• E-mail
• Print
• RSS

Tip: Analyze preemption statutes when addressing HIPAA's requirements for psychotherapy notes

HIPAA Weekly Advisor, July 27, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Take a close look at state laws before developing policies and procedures for complying with the privacy rule's requirements for psychotherapy notes. "Many states already have more prescriptive laws for mental health records than HIPAA," says Beth Hjort, RHIA, CHP, professional practice manager for the American Health Information Management Association. A preemption analysis is crucial, she says. "Those more stringent laws preempt HIPAA."

It's also important to look at the federal regulation on confidentiality of alcohol and drug abuse patient records, says Hjort. "Some psychotherapy records have alcohol and drug abuse information in them, so [that rule's requirements] also have to be woven into the release of information."

But in order to conduct a preemption analysis, you need to fully understand the privacy rule's requirements. And psychotherapy notes can be confusing, says Hjort. "In the past, we've tended to think of behavioral health records as a collection. But HIPAA singles out [behavioral therapy] notes for special handling and leaves all other types of psychotherapy records to be handled the same as all other PHI."

In most cases, psychotherapy notes can only be released with patients' authorization, so patients are in the driver's seat, says Hjort. Authorizations for uses or disclosures of psychotherapy notes may be combined, but only with others related to psychotherapy notes.

According to Section 164.508(a)(2) of the privacy rule, covered entities may use and disclose psychotherapy notes without obtaining patient authorization to carry out their own limited treatment, payment, or health care operations. Uses and disclosures that do not require patient authorization include those for the following purposes:

• By the originator of the notes for treatment
• For the covered entity's own training programs for its mental health professionals, students, and trainees
• By the covered entity to defend itself in a legal action or other proceeding brought by the patient
• Required for enforcement of the regulations by HHS
• Mandated by law
• For oversight of the provider who created the notes
• Needed by a coroner or medical examiner
• Needed to avert a serious and imminent threat to health or safety

Facilities may not use or disclose psychotherapy notes for purposes of another covered entity's treatment, payment, or health care operations without obtaining authorization.

Facilities must separate psychotherapy notes from the rest of patients' medical records, which can make patients feel more secure about their privacy, says Hjort. "It boosts their confidence to know that whatever is stated at a therapy session won't make its way into the general medical record and is protected in a special way."

Commentary in the privacy rule encourages facilities to provide access to psychotherapy notes when they believe it is appropriate to do so, but the privacy rule does not grant patients a right of access. "It's an area that takes very careful handling, because you're dealing with individuals who feel that it's information they have the right to know," says Hjort. But the psychotherapist or physician has to use professional judgment to determine whether it's in the best interest of the patient to provide access to the notes. "They know best," she says.

Editor's note: From the upcoming July 2003 issue of Briefings on HIPAA.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive