Hipaa Laws: Do They Apply To Counselors?

The Health Insurance Portability and Accountability Act, or HIPAA, relates to the privacy of patients' medical records and health information. It controls how this information can be shared with others. HIPAA applies to therapists and counsellors in different ways, depending on their employment status and the nature of their practice. For example, a therapist is a solo Covered Entity under HIPAA when they work independently of other healthcare providers and conduct transactions electronically. However, in some cases, therapists and counsellors may not be required to comply with HIPAA, but with similar state legislation.

HIPAA and therapists' employment status

The Health Insurance Portability and Accountability Act, commonly known as HIPAA, is a law that protects the privacy of people receiving medical treatment. HIPAA applies to therapists, whether they are solo practitioners or part of a larger organization. The specific requirements for HIPAA compliance depend on the therapist's employment status.

Solo Covered Entity

A therapist is a solo Covered Entity under HIPAA when they work independently of other healthcare providers and conduct transactions electronically per the Department of Health and Human Services (HHS) standards. Solo practitioners must comply with HIPAA's Privacy Rule, which sets standards for preventing the inappropriate use or disclosure of protected health information (PHI). This includes maintaining separate and confidential psychotherapy notes.

Hybrid Covered Entity

A therapist can be a hybrid Covered Entity if they perform both covered and non-covered functions. For example, a therapist who bills clients directly for treatment and through their health plan must maintain separate information for clients billed directly, complying with the Privacy, Security, and Breach Notification Rules.

Affiliated Covered Entity

Affiliated Covered Entities are legally separate entities under common ownership or control that designate themselves as a single Covered Entity for HIPAA compliance. This arrangement facilitates sharing Protected Health Information between healthcare providers but also means shared liability for any HIPAA violations.

Organized Health Care Arrangement

An Organized Health Care Arrangement is when Covered Entities with different ownership or control operate as one entity for HIPAA compliance. This arrangement simplifies HIPAA compliance by sharing specific requirements, such as Notices of Privacy Practices and facility access controls. However, each Covered Entity within the group is individually liable for HIPAA violations.

Business Associate to a Covered Entity

Therapists who are not solo, hybrid, or affiliated Covered Entities may still be subject to partial HIPAA compliance if they provide services to or on behalf of a Covered Entity as a Business Associate. Their compliance requirements typically include Security Rule compliance and Breach Notification compliance, with additional Privacy Rule standards depending on the nature of the therapy.

Employee of a Covered Entity

Therapists employed by a Covered Entity must comply with HIPAA to the extent that their employer develops HIPAA-compliant policies and procedures. The employer is responsible for training, monitoring compliance, and imposing sanctions for violations.

It's important to note that even if a therapist doesn't fall into any of the above categories, they may still need to comply with state legislation that mandates HIPAA-style privacy, security, and breach notification requirements.

HIPAA and patient consent

The Health Insurance Portability and Accountability Act (HIPAA) applies to counselors, but the specifics depend on the nature of their practice. Counselors can be solo Covered Entities, hybrid Covered Entities, part of an affiliated Covered Entity, part of an Organized Health Care Arrangement, Business Associates to a Covered Entity, or employees of any of the above.

HIPAA's Privacy Rule permits, but does not require, Covered Entities to obtain patient consent for the use and disclosure of Protected Health Information (PHI) for treatment, payment, and healthcare operations. However, if the use or disclosure of PHI is not permitted by the Privacy Rule, patient authorization is required.

Consent and authorization are distinct concepts under HIPAA. Consent is voluntary and allows Covered Entities to use and disclose PHI for treatment, payment, and healthcare operations. The process for obtaining consent can be designed at the entity's discretion. On the other hand, authorization is mandatory for uses and disclosures of PHI not allowed by the Privacy Rule. An authorization is a detailed document that specifies the purpose of using or disclosing PHI and gives permission to do so. It must include a description of the PHI, the person authorized to make the use or disclosure, the party to whom the disclosure can be made, and an expiration date.

While HIPAA does not require patient consent for sharing PHI, many states and entities have adopted policies or laws that do. HIPAA is designed to work alongside more privacy-protective policies, so entities in these states must obtain the patient's basic consent preference, such as opting in or out of electronic information exchange.

HIPAA and insurance companies

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) covers both individuals and organizations. Those who must comply with HIPAA are often referred to as HIPAA covered entities. Covered entities include health plans, health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans' health care programs.

HIPAA also applies to health care clearinghouses, which are entities that process nonstandard health information they receive from another entity into a standard format, or vice versa. This includes organizations that process nonstandard health information to conform to standards for data content or format on behalf of other organizations.

Covered entities must have contracts in place with their business associates, such as companies that help administer health plans, ensuring that they use and disclose health information properly and safeguard it appropriately. Business associates must also have similar contracts with subcontractors.

Therapists can be considered covered entities under HIPAA if they work independently of other healthcare providers and conduct transactions electronically for which the Department of Health and Human Services (HHS) has issued standards. These standards relate to processes such as eligibility checks for treatment, authorizations for treatment, and billing for treatment when payment is made by a health plan. Therapists employed by a covered entity are required to comply with HIPAA to the extent that their employer is responsible for developing HIPAA-compliant policies and procedures.

HIPAA and psychotherapy notes

Depending on their work setup, counselors may need to comply with the Health Insurance Portability and Accountability Act (HIPAA) requirements. Counselors can be solo Covered Entities, hybrid Covered Entities, part of an affiliated Covered Entity, part of an Organized Healthcare Arrangement, Business Associates to a Covered Entity, or employees of any of the above.

HIPAA treats psychotherapy notes differently from other mental health information. This is because they contain highly sensitive information and are the therapist's personal notes, typically not required or useful for treatment, payment, or healthcare operations purposes. The Privacy Rule defines psychotherapy notes as:

> "...notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record."

Psychotherapy notes do not include medication prescription and monitoring information, counseling session start and stop times, modalities and frequencies of treatment, results of clinical tests, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. They also do not include any information in a patient's medical record.

The Privacy Rule requires covered entities to obtain a patient's authorization before disclosing psychotherapy notes for any reason, including treatment purposes to another healthcare provider. However, exceptions exist for mandatory reporting of abuse and "duty to warn" situations regarding threats of serious and imminent harm by the patient.

HIPAA and business associates

The Health Insurance Portability and Accountability Act of 1996, or HIPAA, applies to covered entities and their business associates. A business associate is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of a covered entity. This includes providing services to a covered entity.

Covered entities are required to obtain satisfactory assurances from their business associates, in the form of a contract or other written agreement, that the business associate will appropriately safeguard protected health information. The contract must describe the permitted and required uses of protected health information by the business associate, and provide that the business associate will not use or disclose the protected information other than as permitted or required by the contract or as required by law. The contract must also require the business associate to use appropriate safeguards to prevent a breach of protected health information.

Business associate functions and activities include: claims processing or administration; data analysis, processing or administration; utilization review; quality assurance; billing; benefit management; practice management; and repricing. Business associate services include: legal; actuarial; accounting; consulting; data aggregation; management; administrative; accreditation; and financial.

Therapists who are business associates are subject to partial HIPAA compliance. This usually includes Security Rule compliance and Breach Notification compliance. However, depending on the nature of the therapy, compliance with some Privacy Rule standards may also be necessary.

Frequently asked questions