as necessary, aiming toward a plan that the patient has ahigh probability of successfully implementing. The counselor should, as necessary, remind the patient that riskreduction and behavior change are incremental processes (see details in Session I, “Negotiate Risk ReductionPlan”). The counselor should help the patient identify persons from whom he/she can get support for his/her riskreduction plan. The counselor should obtain a commitment from the client to attempt the risk reduction step andstick to the risk reduction plan.

This component of the session is intended to identify or develop for the patient peer and community support forthe patient’s HIV risk reduction, as well as provide referral to professional services to address specific issues thepatient may have identified. If during the course of the session the counselor or patient has identified a need forreferrals to professional services (e. g. , drug treatment, support group, mental health counseling, etc. ), thencounselor should be prepared to give specific provider names and phone numbers to the patient. Referrals in thiscontext are particularly important to the extent that the referral services received by the patient may complementor enhance the risk reduction process. The counselor should confirm that the referral is something the patient iswilling to consider. To the extent possible the counselor should try to provide referrals consistent with thatpatient’s readiness to receive the services, comfort with the setting in which the service is provided and interest inaccessing the services. The counselor should be cautious not to overwhelm the patient with numerous referrals. single appropriate referral is often better than several referrals to generic types of support services. The referralmay augment the risk reduction plan, but unless it is the only alternative, completion of the referral by the patientshould not be the primary objective of the risk reduction plan.

Methamphetamine is a stimulant drug that has been around for decades. Its popularity has waxed and waned over the years, but its use seems to be increasing in many parts of the United States and in several population subgroups. Methamphetamine is very addictive, it can be injected, and it can increase sexual arousal while reducing inhibitions. Because of these attributes, public health officials are concerned that users may be putting themselves at increased risk of acquiring or transmitting HIV infection―a valid concern, considering that methamphetamine use has been linked with increased numbers of HIV infections in some populations.

There is a growing body of research on methamphetamine use among men who have sex with men (MSM). Overall, assessments show that MSM who use methamphetamine may increase their sexual risk factors (for example, they may use condoms less often, have more sex partners, and may engage in practices that elevate their risk for HIV infection, such as unprotected receptive anal sex) and perhaps their HIV-related drug-use risk factors (for example, injecting methamphetamine instead of smoking or snorting it) .

MSM are not the only group with risk factors related to methamphetamine use. Evidence shows that heterosexual adults and adolescents under the influence of methamphetamine may also engage in practices that increase their risk for HIV infection and other sexually transmitted diseases (STDs) [2]. However, among MSM, the baseline prevalence of infections (such as HIV) and risk behaviors (such as number of partners and anal sex) tends to be higher, resulting in greater risk for transmission. Methamphetamine users may exchange sex for money or drugs, creating another risk factor for acquiring and transmitting HIV.

What is becoming clear is that the use of methamphetamine can contribute to sexual risk behaviors, regardless of the sexual orientation of the user. Current data indicate a strong link between methamphetamine use and sexual risk among MSM, and perhaps among heterosexual adults and youth.

The following are facts about methamphetamine, its effects on the body, and research showing its role in increasing behaviors that put persons at risk of acquiring or transmitting HIV infection.

Methamphetamine Defined

Methamphetamine is a central nervous system stimulant categorized by the U.S. Food and Drug Administration as a Schedule II amphetamine, which means it has a high potential for abuse and for psychological or physical dependence. There are numerous slang names for methamphetamine, some of which are regional or group-specific. The most common are meth, crystal meth, Tina, ice, and glass. Methamphetamine is smoked, injected, snorted, swallowed, or inserted into the anus .

How Methamphetamine Is Produced

Methamphetamine can be produced through a series of fairly simple chemical steps involving a common decongestant―ephedrine or pseudoephedrine― in combination with products such as iodine crystals, battery acid, red phosphorous, and anhydrous ammonia. It can be formulated as a liquid, a powder, a waxy solid (glass), or a clear rock (ice).

Methamphetamine Use in the United States

According to the Substance Abuse and Mental Health Services Administration (SAMHSA), in 2004,

  • an estimated 12 million persons aged 12 and older (4.9% of US persons aged 12 or older) had used methamphetamine at least once in their lifetime
  • 1.4 million persons aged 12 or older (0.6% of the US population) had used methamphetamine during the past year
  • 600,000 (0.2% of the US population) had used it during the past month.

SAMHSA estimated that from 1993 through 2003, the rate of admissions for the treatment of methamphetamine or amphetamine abuse increased from 13 to 56 admissions per 100,000 for people aged 12 or older.

Studies show a higher prevalence of methamphetamine use among MSM than among the general population. For example, in a study of urban, young MSM (aged 15-22 years), conducted during 1994–1998, 20% of the participants reported having used methamphetamine during the past 6 months.  A 2001 study found that 15% of MSM in San Francisco had used methamphetamine during their most recent anal sex (within the past 3 months)―making methamphetamine use third only to the prevalence of alcohol and marijuana use.

The current increase (since the early 1990s) of methamphetamine use began in the western United States. However by the mid-2000s, its use had become a nationwide concern. The National Clandestine Laboratory Database, which includes the number of clandestine labs seized, showed an increase in the number of lab seizures in almost every state from 2000 through 2005.. As of 2004, the rates of methamphetamine use were particularly high in the western states: 12 states, including California, Nevada, Wyoming, and Montana, ranked in the top third of states in terms of methamphetamine use during the past year.

Lab seizures and restrictions on purchasing ingredients have reduced the production of methamphetamine in the United States.

The Effects of Methamphetamine Use

As a central nervous system stimulant, methamphetamine directly affects the brain and the spinal cord by interfering with the normal release and uptake of neurotransmitters (chemicals that nerve and brain cells produce to communicate with each other). Dopamine is the primary neurotransmitter affected by methamphetamine, but norepinephrine and epinephrine are also affected.

The use of methamphetamine causes the release of large quantities of neurotransmitters. The neurotransmitters, in turn, cause increased heart rate and blood pressure levels and produce sensations of pleasure, self-confidence, energy, and alertness. They also suppress the appetite and enhance sexual arousal. Users may report sleeplessness, talkativeness, teeth grinding, increased body temperature, and compulsive behavior, such as skin picking.

Long-term use can cause physical symptoms (decayed teeth, weight loss, skin lesions, stroke, and heart attack) as well as mental symptoms (paranoia, hallucinations, anxiety, and irritability) and behavioral symptoms (aggressiveness, violence, and isolation).

The long-term use of methamphetamine can lead to reduced levels of dopamine and other neurotransmitters, making the user crave methamphetamine to raise dopamine levels. Because bingeing on the drug depletes neurotransmitter stores, coming down from the high is often described as a “crash,” which includes a phase of depression. Additional doses of methamphetamine are often used to alleviate these negative feelings. This cycle can lead to addiction, which can be very difficult to overcome.

Because methamphetamine use can cause impotence at the same time that it is increasing libido, some MSM may use erectile dysfunction medications and may then engage in unprotected receptive or insertive anal sex while under the influence of the drugs [7].

How Methamphetamine Compares with Amphetamines or Cocaine

Changes in specific parts of the brain of methamphetamine users are similar to those of cocaine and other substance users; however, methamphetamine, amphetamines, and cocaine differ in some ways.

For example, compared with amphetamines, methamphetamine has longer lasting and more toxic effects. Methamphetamine is also stronger and longer lasting than cocaine. Methamphetamine, compared with cocaine, causes a more than 3-fold release of dopamine in the brain and has a half-life (the amount of time necessary for half of the drug to be metabolized) of 12 hours, compared with cocaine’s half-life of 1 hour. If smoked, it can produce a high for 8–24 hours; smoking cocaine produces a high for approximately 20–30 minutes. Because its effects last longer and it is less expensive than cocaine, methamphetamine is attractive to many populations, including young people, who sometimes refer to it as “poor man’s cocaine.” CEU

The Methamphetamine User

There is no typical methamphetamine user. The drug is used by people of different ages and races, in all parts of the country, and for different reasons. However, some trends have been noted in the United States.

  • Age: Many methamphetamine users are young. Because it is cheaper and longer lasting than cocaine, methamphetamine is becoming popular with persons in their teens and early 20s. The average age at first use was 18.9 years in 2002, 20.4 years in 2003, and 22.1 years in 2004]. The highest rate of methamphetamine use during the past year was that for young adults aged 18 to 25, followed by youth aged 12 to 17, and then adults aged 26 or older  
  • Sex: Among all persons 12 years of age or older, the rate of use during the past year was about the same for males and females (0.7% and 0.5%, respectively) [.
  • Race/ethnicity: The largest numbers methamphetamine users are white. However, the highest rates of methamphetamine use during the past year were those for Native Hawaiians or other Pacific Islanders (2.2%), American Indians or Alaska Natives (1.7%), and person who reported 2 or more races (1.9%). Past-year use among whites (0.7%) and Hispanics (0.5%) was higher than among blacks (including African Americans) (0.2%)..
  • MSM: According to data from the 2004 CDC National HIV Behavioral Surveillance System, overall, a higher percentage of MSM methamphetamine users compared to non-users were white (50.4% vs. 43.5% respectively)].
  • Rural users: Many methamphetamine users in rural areas are white, working class, heterosexual young adults [. Trends in rural areas show that increasing numbers of Latinos, Native Americans and youth are using methamphetamine. Rural users, compared with urban users, are more likely to be heterosexual.

Reasons For Methamphetamine Use

The reasons for using methamphetamine vary.

  • Males and females have reported using methamphetamine for increased energy and productivity, its low cost, self-medication for depression or attention deficits, and the euphoric high
  • Males have reported using methamphetamine for economic reasons, (selling the drug, increased energy to work multiple jobs) and sexual reasons (enhanced libido and endurance)
  • A study of HIV-positive MSM who use methamphetamine found that the most frequently reported motivation for use was to enhance sexual pleasure (reported by nearly 90% of respondents) Other reasons included self-medication of negative feelings associated with HIV-positive serostatus. A similar study of HIV-negative heterosexual adults found that the primary motivations for methamphetamine use were to get high, to get more energy, and to party
  • Females reported using methamphetamine to control weight and to combat fatigue .
  • The culture of methamphetamine use provides a social network―a community―for persons who feel like outsiders  

Methamphetamine Use and HIV Risk Behaviors

A growing body of research supports the relationship between methamphetamine use by MSM and heterosexual populations and an increase in behaviors (sexual and those related to injection drug use) that can put the user at risk for HIV infection.

  • A survey of users of noninjection drugs, conducted in California during the mid-1990s, showed that heterosexual persons and MSM who reported using methamphetamine also had more sex partners, were less likely to use a condom, and were more likely to exchange sex for money or drugs, have sex with an injection drug user, or to have a history of STD―all risk factors for HIV transmission.
  • A qualitative study of gay and bisexual men in Seattle (Washington) and San Jose (California), conducted during 1997–2001, revealed a high prevalence of club drugs (methamphetamine, ecstasy, ketamine, and GHB [gamma hydroxyl butyrate]) in tandem with unsafe sex practices. Many of the respondents reported that they already had HIV infection or AIDS and that they “medicated” their symptoms through their drug use. Respondents reported engaging in unprotected sex as well as trading sex for drugs .
  • A 2001 study conducted among gay and bisexual men in the San Francisco Bay Area showed that of MSM who participated in circuit party weekends, those who used methamphetamine were more than twice as likely to have unprotected anal sex during that weekend with a partner whose HIV status was unknown or different from theirs .
  • According to a 1998 study conducted at publicly funded HIV testing sites in California, HIV-positive MSM may be more likely than HIV-negative MSM to use methamphetamine, and some MSM methamphetamine users may be more likely than other methamphetamine users to use it during sex .
  • An analysis of data of heterosexual men, performed by the California Department of Health Services during 2001–2003 determined that recent methamphetamine use was associated with high-risk sexual behaviors, including anal intercourse, sex with an injection drug user, and sex with a casual or an anonymous female partner .
  • In California, 9.5% of primary and secondary syphilis cases in heterosexual men during 2004 were cases in men with a history of methamphetamine use, continuing a trend of increases in syphilis cases, from 3.1% in 2001, 6.4% in 2002, and 7.3% in 2003 . Syphilis infection is a marker for unprotected sex, a risk factor for HIV infection.
  • During a gonorrhea outbreak in 6 central California counties in 2004, substantial proportions of heterosexual men (38%) and women (28%) reported methamphetamine use, particularly when compared with MSM (8%) . Like syphilis, gonorrhea infection is a marker for unprotected sex, a risk factor for HIV infection.
  • Some evidence suggests that the use of methamphetamine (not injected) by heterosexual men and women is associated with unprotected vaginal sex and with a higher number of sex partners during the past 12 months .

In addition to increasing sexual risk factors, methamphetamine use increases the risk for HIV transmission when the drug is injected. For example, women reported being injected with methamphetamine by sex partners, often with a shared syringe.  According to a Colorado study, people who injected methamphetamine more frequently shared syringes during a methamphetamine binge .

Specific Ways Methamphetamine Use Negatively Affects Thinking and Behavior

  • Methamphetamine use may impair the ability or the desire to be safe, both sexually and when injecting drugs. That impairment, in turn, may lead to experimentation with riskier behaviors in general.
  • Methamphetamine may dry mucosa, which may lead to more chafing and abrasions, which, in turn, could provide an entry for HIV during sexual activity.
  • Methamphetamine use is associated with sexual practices that may increase the likelihood of HIV and other STD transmission (e.g., long duration, leading to chafing or sores; multiple partners; lack of inhibition; low level of condom use).
  • Methamphetamine use may cause mental confusion and impair the ability to take medications that have been prescribed for HIV infection or other conditions.

Public Health Implications

Methamphetamine use is a public health issue. There is a need for a broad approach in addressing methamphetamine use and risk for infection with HIV and other STDs―one that includes heterosexual adults and adolescents as well as MSM. HIV and STD prevention and treatment programs could be enhanced to include assessment for methamphetamine use, with referrals to methamphetamine treatment, primary testing, and sexual health promotion.

Hepatitis C virus (HCV) infection is the most common chronic bloodborne infection in the United States; approximately 2.7 million persons are chronically infected . Although HCV is not efficiently transmitted sexually, persons at risk for infection through injection-drug use might seek care in STD treatment facilities, HIV counseling and testing facilities, correctional facilities, drug treatment facilities, and other public health settings where STD and HIV prevention and control services are available.

Persons newly infected with HCV typically are either asymptomatic or have a mild clinical illness. HCV RNA can be detected in blood within 1–3 weeks after exposure. The average time from exposure to antibody to HCV (anti-HCV) seroconversion is 8–9 weeks, and anti-HCV can be detected in >97% of persons by 6 months after exposure. Chronic HCV infection develops in 60%–85% of HCV-infected persons; 60%–70% of chronically infected persons have evidence of active liver disease. The majority of infected persons might not be aware of their infection because they are not clinically ill. However, infected persons serve as a source of transmission to others and are at risk for CLD or other HCV-related chronic diseases for decades after infection.

HCV is most efficiently transmitted through large or repeated percutaneous exposure to infected blood (e.g., through transfusion of blood from unscreened donors or through use of injecting drugs), although less efficient, occupational, perinatal, and sexual exposures also can result in transmission of HCV.

The role of sexual activity in the transmission of HCV has been controversial. Case-control studies have reported an association between acquiring HCV infection and exposure to a sex contact with HCV infection or exposure to multiple sex partners. Surveillance data also indicate that 15%–20% of persons reported with acute HCV infection have a history of sexual exposure in the absence of other risk factors. Case reports of acute HCV infection among HIV-positive MSM who deny injecting-drug use have indicated that this occurrence is frequently associated with other STDs (e.g., syphilis). In contrast, a low prevalence (average: 1.5%) of HCV infection has been demonstrated in studies of long-term spouses of patients with chronic HCV infection who had no other risk factors for infection, and multiple published studies have demonstrated the prevalence of HCV infection among MSM who have not reported a history of injecting-drug use to be no higher than that of heterosexuals. Because sexual transmission of bloodborne viruses is more efficient among homosexual men compared with heterosexual men and women, the reason that HCV infection rates are not substantially higher among MSM compared with heterosexuals is unclear. Overall, these findings indicate that sexual transmission of HCV is possible but inefficient. Additional data are needed to determine whether sexual transmission of HCV might be increased in the context of HIV infection or other STDs.

Diagnosis and Treatment

Anti-HCV testing is recommended for routine screening of asymptomatic persons based on their risk for infection or based on a recognized exposure). For such persons, testing for HCV infection should include the use of an FDA-cleared test for antibody to HCV (i.e., immunoassay, EIA, or enhanced chemiluminescence assay and, if recommended, a supplemental antibody test).

Persons counseled and tested for HCV infection and determined to be anti-HCV positive should be evaluated (by referral or consultation, if appropriate) for presence of active infection, presence or development of CLD, and for possible treatment. Reverse transcriptase polymerase chain reaction to detect HCV RNA may be used to confirm the diagnosis of current HCV infection, and an elevated alanine aminotrans-ferase (ALT) level is biochemical evidence of CLD. Combination therapy with pegylated interferon and ribavirin is the treatment of choice for patients with chronic hepatitis C. Because of advances in the field of antiviral therapy for acute and chronic hepatitis C, clinicians should consult with specialists knowledgeable about management of hepatitis C infection.


No vaccine for hepatitis C is available, and prophylaxis with immune globulin is not effective in preventing HCV infection after exposure. Reducing the burden of HCV infection and disease in the United States requires implementation of both primary and secondary prevention activities. Primary prevention reduces or eliminates HCV transmission; secondary prevention activities reduce liver and other chronic diseases in HCV-infected persons by identifying them and providing appropriate medical management and antiviral therapy, if appropriate.

Persons seeking care in STD clinics or other primary-care settings should be screened to identify those who should be offered HCV counseling and testing. In STD clinics and other settings that serve large numbers of persons at high risk for bloodborne infections (e.g., correctional settings), the major risk factor for which to screen for HCV infection is injection of illegal drugs. In addition, for clinical management issues, all persons with HIV infection should also be offered HCV counseling and testing. Other risk factors for which routine HCV testing is recommended include persons

  • who had a blood transfusion or solid organ transplant before July 1992,
  • who received clotting factor concentrates produced before 1987,
  • who have been on long-term dialysis, and
  • those with signs and symptoms of liver disease (e.g., abnormal ALT).

Persons who test positive for anti-HCV should be provided information regarding 1) how to protect their liver from further harm, 2) how to prevent transmission to others, and 3) the need for medical evaluation for CLD and possible treatment.

  • To protect their liver from further harm, HCV-positive persons should be advised to avoid alcohol and taking any new medicines (including OTC and herbals) without checking with their doctor.
  • To reduce the risk for transmission to others, HCV-positive persons should be advised to 1) not donate blood, body organs, other tissue, or semen; 2) not share any personal items that might have blood on them (e.g., toothbrushes and razors); and 3) cover cuts and sores on the skin to keep from spreading infectious blood or secretions. HCV-positive persons with one long-term, steady sex partner do not need to change their sexual practices. They should discuss the low but present risk for transmission with their partner and discuss the need for counseling and testing. HCV-positive women do not need to avoid pregnancy or breastfeeding.
  • HCV-positive persons should be evaluated (by referral or consultation, if appropriate) for presence of development of CLD, including assessment of liver function tests, assessment for severity of liver disease and possible treatment, and determination of the need for hepatitis A and B vaccination.

Persons who test negative for anti-HCV who had an exposure previously should be reassured that they are not infected.

Regardless of test results, persons who use or inject illegal drugs should be counseled to

  • stop using and injecting drugs;
  • enter and complete substance abuse treatment, including relapse prevention;
  • take the following steps to reduce personal and public health risks, if they continue to inject drugs:
    • never reuse or share syringes, water, or drug preparation equipment;
    • use only syringes obtained from a reliable source (e.g., pharmacies);
    • use a new, sterile syringe to prepare and inject drugs;
    • if possible, use sterile water to prepare drugs; otherwise, use clean water from a reliable source (e.g., fresh tap water);
    • use a new or disinfected container (“cooker”) and a new filter (“cotton”) to prepare drugs;
    • clean the injection site before injection with a new alcohol swab;
    • safely dispose of syringes after one use; and
    • get vaccinated for hepatitis A and B.

Postexposure Follow-Up

No PEP has been demonstrated to be effective against HCV. Testing to determine whether HCV infection has developed is recommended for health-care workers after percutaneous or permucosal exposures to HCV-positive blood and for children born to HCV-positive women.

Special Considerations


Routine testing for HCV infection is not recommended for all pregnant women. Pregnant women with a known risk factor for HCV infection should be offered counseling and testing. Patients should be advised that approximately five of every 100 infants born to HCV-infected woman become infected. This infection occurs predominantly during or near delivery, and no treatment or delivery method is known to decrease this risk. The risk is increased by the presence of maternal HCV viremia at delivery and also is greater (2–3 times) if the woman is coinfected with HIV. Breastfeeding does not appear to transmit HCV, although HCV-positive mothers should consider abstaining from breastfeeding if their nipples are cracked or bleeding. Infants born to HCV-positive mothers should be tested for HCV infection and, if positive, evaluated for the presence of CLD.

HIV Infection

Because of the high prevalence of HIV/HCV coinfection and because of critical clinical management issues for coinfected persons, all HIV-infected persons should be tested for HCV. Because a small percentage of coinfected persons fail to acquire HCV antibodies, HCV RNA should be tested in HIV-positive persons with unexplained liver disease who are anti-HCV negative. The course of liver disease is more rapid in HIV/HCV coinfected persons, and the risk for cirrhosis is nearly twice that in persons with HCV infection alone. Treatment of HCV in coinfected persons might improve tolerance to highly active antiretroviral therapy (HAART) for HIV infection because of the increased risk for hepatotoxicity from HAART with HCV infection. However, anti-HCV treatment in coinfected persons is still investigational, and based on ongoing clinical trials, more data are needed to determine the best regimens.

In 1984, 3 years after the first reports of a disease that was to become known as AIDS, researchers discovered the primary causative viral agent, the human immunodeficiency virus type 1 (HIV-1). In 1986, a second type of HIV, called HIV-2, was isolated from AIDS patients in West Africa, where it may have been present decades earlier. Studies of the natural history of HIV-2 are limited, but to date comparisons with HIV-1 show some similarities while suggesting differences. Both HIV-1 and HIV-2 have the same modes of transmission and are associated with similar opportunistic infections and AIDS. In persons infected with HIV-2, immunodeficiency seems to develop more slowly and to be milder. Compared with persons infected with HIV-1, those with HIV-2 are less infectious early in the course of infection. As the disease advances, HIV-2 infectiousness seems to increase; however, compared with HIV-1, the duration of this increased infectiousness is shorter. HIV-1 and HIV-2 also differ in geographic patterns of infection; the United States has few reported cases.

Which countries have a high prevalence* of HIV-2 infection?

HIV-2 infections are predominantly found in Africa. West African nations with a prevalence of HIV-2 of more than 1% in the general population are Cape Verde, Côte d'Ivoire (Ivory Coast), Gambia, Guinea-Bissau, Mali, Mauritania, Nigeria, and Sierra Leone. Other West African countries reporting HIV-2 are Benin, Burkina Faso, Ghana, Guinea, Liberia, Niger, São Tomé, Senegal, and Togo. Angola and Mozambique are other African nations where the prevalence of HIV-2 is more than 1%.

*Prevalence is the proportion of cases present in a population at a given point in time.

What is known about HIV-2 in the United States?

The first case of HIV-2 infection in the United States was diagnosed in 1987. Since then, the Centers for Disease Control and Prevention (CDC) has worked with state and local health departments to collect demographic, clinical, and laboratory data on persons with HIV-2 infection.

Of the 79 infected persons, 66 are black and 51 are male. Fifty-two were born in West Africa, 1 in Kenya, 7 in the United States, 2 in India, and 2 in Europe. The region of origin was not known for 15 of the persons, although 4 of them had a malaria-antibody profile consistent with residence in West Africa. AIDS-defining conditions have developed in 17, and 8 have died.

These case counts represent minimal estimates because completeness of reporting has not been assessed. Although AIDS is reported uniformly nationwide, the reporting of HIV infection, including HIV-2 infection, differs from state to state according to state policy.

Who should be tested for HIV-2?

Because epidemiologic data indicate that the prevalence of HIV-2 in the United States is very low, CDC does not recommend routine HIV-2 testing at U.S. HIV counseling and test sites or in settings other than blood centers. However, when HIV testing is to be performed, tests for antibodies to both HIV-1 and HIV-2 should be obtained if demographic or behavioral information suggests that HIV-2 infection might be present.

Persons at risk for HIV-2 infection include

  • Sex partners of a person from a country where HIV-2 is endemic (refer to countries listed earlier)
  • Sex partners of a person known to be infected with HIV-2
  • People who received a blood transfusion or a nonsterile injection in a country where HIV-2 is endemic
  • People who shared needles with a person from a country where HIV-2 is endemic or with a person known to be infected with HIV-2
  • Children of women who have risk factors for HIV-2 infection or are known to be infected with HIV-2

HIV-2 testing also is indicated for

  • People with an illness that suggests HIV infection (such as an HIV-associated opportunisticinfection) but whose HIV-1 test result is not positive
  • People for whom HIV-1 Western blot exhibits the unusual indeterminate test band pattern of gag (p55, p24, or p17) plus pol (p66, p51, or p32) in the absence of env (gp160, gp120, or gp41)

Among all HIV-infected people, the prevalence of HIV-2 is very low compared with HIV-1. However, the potential risk for HIV-2 infection in some populations (such as those listed) may justify routine HIV-2 testing for all people for whom HIV-1 testing is warranted. The decision to implement routine HIV-2 testing requires consideration of the number of HIV-2-infected persons whose infection would remain undiagnosed without routine HIV-2 testing compared with the problems and costs associated with the implementation of HIV-2 testing.

The development of antibodies is similar in HIV-1 and HIV-2. Antibodies generally become detectable within 3 months of infection. Testing for HIV-2 antibodies is available through private physicians or state and local health departments.

Are blood donors tested for HIV-2?

Since 1992, all U.S. blood donations have been tested with a combination HIV-1/HIV-2 enzyme immunoassay test kit that is sensitive to antibodies to both viruses. This testing has demonstrated that HIV-2 infection in blood donors is extremely rare. All donations detected with either HIV-1 or HIV-2 are excluded from any clinical use, and donors are deferred from further donations.

Is the clinical treatment of HIV-2 different from that of HIV-1?

Little is known about the best approach to the clinical treatment and care of patients infected with HIV-2. Given the slower development of immunodeficiency and the limited clinical experience with HIV-2, it is unclear whether antiretroviral therapy significantly slows progression. Not all of the drugs used to treat HIV-1 infection are as effective against HIV-2. In vitro (laboratory) studies suggest that nucleoside analogs are active against HIV-2, though not as active as against HIV-1. Protease inhibitors should be active against HIV-2. However, non-nucleoside reverse transcriptase inhibitors (NNRTIs) are not active against HIV-2. Whether any potential benefits would outweigh the possible adverse effects of treatment is unknown.

Monitoring the treatment response of patients infected with HIV-2 is more difficult than monitoring people infected with HIV-1. No FDA-licensed HIV-2 viral load assay is available yet. Viral load assays used for HIV-1 are not reliable for monitoring HIV-2. Response to treatment for HIV-2 infection may be monitored by following CD4+ T-cell counts and other indicators of immune system deterioration, such as weight loss, oral candidiasis, unexplained fever, and the appearance of a new AIDS-defining illness. More research and clinical experience is needed to determine the most effective treatment for HIV-2.

The optimal timing for antiretroviral therapy (i.e., soon after infection, when symptoms appear, or when CD4+ T cell counts fall below a certain level) remains under review by clinical experts. Guidelines for the Use of Antiretroviral Agents in HIV-Infected Adults and Adolescents, by the Department of Health and Human Services Panel on Clinical Practices for Treatment of HIV Infection, may be helpful to the clinician who is caring for a patient infected with HIV-2; however, the recommendations on viral load monitoring and the use of NNRTIs would not apply to patients with HIV-2 infection. Copies of the guidelines are available from the CDC National Prevention Information Network (1 800 458-5231) and from its Web site ( The guidelines also are available from the HIV/AIDS Treatment Information Service (1 800 448-0440; Fax 301 519-6616; TTY 1 800 243-7012) and on the ATIS Web site (

What is known about HIV-2 infection in children?

HIV-2 infection in children is rare. Compared with HIV-1, HIV-2 seems to be less transmissible from an infected mother to her child. However, cases of transmission from an infected woman to her fetus or newborn have been reported among women who had primary HIV-2 infection during their pregnancy. Zidovudine therapy has been demonstrated to reduce the risk for perinatal HIV-1 transmission and also might prove effective for reducing perinatal HIV-2 transmission. Zidovudine therapy should be considered for HIV-2-infected expectant mothers and their newborns, especially for women who become infected during pregnancy.

How should physicians and patients decide whether to start treatment for HIV-2?

Physicians caring for patients with HIV-2 infection should decide whether to initiate antiretroviral therapy after discussing with their patients what is known, what is not known, and the possible adverse effects of treatment.

What can be done to control the spread of HIV-2?

Continued surveillance is needed to monitor HIV-2 in the U.S. population because the possibility for further spread of HIV-2 exists, especially among injecting drug users and people with multiple sex partners. Programs aimed at preventing the transmission of HIV-1 also can help to prevent and control the spread of HIV-2.

What are the Symptoms of HIV?

The symptoms of HIV vary, depending on the individual and what stage of the disease you are in.

Early Stage of HIV: Symptoms

Within 2-4 weeks after HIV infection, many, but not all, people experience flu-like symptoms, often described as the “worst flu ever.” This is called “acute retroviral syndrome” (ARS) or “primary HIV infection,” and it’s the body’s natural response to the HIV infection.
Symptoms can include:

  • Fever (this is the most common symptom)
  • Swollen glands
  • Sore throat
  • Rash
  • Fatigue
  • Muscle and joint aches and pains
  • Headache

These symptoms can last anywhere from a few days to several weeks. However, you should not assume you have HIV if you have any of these symptoms. Each of these symptoms can be caused by other illnesses. Conversely, not everyone who is infected with HIV develops ARS. Many people who are infected with HIV do not have any symptoms at all for 10 years or more. 

You cannot rely on symptoms to know whether you have HIV. The only way to know for sure if you are infected with HIV is to get tested. If you think you have recently been exposed to HIV—if you have had oral, vaginal or anal sex without a condom with a known HIV positive person or a partner whose HIV status you do not know or shared needles to inject drugs—get an HIV test. Traditional HIV tests detect HIV antibodies. But during this early stage your body is not yet producing these antibodies. A new HIV test was approved in 2013 that can detect the presence of HIV in your body during this early stage of infection. So no matter where you get tested, it is very important to let your provider know that you may have been recently infected with HIV and you would like to be tested for acute HIV. Use the HIV/AIDS Testing and Services Locator to find a HIV testing site near you or enter your location here:

It is important to remember that with or without symptoms, you are at particularly high risk of transmitting HIV to your sexual or drug using partners during this time because the levels of HIV in your blood stream are very high. For this reason, it is very important to take steps to reduce your risk of transmission.

The Clinical Latency Stage

After the early stage of HIV infection, the disease moves into a stage called the “clinical latency” stage. “Latency” means a period where a virus is living or developing in a person without producing symptoms. During the clinical latency stage, people who are infected with HIV experience no HIV-related symptoms, or only mild ones. (This stage is sometimes called “asymptomatic HIV infection” or “chronic HIV infection.”)

During the clinical latency stage, the HIV virus reproduces at very low levels, although it is still active. If you take antiretroviral therapy (ART), you may live with clinical latency for several decades because treatment helps keep the virus in check. (Read more about HIV treatment.) For people who are not on ART, this clinical latency stage lasts an average of 10 years, but some people may progress through this phase faster.

It is important to remember that people in this symptom-free period are still able to transmit HIV to others even if they are on ART, although ART greatly reduces the risk of transmission. Again, the only way to know for sure if you are infected with HIV is to get tested. Tests are available that can detect the virus at this stage. Use the HIV/AIDS Testing and Services Locator to find a HIV testing site near you.

Progression to AIDS: Symptoms

If you have HIV and you are not taking HIV medication (antiretroviral therapy), eventually the HIV virus will weaken your body’s immune system. The onset of symptoms signals the transition from the clinical latency stage to AIDS (Acquired Immunodeficiency Syndrome).
During this late stage of HIV infection, people infected with HIV may have the following symptoms:

  • Rapid weight loss
  • Recurring fever or profuse night sweats
  • Extreme and unexplained tiredness
  • Prolonged swelling of the lymph glands in the armpits, groin, or neck
  • Diarrhea that lasts for more than a week
  • Sores of the mouth, anus, or genitals
  • Pneumonia
  • Red, brown, pink, or purplish blotches on or under the skin or inside the mouth, nose, or eyelids
  • Memory loss, depression, and other neurologic disorders.

Each of these symptoms can be related to other illnesses. So, as noted above, the only way to know for sure if you are infected with HIV is to get tested.

The Stages of HIV Infection
Key Points

  • Without treatment, HIV infection advances in stages, getting worse over time.
  • The three stages of HIV infection are (1) acute HIV infection, (2) chronic HIV infection, and (3) acquired immunodeficiency syndrome (AIDS).
  • HIV can be transmitted (spread) during any stage of infection, but the risk is greatest during acute HIV infection.
  • There is no cure for HIV infection, but HIV medicines (called antiretroviral medicines) can prevent HIV from advancing to AIDS. HIV medicines help people with HIV live longer, healthier lives. HIV medicines also reduce the risk of HIV transmission (the spread of HIV to others).

Without treatment, HIV infection advances in stages, getting worse over time. HIV gradually destroys the immune system and eventually causes acquired immunodeficiency syndrome (AIDS). 

There is no cure for HIV infection, but HIV medicines (called antiretroviral medicines) can prevent HIV from advancing to AIDS. HIV medicines help people with HIV live longer, healthier lives. HIV medicines also reduce the risk of HIV transmission (the spread of HIV to others). 

There are three stages of HIV infection:

1.)        Acute HIV Infection
Acute HIV infection is the earliest stage of HIV. Acute HIV infection generally develops within 2 to 4 weeks after a person is infected with HIV. During acute HIV infection, many people have flu-like symptoms, such as fever, headache, and rash. In this acute stage of infection, HIV multiplies rapidly and spreads throughout the body. The virus attacks and destroys the infection-fighting CD4 cells of the immune system. HIV can be transmitted during any stage of infection, but the risk is greatest during acute HIV infection.

2.)        Chronic HIV Infection
The second stage of HIV infection is chronic HIV infection (also called asymptomatic HIV infection or clinical latency.) During this stage of the disease, HIV continues to multiply in the body but at very low levels. People with chronic HIV infection may not have any HIV-related symptoms, but they can still spread HIV to others. Without treatment with HIV medicines, chronic HIV infection usually advances to AIDS in 10 to 12 years.

3.)        AIDS 
AIDS is the final stage of HIV infection. Because HIV has destroyed the immune system, the body can’t fight off opportunistic infections and cancer. (Examples of opportunistic infections include pneumonia and tuberculosis.) AIDS is diagnosed when a person with HIV has a CD4 count of less than 200 cells/mm3 and/or one or more opportunistic infections. Without treatment, people with AIDS typically survive about 3 years.

HIV and Women
Key Points

  • At the end of 2010, one in four people living with HIV in the United States was a woman. The most common way that women get HIV is through sex with an HIV-infected male partner (also called sexual transmission). 
  • Several factors increase the risk of HIV infection in women. For example, during unprotected vaginal sex, HIV passes more easily from a man to a woman than from a woman to a man. (Unprotected sex is sex without a condom). A women’s risk of HIV can also increase because of her partner’s high-risk behaviors, such as unprotected sex with other partners or injection drug use.
  • Treatment with HIV medicines (also called antiretroviral therapy) is recommended for everyone infected with HIV. In general, recommendations on the use of HIV medicines are the same for men and women.
  • Women with HIV take HIV medicines during pregnancy and childbirth to prevent mother-to-child transmission of HIV and to protect their own health. 

Does HIV affect women?
Yes. According to the U.S. Centers for Disease Control and Prevention (CDC), at the end of 2010, one in four people living with HIV in the United States was a woman. 

Here are more facts about HIV among women from CDC:

  • Of the total number of new HIV infections in women in 2011, 64% occurred in African-American women, 17% in white women, and 15% in Hispanic/Latino women. 
  • Most new HIV infections in women in 2011 were diagnosed in women 25 to 44 years old.
  • The most common way that women get HIV is through sex with an HIV-infected male partner (also called sexual transmission).  

Even though HIV testing is recommended for everyone 13 to 64 years old, 15% of women in the United States who have HIV don’t know that they are HIV-infected. (HIV testing is also recommended for anyone at increased risk for HIV infection regardless of age.)  
What factors put women at risk for HIV?
HIV is spread through the blood, semen, vaginal fluids, or breast milk of a person infected with HIV. The spread of HIV from person to person is called HIV transmission.  

The main risk factors for HIV transmission are the same for women as for men:

  • Having unprotected sex (sex without a condom) with a person infected with HIV
  • Sharing drug injection equipment (such as needles and syringes) with a person who has HIV

Several factors increase the risk of HIV infection in women. For example, during unprotected vaginal sex, HIV passes more easily from a man to a woman than from a woman to a man. Some age-related factors, such as an immature genital tract in adolescent girls or atrophy (shrinking) of the vagina in older women, may make it easier for HIV to infect a woman than a man. A woman’s risk of HIV can also increase because of her partner’s high-risk behaviors, such as unprotected sex with other partners or injection drug use.

Are there issues that can affect HIV treatment in women?

Treatment with HIV medicines (also called antiretroviral therapy or ART) helps people with HIV live longer, healthier lives. ART is recommended for everyone infected with HIV. In general, recommendations on the use of HIV medicines are the same for men and women. 

Some side effects from HIV medicines may be more frequent or more severe in women than in men. For example, the risk of liver-related side effects due to  nevirapine (brand name: Viramune) is greater for women than for men.  Birth control and pregnancy are also examples of issues that affect the use of HIV medicines in women.

Birth control 
Some HIV medicines may reduce the effectiveness of birth control pills, in which case, a woman may have to use an additional or different form of birth control.

Women with HIV take HIV medicines during pregnancy and childbirth to reduce the risk of mother-to-child transmission of HIV and to protect their health. 

The following factors affect the use of HIV medicines during pregnancy:

  • Changes during pregnancy that can affect how the body processes HIV medicines. Because of these changes, the dose of an HIV medicine may change during pregnancy.
  • The increased risk of certain side effects from some HIV medicines, such as nevirapine. 
  • The potential risk of birth defects with use of some HIV medicines. No HIV medicines have been clearly linked to birth defects. There is some concern that taking efavirenz (brand name: Sustiva) in the first weeks of pregnancy may increase the risk of birth defects, but this is not certain. Women with HIV who take HIV medicines during pregnancy are encouraged to enroll in the Antiretroviral Pregnancy Registry. The registry is a project established to monitor prenatal exposures to HIV medicines and to detect any potential increase in the risk of related birth defects. Pregnant women exposed to HIV medicines voluntarily enroll in the Registry through their health care providers.

Preventing Mother-to-Child Transmission of HIV During Childbirth
Key Points

  • Pregnant women with HIV receive HIV medicines during childbirth (also called labor and delivery) to reduce the risk of mother-to-child transmission of HIV. 
  • Recommendations on the use of HIV medicines during childbirth take into account whether a woman is already taking HIV medicines when she goes into labor and the level of HIV in her blood (HIV viral load). 
  • Women already taking HIV medicines should continue taking their HIV medicines as much as possible during childbirth. In addition to taking their HIV medicines, women who have a high viral load near delivery may also receive zidovudine (brand name: Retrovir) by intravenous (IV) injection injection. Women who did not take HIV medicines during pregnancy may also receive IV zidovudine during childbirth. 
  • In some situations, a pregnant woman with HIV may have a scheduled cesarean delivery (also called a C-section) at 38 weeks of pregnancy (2 weeks before a woman’s expected due date). A scheduled cesarean delivery is planned ahead of time.

Childbirth (also called labor and delivery) is the process of giving birth. A pregnant woman with HIV can pass HIV to her baby at any time during pregnancy, including during childbirth. The risk of mother-to-child transmission of HIV is greatest during delivery when a baby passes through the birth canal and is exposed to any HIV in an HIV-infected mother’s blood or other fluids. 

How is the risk of mother-to-child transmission of HIV reduced during childbirth? Pregnant women with HIV receive HIV medicines during childbirth to prevent mother-to-child transmission of HIV.

In some situations, a pregnant woman with HIV may have a scheduled cesarean delivery (also called a C-section) at 38 weeks of pregnancy (2 weeks before a woman’s expected due date). A scheduled cesarean delivery is planned ahead of time.

All decisions regarding the use of HIV medicines during childbirth and the choice of a cesarean delivery to prevent mother-to-child transmission of HIV should be made jointly by a woman and her health care providers.

Do pregnant women with HIV all receive the same HIV medicines during childbirth?
The choice of HIV medicines to use during childbirth depends on a woman’s individual situation. Recommendations on medicines to use take into account whether a woman is already taking HIV medicines and the level of HIV in her blood (HIV viral load). 

Women who are already taking HIV medicines when they go into labor should continue taking their HIV medicines as much as possible during childbirth. 

In addition to taking their HIV medicines by mouth, some women may also receive  zidovudine (brand name: Retrovir) by intravenous (IV) injection. For example, women who have a high viral load near delivery may also receive IV zidovudine. Women who did not receive HIV medicines during their pregnancies may also receive IV zidovudine during childbirth. 

Why does zidovudine prevent mother-to-child transmission of HIV even in women who did not take HIV medicine during pregnancy?

Zidovudine is an HIV medicine that passes easily from a pregnant woman to her unborn baby across the placenta (also called the afterbirth). Once in a baby’s system, the HIV medicine protects the baby from infection with any HIV that passed from mother to child during childbirth. For this reason, the use of zidovudine during childbirth prevents mother-to-child transmission of HIV even in women who did not take HIV medicines during pregnancy. 

When should a pregnant woman with HIV have a scheduled cesarean delivery to prevent mother-to-child transmission of HIV?

A scheduled cesarean delivery at 38 weeks to prevent mother-to-child transmission of HIV is recommended in the following situations:

  • When a woman has a viral load greater than 1,000 copies/mL near delivery 
  • When a woman’s viral load is unknown

In these situations, a woman with HIV should have a scheduled cesarean delivery even if she took HIV medicine during pregnancy. The cesarean delivery should be performed before a woman goes into labor and before her water breaks (also called rupture of membranes).

The risk of mother-to-child transmission of HIV is low for women who take HIV medicines during pregnancy and have a viral load less than 1,000 copies/mL near the time of delivery. In this situation, a woman with HIV should have a vaginal delivery unless there are other medical reasons for a cesarean delivery. 

What happens if an HIV-infected woman goes into labor or her water breaks before her scheduled cesarean delivery?

Once a woman goes into labor or her water breaks, a cesarean delivery may no longer prevent mother-to-child transmission of HIV. In this situation, the decision whether to deliver the baby by cesarean section is based on medical reasons and not to prevent mother-to-child transmission of HIV.

Preventing Mother-to-Child Transmission of HIV After Birth
Key Points

  • For 6 weeks after birth, babies born to women with HIV should receive an HIV medicine called zidovudine (brand name: Retrovir). The HIV medicine protects the babies from infection with any HIV that passed from mother to child during childbirth.
  • HIV testing for babies born to women with HIV is recommended at 14 to 21 days after birth, at 1 to 2 months, and again at 4 to 6 months. Testing should be done using a test that looks directly for HIV in the blood (called a virologic HIV test).
  • Results on two virologic tests must be negative to be certain that a baby is not infected with HIV. The first negative result must be from a test done when a baby is 1 month or older and the second result from a test done when a baby is 4 months or older. Results on two HIV virologic tests must be positive to know for certain that a baby is infected with HIV
  • If test results show that a baby has HIV, the baby will be switched from zidovudine to a combination of HIV medicines. HIV medicines help children infected with HIV live healthier lives.  
  • Because HIV can spread in breast milk, HIV-infected women in the United States should not breastfeed their babies. In the United States, infant formula is a safe and healthy alternative to breast milk.

How many babies in the United States are born with HIV?
Fewer than 200 babies with HIV are born each year in the United States.

The risk of mother-to-child transmission of HIV is low when:

  • Women with HIV receive HIV medicine during pregnancy and childbirth and, in certain situations, have a scheduled cesarean delivery (also called a C-section).
  • Babies born to women with HIV receive HIV medicines for 6 weeks after birth and are not breastfed. (HIV can pass from mother to child in breast milk.)

How soon after birth do babies born to women with HIV begin to receive HIV medicines to prevent mother-to-child transmission of HIV?

Within 6 to 12 hours after birth, all babies born to women with HIV should receive an HIV medicine called zidovudine (brand name: Retrovir). In general, the babies receive zidovudine for 6 weeks. In certain situations, a baby may receive other HIV medicines in addition to zidovudine. The HIV medicine protects the babies from infection with any HIV that passed from mother to child during childbirth.


Problems within HIPAA:

This is a new set of laws which are designed by the US Congress to regulate the healthcare industry. Because of this, states, which have regulated healthcare previously, have a variety of laws which are usually similar to those of HIPAA, but different enough that there is an ongoing task force to determine which laws should be changed so that Federal and State law governing the privacy of healthcare are more closely the same. When state laws are more restrictive the HIPAA rules do not preempt state laws. Additionally, all states will continue to investigate and regulate therapists with regard to confidentiality, ethics, and integrity.

Although HIPAA went into effect in April 2003, and was to become the law of the land by October 16, 2003, it is clear at this time (November 2003) that this has not yet occurred. Those healthcare providers who have small practices and have used electronic transmission of billing provided by Medicare have been told that the new software is not yet complete to replace the system which has been offered for free to practitioners with a small number of Medicare patients. The pre-HIPAA software continues to be adequate to submit billing for now.

Additionally, HIPAA does not give clear black and white rules about when therapists may and may not disclose information. Perhaps some of these rules will eventually be decided through case law. Your issue, as an individual clinician is to make certain that you are not the one whose name appears in the case law which will eventually be cited.

HIPAA, at this time, does not create a national data bank for offenders. However, if you are successfully sued by a patient for failing to follow HIPAA and failing to protect the confidentiality of records, you will find yourself in the National Data Bank anyway.

Psychotherapists who work on a fee-for-service, out-of-pocket, cash only basis 100% of the time and who never bill insurance either directly or by providing their patients with the means to bill their own insurance carrier can, so far remain free of the HIPAA regulations.

HIPAA is a long, rambling, complex set of laws. In many places it is unclear and difficult to interpret. If one looks at the law with a particular question in mind, the problems become very difficult indeed. HIPAA will continue to change. It is necessary to stay in touch with one’s professional organizations to stay current with the law.

The privacy and security of health information is an important concern for all those delivering healthcare and is especially crucial for those who care for HIV/AIDS patients. You should be aware that any inappropriate disclosure of their condition may have serious consequences for your patients.  AIDS-related stigma and discrimination persist and people with HIV/AIDS continue to be discriminated against in health care, housing, and the workplace.  Fear of stigma and discrimination also affects their decision to obtain care, as it may discourage them from seeking HIV testing and treatment.  Thus, it is crucial that you adhere to the privacy and security rules that protect your patients’ rights.

All healthcare providers are required to comply with Federal and State laws that protect patients’ health information.  The first and most extensive Federal legislation on health privacy and security is the Health Insurance Portability and Accountability Act of 1996 (HIPAA).  This legislation defines what health information must be protected and stipulates what must be done to protect patients’ privacy and security.  While HIPAA does not specifically address HIV/AIDS, its regulations have been important for protecting HIV/AIDS patients from discrimination related to their condition.  

Recent growth in the use of health IT presents new benefits and potential risks for the privacy and security of patients’ health information.  Since the enactment of HIPAA in 1996, the use of electronic health information technology (IT) has grown.  Vendors’ health IT systems have become increasingly sophisticated and providers have become more accepting of their use.  In addition, the Federal government funded programs to encourage providers to purchase, adopt, implement, and demonstrate meaningful use of electronic health record (EHR) systems and will eventually penalize Medicare providers do not meaningfully use EHR technologies.  

While health IT offers you and your patients the opportunity for better quality and more efficient care, widespread use of health IT also presents challenges to privacy and security.  To address these challenges, the Federal government’s Health Information Technology for Economic and Clinical Health Act (HITECH) of the American Recovery and Reinvestment Act of 2009 (ARRA) strengthened some HIPAA requirements for privacy and security.  An interim rule expands individuals’ rights to access their health information and restricts certain types of disclosures of protected health information to health plans; requires business associates of HIPAA-covered entities to be under most of the same rules as the covered entities; sets new limitations on the use and disclosure of protected health information for marketing and fundraising; and prohibits the sale of protected health information without patient authorization.  These and other changes to HIPAA’s rules were proposed on July 14, 2010 and are already in effect.  All covered providers must comply with these Federal rules and all other applicable state and local regulations.  

What Are the Specific Privacy and Security Needs of HIV/AIDS Patients?

To understand the answer to this question, you need to know how privacy, confidentiality, and security are defined:

  • Privacy refers to an individual’s right to control both access to and use of his or her health information. 
  • Confidentiality relates to the right of an individual to the protection of their health information during storage, transfer, and use, in order to prevent unauthorized disclosure of that information to third parties.
  • Security consists of the protections or safeguards put in place to secure protected health information (PHI).  It requires that administrative, technical, and physical safeguards are developed and used.  

Discussing, diagnosing, and treating HIV/AIDS is a sensitive, private issue between a patient and his or her provider.  This privacy is especially important, because as mentioned in the introduction, any breach of privacy may result in stigmatization or discrimination against HIV/AIDS patients.  Patients who are concerned that their health information will not be held private or secure may be discouraged from being tested for HIV and may be dissuaded from pursuing or adhering to recommended treatment regimens.  

The need for privacy and security must be carefully balanced with the appropriate sharing of patient information.  Health IT poses risks for maintaining patient privacy and security, but also offers you and your HIV/AIDS patients potential benefits.  There are instances in which you must reveal patient information to someone other than the patient.  You are required to report the names of persons who have a positive HIV test to public health authorities for infectious disease surveillance.  In some States you are also required to report the names of partners of those who test positive for HIV.  
You may also share a patient’s medical information with the patient’s other medical providers to coordinate care and to manage HIV/AIDS as a chronic condition.  The policies and regulations that have been put in place will allow you to share patient health information when necessary and appropriate, while maintaining the confidentiality, privacy, and security of this information.


  • The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).1 The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals' privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.

    A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.

    This is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Rule are obligated to comply with all of its applicable requirements and should not rely on this summary as a source of legal information or advice.

Statutory and Regulatory Background

  • The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996. Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions.

    HIPAA required the Secretary to issue privacy regulations governing individually identifiable health information, if Congress did not enact privacy legislation within three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, 1999. The Department received over 52,000 public comments. The final regulation, the Privacy Rule, was published December 28, 2000.2 

In March 2002, the Department proposed and released for public comment modifications to the Privacy Rule. The Department received over 11,000 comments.The final modifications were published in final form on August 14, 2002.

Who is Covered by the Privacy Rule

The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”). Health Plans. Individual and group plans that provide or pay the cost of medical care are covered entities.4 Health plans include health, dental, vision, and prescription drug insurers, health maintenance organizations (“HMOs”), Medicare, Medicaid, Medicare+Choice and Medicare supplement insurers, and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. There are exceptions—a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity. Two types of government-funded programs are not health plans: (1) those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program; and (2) those programs whose principal activity is directly providing health care, such as a community health center,5 or the making of grants to fund the direct provision of health care. Certain types of insurance entities are also not health plans, including entities providing only workers’ compensation, automobile insurance, and property and casualty insurance. If an insurance entity has separable lines of business, one of which is a health plan, the HIPAA regulations apply to the entity with respect to the health plan line of business.

Health Care Providers. Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule.6 Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Health care providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care.
Health Care Clearinghouses.Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa.7 In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse’s uses and disclosures of protected health information.8 Health care clearinghouses include billing services, repricing companies, community health management information systems, and value-added networks and switches if these entities perform clearinghouse functions.

Business Associates

Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.9  Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity. 

Business Associate Contract. When a covered entity uses a contractor or other non-workforce member to perform "business associate" services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates.10  Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule. Covered entities that had an existing written contract or agreement with business associates prior to October 15, 2002, which was not renewed or modified prior to April 14, 2003, were permitted to continue to operate under that contract until they renewed the contract or April 14, 2004, whichever was first.

What Information is Protected

Protected Health Information. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)."12
“Individually identifiable health information” is information, including demographic data, that relates to:

  • the individual’s past, present or future physical or mental health or condition,
  • the provision of health care to the individual, or
  • the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.13  Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number). 
The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g. 

De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information.14 De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.15

General Principle for Uses and Disclosures

Basic Principle. A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual’s protected heath information may be used or disclosed by covered entities. A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.16

Required Disclosures. A covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to HHS when it is undertaking a compliance investigation or review or enforcement action.

Permitted Uses and Disclosures

Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.
(1) To the Individual. A covered entity may disclose protected health information to the individual who is the subject of the information.

(2) Treatment, Payment, Health Care Operations. A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities.19 A covered entity also may disclose protected health information for the treatment activities of any health care provider, the payment activities of another covered entity and of any health care provider, or the health care operations of another covered entity involving either quality or competency assurance activities or fraud and abuse detection and compliance activities, if both covered entities have or had a relationship with the individual and the protected health information pertains to the relationship.

Treatment is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding a patient and referral of a patient by one provider to another.20

Payment encompasses activities of a health plan to obtain premiums, determine or fulfill responsibilities for coverage and provision of benefits, and furnish or obtain reimbursement for health care delivered to an individual21 and activities of a health care provider to obtain payment or be reimbursed for the provision of health care to an individual.
Health care operations are any of the following activities: (a) quality assessment and improvement activities, including case management and care coordination; (b) competency assurance activities, including provider or health plan performance evaluation, credentialing, and accreditation; (c) conducting or arranging for medical reviews, audits, or legal services, including fraud and abuse detection and compliance programs; (d) specified insurance functions, such as underwriting, risk rating, and reinsuring risk; (e) business planning, development, management, and administration; and (f) business management and general administrative activities of the entity, including but not limited to: de-identifying protected health information, creating a limited data set, and certain fundraising for the benefit of the covered entity.22
Most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization as described below.23 Obtaining “consent” (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities.24 The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent.

(3) Uses and Disclosures with Opportunity to Agree or Object. Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual.

Facility Directories. It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual’s informal permission to list in its facility directory the individual’s name, general condition, religious affiliation, and location in the provider’s facility.25 The provider may then disclose the individual’s condition and location in the facility to anyone asking for the individual by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation.

For Notification and Other Purposes. A covered entity also may rely on an individual’s informal permission to disclose to the individual’s family, relatives, or friends, or to other persons whom the individual identifies, protected health information directly relevant to that person’s involvement in the individual’s care or payment for care. 26 This provision, for example, allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient. Similarly, a covered entity may rely on an individual’s informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual’s care of the individual’s location, general condition, or death. In addition, protected health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts.

(4) Incidental Use and Disclosure. The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as “incident to,” an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the “minimum necessary,” as required by the Privacy Rule.27 (5)

Public Interest and Benefit Activities. The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for 12 national priority purposes.28 These disclosures are permitted, although not required, by the Rule in recognition of the important uses made of health information outside of the health care context. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information. 

Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).29

Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law. Victims of Abuse, Neglect or Domestic Violence. In certain circumstances, covered entities may disclose protected health information to appropriate government authorities regarding victims of abuse, neglect, or domestic violence.31

Health Oversight Activities. Covered entities may disclose protected health information to health oversight agencies (as defined in the Rule) for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs.32

Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.33

Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person’s death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34

Decedents. Covered entities may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.35

Cadaveric Organ, Eye, or Tissue Donation. Covered entities may use or disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue.36

Research. “Research” is any systematic investigation designed to develop or contribute to generalizable knowledge.37 The Privacy Rule permits a covered entity to use and disclose protected health information for research purposes, without an individual’s authorization, provided the covered entity obtains either: (1) documentation that an alteration or waiver of individuals’ authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board; (2) representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any protected health information from the covered entity, and that protected health information for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought.38 A covered entity also may use or disclose, without an individuals’ authorization, a limited data set of protected health information for research purposes (see discussion below).

Serious Threat to Health or Safety. Covered entities may disclose protected health information that they believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone they believe can prevent or lessen the threat (including the target of the threat). Covered entities may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal.40

Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.41

Workers’ Compensation. Covered entities may disclose protected health information as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses.
(6) Limited Data Set. A limited data set is protected health information from which certain specified direct identifiers of individuals and their relatives, household members, and employers have been removed.43 A limited data set may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set.

Authorized Uses and Disclosures

Authorization. A covered entity must obtain the individual’s written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule.44 A covered entity may not condition treatment, payment, enrollment, or benefits eligibility on an individual granting an authorization, except in limited circumstances.45
An authorization must be written in specific terms. It may allow use and disclosure of protected health information by the covered entity seeking the authorization, or by a third party. Examples of disclosures that would require an individual’s authorization include disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes.

All authorizations must be in plain language, and contain specific information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data. The Privacy Rule contains transition provisions applicable to authorizations and other express legal permissions obtained prior to April 14, 2003.46

Psychotherapy Notes47. A covered entity must obtain an individual’s authorization to use or disclose psychotherapy notes with the following exceptions48:

  • The covered entity who originated the notes may use them for treatment.
  • A covered entity may use or disclose, without an individual’s authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine the covered entity’s compliance with the Privacy Rules, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law.

Marketing. Marketing is any communication about a product or service that encourages recipients to purchase or use the product or service.49 The Privacy Rule carves out the following health-related activities from this definition of marketing:

  • Communications to describe health-related products or services, or payment for them, provided by or included in a benefit plan of the covered entity making the communication;
  • Communications about participating providers in a provider or health plan network, replacement of or enhancements to a health plan, and health-related products or services available only to a health plan’s enrollees that add value to, but are not part of, the benefits plan;
  • Communications for treatment of the individual; and
  • Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual.

Marketing also is an arrangement between a covered entity and any other entity whereby the covered entity discloses protected health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. A covered entity must obtain an authorization to use or disclose protected health information for marketing, except for face-to-face marketing communications between a covered entity and an individual, and for a covered entity’s provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves the covered entity’s receipt of direct or indirect remuneration from a third party must reveal that fact. See additional guidance on  

Limiting Uses and Disclosures to the Minimum Necessary

Minimum Necessary. A central aspect of the Privacy Rule is the principle of “minimum necessary” use and disclosure. A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.50 A covered entity must develop and implement policies and procedures to reasonably limit uses and disclosures to the minimum necessary. When the minimum necessary standard applies to a use or disclosure, a covered entity may not use, disclose, or request the entire medical record for a particular purpose, unless it can specifically justify the whole record as the amount reasonably needed for the purpose.

 The minimum necessary requirement is not imposed in any of the following circumstances: (a) disclosure to or a request by a health care provider for treatment; (b) disclosure to an individual who is the subject of the information, or the individual’s personal representative; (c) use or disclosure made pursuant to an authorization; (d) disclosure to HHS for complaint investigation, compliance review or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules.

Access and Uses. For internal uses, a covered entity must develop and implement policies and procedures that restrict access and uses of protected health information based on the specific roles of the members of their workforce. These policies and procedures must identify the persons, or classes of persons, in the workforce who need access to protected health information to carry out their duties, the categories of protected health information to which access is needed, and any conditions under which they need the information to do their jobs.

Disclosures and Requests for Disclosures. Covered entities must establish and implement policies and procedures (which may be standard protocols) for routine, recurring disclosures, or requests for disclosures, that limits the protected health information disclosed to that which is the minimum amount reasonably necessary to achieve the purpose of the disclosure. Individual review of each disclosure is not required. For non-routine, non-recurring disclosures, or requests for disclosures that it makes, covered entities must develop criteria designed to limit disclosures to the information reasonably necessary to accomplish the purpose of the disclosure and review each of these requests individually in accordance with the established criteria.

Reasonable Reliance. If another covered entity makes a request for protected health information, a covered entity may rely, if reasonable under the circumstances, on the request as complying with this minimum necessary standard. Similarly, a covered entity may rely upon requests as being the minimum necessary protected health information from: (a) a public official, (b) a professional (such as an attorney or accountant) who is the covered entity’s business associate, seeking the information to provide services to or for the covered entity; or (c) a researcher who provides the
documentation or representation required by the Privacy Rule for research.

Notice and Other Individual Rights

Privacy Practices Notice. Each covered entity, with certain exceptions, must provide a notice of its privacy practices.51 The Privacy Rule requires that the notice contain certain elements. The notice must describe the ways in which the covered entity may use and disclose protected health information. The notice must state the covered entity’s duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The notice must describe individuals’ rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated. The notice must include a point of contact for further information and for making complaints to the covered entity. Covered entities must act in accordance with their notices. The Rule also contains specific distribution requirements for direct treatment providers, all other health care providers, and health plans. Notice

Distribution. A covered health care provider with a direct treatment relationship with individuals must have delivered a privacy practices notice to patients starting April 14, 2003 as follows:

    • Not later than the first service encounter by personal delivery (for patient visits), by automatic and contemporaneous electronic response (for electronic service delivery), and by prompt mailing (for
      telephonic service delivery);
    • By posting the notice at each service delivery site in a clear and prominent place where people seeking service may reasonably be expected to be able to read the notice; and
    • In emergency treatment situations, the provider must furnish its notice as soon as practicable after the emergency abates.

Covered entities, whether direct treatment providers or indirect treatment providers (such as laboratories) or health plans must supply notice to anyone on request.52 A covered entity must also make its notice electronically available on any web site it maintains for customer service or benefits information.

The covered entities in an organized health care arrangement may use a joint privacy practices notice, as long as each agrees to abide by the notice content with respect to the protected health information created or received in connection with participation in the arrangement.53 Distribution of a joint notice by any covered entity participating in the organized health care arrangement at the first point that an OHCA member has an obligation to provide notice satisfies the distribution obligation of the other participants in the organized health care arrangement.

A health plan must distribute its privacy practices notice to each of its enrollees by its Privacy Rule compliance date. Thereafter, the health plan must give its notice to each new enrollee at enrollment, and send a reminder to every enrollee at least once every three years that the notice is available upon request. A health plan satisfies its distribution obligation by furnishing the notice to the “named insured,” that is, the subscriber for coverage that also applies to spouses and dependents.

  • Acknowledgement of Notice Receipt. A covered health care provider with a direct treatment relationship with individuals must make a good faith effort to obtain written acknowledgement from patients of receipt of the privacy practices notice.54 The Privacy Rule does not prescribe any particular content for the acknowledgement. The provider must document the reason for any failure to obtain the patient’s written acknowledgement. The provider is relieved of the need to request acknowledgement in an emergency treatment situation.

Access. Except in certain circumstances, individuals have the right to review and obtain a copy of their protected health information in a covered entity’s designated record set.55 The “designated record set” is that group of records maintained by or for a covered entity that is used, in whole or part, to make decisions about individuals, or that is a provider’s medical and billing records about individuals or a health plan’s enrollment, payment, claims adjudication, and case or medical management record systems.56 The Rule excepts from the right of access the following protected health information: psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act (CLIA) prohibits access, or information held by certain research laboratories. For information included within the right of access, covered entities may deny an individual access in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion.57 Covered entities may impose reasonable, cost-based fees for the cost of copying and postage. 

Amendment. The Rule gives individuals the right to have covered entities amend their protected health information in a designated record set when that information is inaccurate or incomplete. 58 If a covered entity accepts an amendment request, it must make reasonable efforts to provide the amendment to persons that the individual has identified as needing it, and to persons that the covered entity knows might rely on the information to the individual’s detriment.59 If the request is denied, covered entities must provide the individual with a written denial and allow the individual to submit a statement of disagreement for inclusion in the record. The Rule specifies processes for requesting and responding to a request for amendment. A covered entity must amend protected health information in its designated record set upon receipt of notice to amend from another covered entity.

Disclosure Accounting. Individuals have a right to an accounting of the disclosures of their protected health information by a covered entity or the covered entity’s business associates.60 The maximum disclosure accounting period is the six years immediately preceding the accounting request, except a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date.

The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment, or health care operations; (b) to the individual or the individual’s personal representative; (c) for notification of or to persons involved in an individual’s health care or payment for health care, for disaster relief, or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; (g) to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody; or (h) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities.

Restriction Request. Individuals have the right to request that a covered entity restrict use or disclosure of protected health information for treatment, payment or health care operations, disclosure to persons involved in the individual’s health care or payment for health care, or disclosure to notify family members or others about the individual’s general condition, location, or death.61 A covered entity is under no obligation to agree to requests for restrictions. A covered entity that does agree must comply with the agreed restrictions, except for purposes of treating the individual in a medical emergency.62

Confidential Communications Requirements. Health plans and covered health care providers must permit individuals to request an alternative means or location for receiving communications of protected health information by means other than those that the covered entity typically employs.63 For example, an individual may request that the provider communicate with the individual through a designated address or phone number. Similarly, an individual may request that the provider send communications in a closed envelope rather than a post card. 

Health plans must accommodate reasonable requests if the individual indicates that the disclosure of all or part of the protected health information could endanger the individual. The health plan may not question the individual’s statement of endangerment. Any covered entity may condition compliance with a confidential communication request on the individual specifying an alternative address or method of contact and explaining how any payment will be handled.

Administrative Requirements

HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the flexibility and scalability of the Rule are intended to allow covered entities to analyze their own needs and implement solutions appropriate for their own environment. What is appropriate for a particular covered entity will depend on the nature of the covered entity’s business, as well as the covered entity’s size and resources. 

Privacy Policies and Procedures. A covered entity must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule.64

Privacy Personnel. A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity’s privacy practices.65

Workforce Training and Management. Workforce members include employees, volunteers, trainees, and may also include other persons whose conduct is under the direct control of the entity (whether or not they are paid by the entity).66 A covered entity must train all workforce members on its privacy policies and procedures, as necessary and appropriate for them to carry out their functions.67 A covered entity must have and apply appropriate sanctions against workforce members who violate its privacy policies and procedures or the Privacy Rule.68

Mitigation. A covered entity must mitigate, to the extent practicable, any harmful effect it learns was caused by use or disclosure of protected health information by its workforce or its business associates in violation of its privacy policies and procedures or the Privacy Rule.69

Data Safeguards. A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure.70 For example, such safeguards might include shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes. See additional guidance on   Complaints. A covered entity must have procedures for individuals to complain about its compliance with its privacy policies and procedures and the Privacy Rule.71 The covered entity must explain those procedures in its privacy practices notice.72Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS.

Retaliation and Waiver. A covered entity may not retaliate against a person for exercising rights provided by the Privacy Rule, for assisting in an investigation by HHS or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates the Privacy Rule.73 A covered entity may not require an individual to waive any right under the Privacy Rule as a condition for obtaining treatment, payment, and enrollment or benefits eligibility.74

Documentation and Record Retention. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, its privacy policies and procedures, its privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented.75

Fully-Insured Group Health Plan Exception. The only administrative obligations with which a fully-insured group health plan that has no more than enrollment data and summary health information is required to comply are the (1) ban on retaliatory acts and waiver of individual rights, and (2) documentation requirements with respect to plan documents if such documents are amended to provide for the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO that services the group health plan.76

Organizational Options

The Rule contains provisions that address a variety of organizational issues that may affect the operation of the privacy protections.

Hybrid Entity. The Privacy Rule permits a covered entity that is a single legal entity and that conducts both covered and non-covered functions to elect to be a “hybrid entity.”77 (The activities that make a person or organization a covered entity are its “covered functions.”78) To be a hybrid entity, the covered entity must designate in writing its operations that perform covered functions as one or more “health care components.” After making this designation, most of the requirements of the Privacy Rule will apply only to the health care components. A covered entity that does not make this designation is subject in its entirety to the Privacy Rule. 

Affiliated Covered Entity. Legally separate covered entities that are affiliated by common ownership or control may designate themselves (including their health care components) as a single covered entity for Privacy Rule compliance.79 The designation must be in writing. An affiliated covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions. 

Organized Health Care Arrangement. The Privacy Rule identifies relationships in which participating covered entities share protected health information to manage and benefit their common enterprise as “organized health care arrangements.”80 Covered entities in an organized health care arrangement can share protected health information with each other for the arrangement’s joint health care operations.81

Covered Entities With Multiple Covered Functions. A covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions.82 The covered entity may not use or disclose the protected health information of an individual who receives services from one covered function (e.g., health care provider) for another covered function (e.g., health plan) if the individual is not involved with the other function.

Group Health Plan disclosures to Plan Sponsors. A group health plan and the health insurer or HMO offered by the plan may disclose the following protected health information to the “plan sponsor”—the employer, union, or other employee organization that sponsors and maintains the group health plan83:

  • Enrollment or disenrollment information with respect to the group health plan or a health insurer or HMO offered by the plan.
  • If requested by the plan sponsor, summary health information for the plan sponsor to use to obtain premium bids for providing health insurance coverage through the group health plan, or to modify, amend, or terminate the group health plan. “Summary health information” is information that summarizes claims history, claims expenses, or types of claims experience of the individuals for whom the plan sponsor has provided health benefits through the group health plan, and that is stripped of all individual identifiers other than five digit zip code (though it need not qualify as de-identified protected health information).
  • Protected health information of the group health plan’s enrollees for the plan sponsor to perform plan administration functions. The plan must receive certification from the plan sponsor that the group health plan document has been amended to impose restrictions on the plan sponsor’s use and disclosure of the protected health information. These restrictions must include the representation that the plan sponsor will not use or disclose the protected health information for any employment-related action or decision or in connection with any other benefit plan.

Other Provisions: Personal Representatives and Minors

Personal Representatives. The Privacy Rule requires a covered entity to treat a "personal representative" the same as the individual, with respect to uses and disclosures of the individual’s protected health information, as well as the individual’s rights under the Rule.84 A personal representative is a person legally authorized to make health care decisions on an individual’s behalf or to act for a deceased individual or the estate. The Privacy Rule permits an exception when a covered entity has a reasonable belief that the personal representative may be abusing or neglecting the individual, or that treating the person as the personal representative could otherwise endanger the individual.

Special Case: Minors. In most cases, parents are the personal representatives for their minor children. Therefore, in most cases, parents can exercise individual rights, such as access to the medical record, on behalf of their minor children. In certain exceptional cases, the parent is not considered the personal representative. In these situations, the Privacy Rule defers to State and other law to determine the rights of parents to access and control the protected health information of their minor children.  If State and other law is silent concerning parental access to the minor’s protected health information, a covered entity has discretion to provide or deny a parent access to the minor’s health information, provided the decision is made by a licensed health care professional in the exercise of professional judgment. See additional guidance on  

State Law

Preemption. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply.85 “Contrary” means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.86 The Privacy  Rule provides exceptions to the general rule of federal preemption for contrary State laws that (1) relate to the privacy of individually identifiable health information and provide greater privacy protections or privacy rights with respect to such information, (2) provide for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention, or (3) require certain health plan reporting, such as for management or financial audits.

Exception Determination. In addition, preemption of a contrary State law will not occur if HHS determines, in response to a request from a State or other entity or person, that the State law:

  • Is necessary to prevent fraud and abuse related to the provision of or payment for health care,
  • Is necessary to ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation,
  • Is necessary for State reporting on health care delivery or costs,
  • Is necessary for purposes of serving a compelling public health, safety, or welfare need, and, if a Privacy Rule provision is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or
  • Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law.

Enforcement and Penalties for Noncompliance

Compliance. The Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) establishes a set of national standards for the use and disclosure of an individual’s health information – called protected health information – by covered entities, as well as standards for providing individuals with privacy rights to understand and control how their health information is used.  The Department of Health and Human Services, Office for Civil Rights (OCR) is responsible for administering and enforcing these standards and may conduct complaint investigations and compliance reviews.

Consistent with the principles for achieving compliance provided in the Privacy Rule, OCR will seek the cooperation of covered entities and may provide technical assistance to help them comply voluntarily with the Privacy Rule.  Covered entities that fail to comply voluntarily with the standards may be subject to civil money penalties.  In addition, certain violations of the Privacy Rule may be subject to criminal prosecution.  These penalty provisions are explained below.

Civil Money Penalties.  OCR may impose a penalty on a covered entity for a failure to comply with a requirement of the Privacy Rule.  Penalties will vary significantly depending on factors such as the date of the violation, whether the covered entity knew or should have known of the failure to comply, or whether the covered entity’s failure to comply was due to willful neglect.  Penalties may not exceed a calendar year cap for multiple violations of the same requirement.


For violations occurring prior to 2/18/2009

For violations occurring on or after 2/18/2009

Penalty Amount

Up to $100
per violation

$100 to $50,000 or more
per violation

Calendar Year Cap



A penalty will not be imposed for violations in certain circumstances, such as if:

  • the failure to comply was not due to willful neglect, and was corrected during a 30-day period after the entity knew or should have known the failure to comply had occurred (unless the period is extended at the discretion of OCR); or
  • the Department of Justice has imposed a criminal penalty for the failure to comply (see below).

In addition, OCR may choose to reduce a penalty if the failure to comply was due to reasonable cause and the penalty would be excessive given the nature and extent of the noncompliance.  Before OCR imposes a penalty, it will notify the covered entity and provide the covered entity with an opportunity to provide written evidence of those circumstances that would reduce or bar a penalty.  This evidence must be submitted to OCR within 30 days of receipt of the notice.  In addition, if OCR states that it intends to impose a penalty, a covered entity has the right to request an administrative hearing to appeal the proposed penalty.

Criminal Penalties.  A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment.  The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm.  The Department of Justice is responsible for criminal prosecutions under the Privacy Rule.

Compliance Dates

Compliance Schedule. All covered entities, except “small health plans,” must have been compliant with the Privacy Rule by April 14, 2003.90 Small health plans, however, had until April 14, 2004 to comply. 

Small Health Plans. A health plan with annual receipts of not more than $5 million is a small health plan.91 Health plans that file certain federal tax returns and report receipts on those returns should use the guidance provided by the Small Business Administration at 13 Code of Federal Regulations (CFR) 121.104 to calculate annual receipts. Health plans that do not report receipts to the Internal Revenue Service (IRS), for example, group health plans regulated by the Employee Retirement Income Security Act 1974 (ERISA) that are exempt from filing income tax returns, should use proxy measures to determine their annual receipts.92See What constitutes a small health plan?

5 Even if an entity, such as a community health center, does not meet the definition of a health plan, it may, nonetheless, meet the definition of a health care provider, and, if it transmits health information in electronic form in connection with the transactions for which the Secretary of HHS has adopted standards under HIPAA, may still be a covered entity.
6 45 C.F.R. §§ 160.102, 160.103; see Social Security Act § 1172(a)(3), 42 U.S.C. § 1320d-1(a)(3).
The transaction standards are established by the HIPAA Transactions Rule at 45 C.F.R. Part 162.

15 The following identifiers of the individual or of relatives, employers, or household members of the individual must be removed to achieve the “safe harbor” method of de-identification: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of Census (1) the geographic units formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000; (C) All elements of dates (except year) for dates directly related to the individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses: (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet

Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and ® any other unique identifying number, characteristic, or code, except as permitted for re-identification purposes provided certain conditions are met. In addition to the removal of the above-stated identifiers, the covered entity may not have actual knowledge that the remaining information could be used alone or in combination with any other information to identify an individual who is subject of the information. 45 C.F.R. § 164.514(b).

37 The Privacy Rule defines research as, “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.” 45 C.F.R. § 164.501.43 45 C.F.R. § 164.514(e). A limited data set is protected health information that excludes thefollowing direct identifiers of the individual or of relatives, employers, or household members ofthe individual: (i) Names; (ii) Postal address information, other than town or city, State and zipcode; (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses: (vi) Socialsecurity numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix)Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers,including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric identifiers, including finger and voice prints; (xvi) Full face photographic images and any comparable images. 45 C.F.R. § 164.514(e)(2).
44 45 C.F.R. § 164.508.

45 A covered entity may condition the provision of health care solely to generate protected health information for disclosure to a third party on the individual giving authorization to disclose the information to the third party. For example, a covered entity physician may condition the provision of a physical examination to be paid for by a life insurance issuer on an individual’s authorization to disclose the results of that examination to the life insurance issuer. A health plan may condition enrollment or benefits eligibility on the individual giving authorization, requested before the individual’s enrollment, to obtain protected health information (other than psychotherapy notes) to determine the individual’s eligibility or enrollment or for underwriting or risk rating. A covered health care provider may condition treatment related to research (e.g., clinical trials) on the individual giving authorization to use or disclose the individual’s protected health information for the research. 45 C.F.R. 508(b)(4).

46 45 CFR § 164.532. 47 “Psychotherapy notes” means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. 51 45 C.F.R. §§ 164.520(a) and (b). A group health plan, or a health insurer or HMO with respect to the group health plan, that intends to disclose protected health information (including enrollment data or summary health information) to the plan sponsor, must state that fact in the notice. Special statements are also required in the notice if a covered entity intends to contact individuals about health-related benefits or services, treatment alternatives, or appointment reminders, or for the covered entity’s own fundraising.

57 A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed by a licensed health care professional (who is designated by the covered entity and who did not participate in the original decision to deny), when a licensed health care professional has determined, in the exercise of professional judgment, that: (a) the access requested is reasonably likely to endanger the life or physical safety of the individual or another person; (b) the protected health information makes reference to another person (unless such other person is a health care provider) and the access requested is reasonably likely to cause substantial harm to such other person; or (c) the request for access is made by the individual’s personal representative and the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.

A covered entity may deny access to individuals, without providing the individual an opportunity for review, in the following protected situations: (a) the protected health information falls under an exception to the right of access; (b) an inmate request for protected health information under certain circumstances; (c) information that a provider creates or obtains in the course of research that includes treatment for which the individual has agreed not to have access as part of consenting to participate in the research (as long as access to the information is restored upon completion of the research); (d) for records subject to the Privacy Act, information to which access may be denied under the Privacy Act, 5 U.S.C. § 552a; and (e) information obtained under a promise of confidentiality from a source other than a health care provider, if granting access would likely reveal the source. 45 C.F.R. § 164.524.58 45 C.F.R. § 164.526.

59 Covered entities may deny an individual’s request for amendment only under specified circumstances. A covered entity may deny the request if it: (a) may exclude the information from access by the individual; (b) did not create the information (unless the individual provides a reasonable basis to believe the originator is no longer available); (c) determines that the information is accurate and complete; or (d) does not hold the information in its designated record set. 164.526(a)(2).



CEUs Home | CEUs Courses |Provider Approved | CEUs Contact Us | Ceus Logon | Ceus Questions |