Office of Compliance Programs

HIPAA and the Provision of Mental Health Services

Revised: April 19, 2017

HIPAA and Mental Health Professionals

Due to the sensitive information received, the HIPAA Privacy Rule has additional requirements regarding the protection of health information obtained through psychotherapy or counseling.

This presentation is a supplement to your HIPAA Privacy-High Risk and HIPAA Privacy - Patient Protection modules and will address the additional requirements the Privacy Rule requires of mental health professionals.

As a practicing mental health professional, these requirements affect your daily practice.

HIPAA Privacy Rules that affect Mental Health Professionals

Patints' Right to Access Mental Health Records

As a general rule, HIPAA provides that a patient has a right to access and obtain a copy of his/her protected health information.

Exceptions to Right of Access

There are two exceptions to the patient’s right of access which are relevant to the practice of psychiatry:

Exception for Psychotherapy Notes

Psychotherapy notes as defined by HIPAA means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record.

What are not considered Psychotherapy Notes?

Psychotherapy notes excludes the following:

In order to qualify as “psychotherapy notes” and be an exception to the patient right of access requirement under HIPAA, the healthcare provider:

Exception for Legal Proceedings

Any information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding is an exception to the patient’s right of access under HIPAA.

Civil or criminal action would be a proceeding brought before a court of law (e.g. a lawsuit.

For purposes of this exception, an administrative action or proceeding is a hearing, inquiry, investigation, or trial before an administrative agency.

An Administrative Agency is a government body, usually part of the executive branch of government that is charged with implementing particular laws passed by the legislature or Congress.

A proceeding of the Medical Malpractice Review Panel IS an Administrative Action or Proceeding, as defined under the HIPAA Privacy Rule.

An academic determination of fitness of a student to return to school is a due process hearing, but NOT an administrative hearing as defined under the HIPAA Privacy Rule.

Disclosing Records to Third Parties

In most cases, disclosure of patient records to third parties requires a patient to sign the LSUHSC-NO HIPAA authorization form. The patient must receive a copy of the signed authorization form.

Chancellor's Memorandum 53 Section T is the university's HIPAA authorization policy and describes the patient authorization requirements. Please note that the LSUHSC-NO HIPAA Authorization form is the ONLY form that may be used to obtain HIPAA authorizations in such instances.

Defective Authorizations

An authorization is not valid if the form signed by the subject has any of the following defects:

Separate Authorization for Psychotherapy Notes Disclosure

The HIPAA Privacy Rule requires that if a mental health professional wishes to disclose psychotherapy notes, as defined by HIPAA, to a third party, the patient must sign a separate HIPAA authorization form, which only authorizes the disclosure of the psychotherapy notes and is not combined with any other authorization for use and/or disclosure of any other PHI.

Instances When an Authorization is NOT Required for the Disclosure of Psychotherapy Notes

An authorization is not required to carry out the following:

Re-disclosure of Records and Psychotherapy Notes

It is important to keep in mind that while a patient may be denied right of access to their psychotherapy notes, a patient may authorize the release of their psychotherapy notes to a third party, which may be an attorney, another provider, or even a friend .

A mental health professional must comply with all authorizations and thus, the third party may give the patient a copy of the psychotherapy notes.

It is imperative that in the event psychotherapy notes are released to a healthcare provider, they be labeled and direction provided to keep them separate and apart from the main file pursuant to the HIPAA regulations, in order to continue to fall under the exception of right of access by the patient.

Responding to Records Requests

To determine whether a signed HIPAA authorization form is required to disclose protected health information in response to a records request:

Court Orders v. Non-Court Orders

Court orders: a request or order for documents issued or signed by a judge, magistrate, clerk of court or attorneys, acting as an officer of the court.

Non-court orders: a request by an attorney or other individual for documents.

Forensic Mental Health Evaluations

A common HIPAA myth is that HIPAA does not apply to forensic medical examinations because there is no doctor-patient relationship. This is not correct.

HIPAA applies to covered entities regardless of the type of service performed or the relationship between the provider and the subject of the examination. In a forensic evaluation, the evaluator, who is a healthcare provider (i.e. covered entity), receives protected health information.

HIPAA provides an exception for uses and disclosures of PHI directed by a court order. This is why the health care provider is allowed to share the PHI with the court.

Since LSUHSC-NO is a covered entity under HIPAA, faculty must adhere to the HIPAA privacy and security rules when conducting all forensic examinations.

Independent Medical Evaluations (IME)

IMEs can be required for many reasons including but not limited to:

As is the case with forensic medical examinations, LSUHSC-NO is a covered entity under HIPAA and all faculty and staff shall adhere to the HIPAA privacy and security rules when conducting IMEs. Absent a court order, a HIPAA authorization will need to be obtained from the subject of the evaluation in order to share the results of the evaluation with the subject's school, employer, etc. Make sure the LSUHSC-NO HIPAA Authorization form is used to obtain the subject's authorization. NO OTHER FORM MAY BE USED TO OBTAIN A PATIENT'S AUTHORIZATION.

An individual has the right to access any report that is created as a result of his/her independent medical evaluation under HIPAA, as with any other medical records, unless an exception applies.

A common instance where an individual would not be entitled to access to the report is a court ordered evaluation.

The individual is denied access under the information compiled for use in a civil, criminal or administrative proceeding exception, discussed earlier.

Reporting a HIPAA Violation

If anyone suspects or knows of mishandling or misuse of patient PHI, a complaint can be made to:

Any Questions?

We Are Here to Help!

Office of Compliance Programs

433 Bolivar St.

Suite 807

New Orleans, LA 70112