Hipaa Laws: Do They Protect Mental Health Records?

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US law that protects the privacy of all individuals' identifiable health information. This includes mental health information, which is treated with the same level of protection as other health information. HIPAA allows for the sharing of mental health information without patient consent for treatment purposes, care coordination, and in certain other circumstances, such as when there is an imminent threat of harm to the patient or others. However, psychotherapy notes can only be disclosed with patient authorization. In addition to HIPAA, state laws and federal substance abuse treatment confidentiality laws may also apply to mental health records, with some states having more stringent privacy protections than HIPAA.

HIPAA and mental health information sharing with family and friends

The Health Insurance Portability and Accountability Act (HIPAA) Rules are designed to protect the privacy of all individuals' identifiable health information and to ensure that health information is available when needed for treatment and other appropriate purposes. Given the sensitive nature of mental health and substance use disorder treatment information, the Office for Civil Rights (OCR) provides guidance on how HIPAA applies in this context.

HIPAA helps family and friends stay connected with loved ones who have a mental health condition or substance use disorder. It also helps mental health professionals to prevent harm and supports caregiving connections.

HIPAA permits health care providers to share an individual's protected health information (PHI) with their family members, friends, or other persons involved in the patient's care or payment for care. This is allowed in situations where the patient is given the opportunity and does not object. The patient's mental health information can also be shared if they are not present or are unable to agree or object due to incapacity or emergency circumstances, and the provider determines that disclosing the information is in the patient's best interests.

HIPAA also allows health care providers to disclose PHI to family or friends if the provider believes the patient presents a serious danger to themselves or others. In such cases, the provider can disclose the necessary information to anyone who is in a position to prevent or lessen the threatened harm. This includes disclosing information to law enforcement if the patient might harm themselves or someone else.

In the case of minors, parents are generally considered the personal representatives of their children and can access their medical records. However, state law determines the age at which a minor child may consent to certain types of health care and the disclosure of their health information to parents. Mental health professionals can also use their professional judgment to decide whether to share a minor's treatment information with their parents.

HIPAA and mental health information sharing with law enforcement

The Health Insurance Portability and Accountability Act (HIPAA) applies to mental health records, which are considered protected health information (PHI). This includes information in a patient's medical record, conversations between doctors and nurses about a patient's care, billing information, and other health information held by any person providing physical or mental health treatment.

HIPAA permits healthcare providers to disclose PHI to law enforcement in certain circumstances. If a provider believes that a patient presents a serious and imminent threat to themselves or others, they are allowed to disclose necessary information to law enforcement, family members, or other persons without the patient's permission. This is described in a letter to the nation's healthcare providers.

HIPAA also permits covered entities, such as hospitals, to disclose certain PHI in response to a law enforcement official's request for the purpose of locating or identifying a suspect, fugitive, material witness, or missing person. This includes information such as the date and time of admission and discharge, a description of distinguishing characteristics, and the name and address of the patient, among other general identifying information.

However, providers must respect a patient's decisions regarding their privacy, and many states require individuals to complete paperwork stating who may or may not see their information. In non-emergency situations, providers should generally follow their client's wishes.

In addition to federal guidelines, individual states may have their own requirements and clarifications regarding mental health information privacy.

HIPAA and the privacy of psychotherapy notes

The Health Insurance Portability and Accountability Act (HIPAA) applies to mental health records, and the HIPAA Privacy Rule treats all protected health information (PHI) uniformly, without regard to the type of information. However, one exception to this general rule is psychotherapy notes, which receive special protections under HIPAA.

Psychotherapy notes are defined as notes recorded by a mental health professional, documenting or analyzing the contents of a conversation during a private, group, joint, or family counselling session. These notes are kept separate from the patient's medical record and do not include information about medication, counselling session times, treatment modalities and frequencies, clinical test results, diagnosis, functional status, treatment plan, symptoms, prognosis, or progress. Psychotherapy notes are also distinct from "personal notes", which are defined by a few states.

HIPAA provides a higher level of protection for psychotherapy notes compared to other types of patient information. In most cases, the release of psychotherapy notes requires the patient's authorization or specific permission. Psychologists can decide whether to release their psychotherapy notes to patients, unless patients have a right to access these notes under state law. Patients do not have the right to obtain copies of psychotherapy notes under HIPAA, and when a psychologist denies a patient access to these notes, there is no review process, unlike with other records.

The special protection afforded to psychotherapy notes under HIPAA is due to the sensitive nature of the information they contain and the fact that they are the personal notes of the therapist, typically not required or useful for treatment, payment, or healthcare operations purposes. However, there are exceptions to the requirement for patient authorization, such as mandatory reporting of abuse and "duty to warn" situations regarding threats of serious and imminent harm.

State laws and mental health information sharing

State laws and federal laws, such as HIPAA, often work in tandem to protect the privacy of mental health records. While HIPAA provides a standard set of privacy rules for all states, each state has its own statutes governing medical record confidentiality, including mental health records. These state laws vary widely and can be more or less restrictive than HIPAA.

State laws governing mental health records generally take four forms:

• Laws pertaining to the records of patients in state mental hospitals or mental health programs. These laws may be part of general statutes governing state health records or specific to mental hospitals.
• Laws governing the records of specific mental health practitioners, such as psychologists, social workers, and counselors. Some states require patient consent for any disclosure by these practitioners, while others allow for sharing of information for treatment purposes.
• Laws pertaining to the records of patients who are involuntarily committed to mental institutions. These laws recognize that patients in these situations may have a special claim to privacy and usually make provisions for the use of records in the commitment process.
• Statutes governing the records of all mental patients, which may include provisions for sharing information for treatment purposes.

In addition to these four categories, some states have comprehensive medical record statutes that attempt to govern all issues pertaining to medical record confidentiality, similar to HIPAA. Other states have specific statutes governing substance abuse records, which may be governed by federal law if the treatment is conducted, regulated, or funded by the federal government.

When it comes to sharing mental health information for treatment purposes, state laws vary widely. Some states have no exception to the general confidentiality obligation and require consent for any disclosure. Other states make provisions for sharing information for treatment purposes, with varying levels of restriction. For example, some states only allow sharing within a single facility or among state treatment programs, while others permit disclosure to a broader range of individuals involved in the patient's care.

In summary, while HIPAA provides a baseline for protecting the privacy of mental health records, state laws play a significant role in governing the sharing of this information. The interaction between federal and state laws can be complex, and it is important to consider both when understanding an individual's privacy rights and the obligations of healthcare providers.

HIPAA and the privacy of substance use disorder treatment records

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law that protects sensitive patient health information from being shared without a patient's consent or knowledge. The HIPAA Privacy Rule allows personal medical information to be processed in a standard format while protecting the patient's privacy.

The protected health information of individuals who receive drug and alcohol abuse treatment in federally-funded programs is subject to additional privacy protections under 42 U.S.C. § 290dd-2 and 42 C.F.R. § 2.11 (Part 2). These federal rules are administered by the Department of Health and Human Services' Substance Abuse and Mental Health Services Administration (SAMHSA).

Part 2 of the Code of Federal Regulations (CFR) protects "the records of the identity, diagnosis, prognosis, or treatment of any patient" maintained in connection with substance abuse education, prevention, training, treatment, rehabilitation, or research. These confidentiality protections help address concerns that discrimination and fear of prosecution deter people from entering treatment for a substance use disorder.

In 2024, the Department of Health and Human Services issued a Final Rule to revise the Confidentiality of Substance Use Disorder Patient Records regulations. The revisions include:

• Allowing Part 2 programs to disclose records based on a single prior patient consent for all future uses and disclosures for treatment, payment, and healthcare operations
• Expanding the prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings
• Creating additional patients' rights, including the right to an accounting of disclosures and the right to request restrictions on disclosures for treatment, payment, and healthcare
• Requiring disclosures to the Secretary for enforcement and applying HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act civil and criminal penalties for violations of Part 2
• Requiring Part 2 programs to establish a process for receiving complaints of Part 2 violations, prohibiting retaliation against patients who file complaints, and prohibiting programs from requiring patients to waive their right to file a complaint as a condition of providing treatment

Under HIPAA, patients have the right to decide how and with whom their protected health information is shared. Providers must respect patients' decisions regarding their privacy. While providers generally follow their clients' wishes, there are emergency situations when a provider may disclose relevant, protected health information to an outside party, including family members or law enforcement. These special circumstances include when a provider believes there is an imminent threat of harm to self or others, or where an individual is deemed "incapacitated," lacking the ability to make their own health decisions, and sharing information is in the best interest of the client's care.

Frequently asked questions