HIPPA Privacy Rule

HIPAA PRIVACY RULE AND SHARING INFORMATION RELATED TO MENTAL HEALTH

By: Cynthia C. Anderson

Cook, Yancey, King & Galloway, APLC

            The U.S. Department of Health and Human Services (HHS) has issued new Guidance regarding the HIPAA Privacy Rule and its relationship to the disclosure of a mental health patient’s protected health information by health care providers. The Guidance is intended to clarify when it is appropriate to share such information.

The Guidance confirms that when a patient is present and has the capacity to make health care decisions, providers may communicate with the patient’s family members, friends and other persons that the patient has involved in his or her care, provided that the patient does not object. The provider must give the patient an opportunity to object to any disclosure and the Guidance emphasizes that the provider must abide by the patient’s wishes. The provider may ask the patient for permission to share the information or may tell the patient that he or she is intending to discuss the information and give the patient an opportunity to object, or permission may be inferred from the circumstances, for example, if a family member or friend is in the treatment room at the patient’s invitation.

Where the patient is not present or is incapacitated, a provider may share the patient’s information as long as the provider determines, based on professional judgment, that doing so is in the best interests of the patient.

In all cases, the information disclosed should be limited to protected health information which is directly relevant to the person’s involvement in the patient’s care or payment for care.

Generally, the Privacy Rule applies uniformly to all protected health information, however, HIPAA provides special protection for psychotherapy notes which are maintained separately from the rest of the patient’s records. Psychotherapy notes are defined as notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint or family counseling session, and that are separate from the rest of the patient’s medical records. Providers must obtain a separate authorization to disclose psychotherapy notes, with few exceptions. A notable exception exists for disclosures required by law, such as mandatory reporting of abuse, or “duty to warn” situations.

The Guidance also discusses when a parent or guardian may obtain information about a minor’s mental health treatment. The general rule is that information may be disclosed to the minor’s personal representative, which is usually the parent or guardian.   However, since the Privacy Rule contains several exceptions to this general rule, HIPAA defers to State or other applicable laws in determining the rights of a parent or guardian to obtain health care information about a minor child.       The Guidance states that a parent does not have a right of access to a minor’s psychotherapy notes, although providers do have a general discretion under HIPAA to disclose an individual’s protected health information (including psychotherapy notes) to the individual’s personal representative. Since such disclosure is purely permissive, the Guidance recommends that providers consult state or local laws for any restrictions on such disclosures.

The Guidance reiterates that HIPAA permits providers to warn family members or law enforcement if the provider believes the patient presents a serious risk of harm to his/herself or others. Additionally, like a number of states, Louisiana has a “duty to warn” statute which requires mental health professionals to warn an identified victim of a significant threat of physical violence.

Finally, the Guidance emphasizes that in all cases, providers should consult their State laws for any more stringent protections for protected health information as well as any specific Federal statutes such as the provisions relating to the disclosure of federal alcohol and drug abuse treatment records.