Mental health professionals are covered entities under HIPAA. Therefore, they must comply with the HIPAA Privacy Rule to protect patient privacy and regulate protected health information (PHI) disclosures, the Security Rule to safeguard electronic PHI through administrative, physical, and technical measures, and the Breach Notification Rule to inform individuals and authorities of PHI breaches. Special protections for psychotherapy notes require patient authorization for disclosure, except in specific cases.
HIPAA identifies three covered entities: healthcare providers, health plans, and healthcare clearinghouses. Mental health professionals fall under the category of healthcare providers, making them subject to HIPAA regulations. This means that any information that can identify a patient and is related to their health, treatment, or payment for healthcare services, known as PHI, must be handled in compliance with HIPAA rules.
Read more: Are mental health professionals covered entities under HIPAA?
The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other personal health information. It requires appropriate safeguards to ensure the privacy of PHI limits the uses and disclosures of such information without patient authorization. According to the HHS, "A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual's personal representative) authorizes in writing.".
Mental health professionals must ensure that PHI is not disclosed improperly and is accessible only to authorized individuals. PHI can be used or disclosed without patient authorization for treatment, payment, and healthcare operations. For example, sharing information with another healthcare provider for treatment is allowed.
There are specific circumstances where confidentiality can be breached, such as reporting child abuse or if a patient poses a danger to themselves or others. These exceptions must be understood and managed carefully.
The HIPAA Security Rule complements the Privacy Rule by setting standards for protecting electronic PHI. The HHS states that "the Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI."
Administrative safeguards involve policies and procedures designed to demonstrate HIPAA compliance, including conducting risk assessments and implementing risk management strategies. Physical safeguards are measures to protect electronic systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion, such as securing physical access to data storage areas.
Technical safeguards include technology and policies that protect electronic PHI and control access to it. These measures involve encryption and unique user IDs for accessing patient records.
Related: What are administrative, physical and technical safeguards?
The Breach Notification Rule requires covered entities to notify affected individuals, the Department of Health and Human Services (HHS), and sometimes the media when there is a breach of unsecured PHI.
Individuals must be notified with no unreasonable delay and no later than 60 days after a breach is discovered. Mental health professionals must also conduct a breach assessment that involves evaluating the nature and extent of the PHI involved, the person who used the PHI or to whom the disclosure was made, whether the PHI was actually acquired or viewed, and the extent to which the risk to the PHI has been mitigated.
Read more: Navigating HIPAA’s Breach Notification Rule
Psychotherapy notes receive special protection under HIPAA due to their sensitive nature. According to Russ Newman, PhD, JD, APA's executive director for practice, "These notes, which capture the psychologist's impressions about the patient and can contain information that is inappropriate for a medical record, are similar to what psychologists have historically referred to as "process notes."
The HHS further explains that "Psychotherapy notes do not include any information about medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, or results of clinical tests; nor do they include summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.".
Generally, these notes cannot be disclosed without the patient’s explicit authorization, except in specific circumstances such as legal proceedings or when required by law.
Patients have the right to access their medical records upon request. Providing easy access to records empowers patients to actively participate in their care and verify the accuracy of their health information. Mental health professionals should have processes to promptly fulfill patient requests for record access while maintaining confidentiality and security.
Related: What are patient rights under HIPAA?
Inform patients about how their information will be used and disclosed as part of treatment, payment, and healthcare operations. Obtain explicit consent from patients before sharing their information for purposes beyond routine care.
HIPAA compliant communication methods ensure a secure and efficient exchange of patient information among healthcare providers involved in a patient's care. Encourage interdisciplinary collaboration through secure channels to provide comprehensive care while adhering to privacy regulations.
Generally, HIPAA requires explicit patient authorization to disclose PHI to family members or caregivers. However, mental health professionals may share information if the patient agrees or if it's necessary to prevent harm or in emergencies where the patient is unable to consent.
HIPAA requires mental health professionals to use secure platforms and technologies for telehealth services to protect patient privacy. They should ensure that telehealth software complies with HIPAA standards for encryption, access control, and data security to prevent unauthorized disclosure of PHI during remote consultations.
Related: How does HIPAA apply to telehealth?
Mental health professionals can disclose patient information for public health activities without patient authorization when required by law to prevent or control disease, injury, or disability. This includes reporting communicable diseases or adverse events to public health authorities.