With Consent
Except for those situations listed below, a physician cannot release a patient’s mental health records unless the patient has provided a valid written, signed, specific, and time-limited authorization. Specific authorizations must be given for psychotherapy notes and for documents with HIV-related information.
Without Consent
The disclosure of mental health information is governed by both federal and state law. Federal law sets the minimum level of privacy protection. State laws may then go further, providing more or stricter levels of privacy and confidentiality for mental health information beyond the federal minimum. The HIPAA Privacy Rule governs this issue uniformly at the federal level, which may then be superseded by state laws of varying complexity and protection aimed specifically at mental health records and professionals or state confidentiality requirements in general.
While providing important privacy safeguards, the Privacy Rule does recognize certain instances when protected health information (PHI), including mental health information, may be disclosed by the physician or other covered entity without patient consent. In fact, with the exception of psychotherapy notes discussed below, mental health information is treated as a form of PHI, subject to all the permitted uses of PHI without patient consent, such as treatment, payment, and health care operations. A patient can always consent to the release of PHI, including mental health information, but in the absence of such consent, HIPAA does permit many uses and disclosures without patient authorization.
One exception to this general rule of permitting the sharing of treatment information without consent is that psychotherapy notes receive special protection under the Privacy Rule and may only be disclosed with patient authorization, except if the notes are used for a covered entity's supervised mental health education and training purposes. The Privacy Rule defines psychotherapy notes as notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a private counseling session that are separate from the rest of the patient’s medical record. Psychotherapy notes do not include medication prescription and monitoring information, counseling session start and stop times, the types of treatment furnished, or results of clinical tests; nor do they include summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. Psychotherapy notes also do not include any information that is maintained in a patient’s medical record.
Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment, or health care operations purposes other than by the mental health professional who created the notes. Therefore, with few exceptions, the Privacy Rule requires a covered entity to obtain a patient’s authorization prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to another physician. In general, the individual signing the authorization may revoke it at any time, a physician cannot condition treatment on the willingness of an individual to sign an authorization for the release of psychotherapy notes, and an authorization for the release of psychotherapy notes must be a separate and independent document. One important exception exists for disclosures required by other laws, such as for mandatory reporting of abuse and mandatory “duty to warn” situations regarding threats of serious and imminent harm made by the patient. State laws vary as to whether such a warning is mandatory or permissible. Special protections apply to substance abuse records at certain substance abuse treatment programs under 42 C.F.R. Part 2, which may include mental health information.
Finally, as noted above, state laws can be stricter than HIPAA and provide greater protection for mental health information beyond the psychotherapy notes exception. All states have some form of medical record confidentiality law, some stricter that HIPAA, some equivalent to HIPAA, and some less stringent laws that are preempted by HPAA. Moreover, all states have laws governing mental health records taking one of four forms:
• Laws about the records of patients in state mental hospitals or programs.
• Laws controlling the records of specific types of mental health providers, such as psychologists, social workers, and counselors.
• Laws governing the records of those involuntarily committed to state mental institutions.
• Laws that generally control the records of all mental health patients.