Header graphic for print
HealtHITech Law HIPAA, HITECH and Beyond

New HHS Guidance on HIPAA Privacy Rule and Sharing Mental Health Information

Posted in Access Rights, Behavioral Health

Many thanks to our colleague Robin Canowitz for assisting us in drafting this post.

The U.S. Department of Health & Human Services (“HHS”) issued new guidance regarding the HIPAA Privacy Rule and its relationship to mental health information disclosures (“Guidance”).  The Guidance addresses when providers may appropriately share the protected health information (“PHI”) of their mental health patients and provides important reminders about HIPAA Privacy Rule issues surrounding mental health records. 

The Guidance also advises that the disclosure of mental health information, like all PHI, must comply with both HIPAA and all other federal, state, and local laws that regulate such disclosures (e.g., 42 C.F.R Part 2 Substance Abuse Program and the Family Educational Rights and Privacy Act rules).

Communications With Family and Friends

Under 45 C.F.R. § 164.510(b), health care providers may communicate with a patient’s family members and friends when the patient does not object and the disclosures are directly relevant to that person’s involvement in the patient’s care or payment for care.  A provider may have permission to disclose PHI (or permission may be inferred) when a family member or friend is present in the treatment room at the patient’s invitation.  HHS confirms that if a patient is incapacitated, a provider may share information with family and friends when that provider determines, based upon professional judgment, that the disclosure is in the patient’s best interest.  The Guidance provides clear examples permitting disclosure when the patient does not object:

  • A psychiatrist may discuss the drugs a patient needs to take with the patient’s sister who is present with the patient at a mental health care appointment.
  • A therapist may give information to a patient’s spouse about warning signs that may signal a developing emergency.

The Guidance examines 45 C.F.R. § 164.510(b)(3), which permits a provider to disclose mental health information to friends or family when a patient is not present or is unable to agree or object due to incapacity or emergency circumstances and the provider believes it is in the patient’s best interests.  Again, the disclosure must be directly relevant to the person’s involvement in the patient’s care or payment for care.  In making these determinations, the provider should consider a patient’s prior expressed preferences and offer the patient who regains capacity the chance to agree or object to future disclosures. 

The Guidance emphasizes that providers must abide by the wishes of their adult mental health patients who object to disclosures to friends and family.  Nevertheless, HHS reiterates that HIPAA permits providers to warn family members or law enforcement if the provider perceives a serious and imminent threat to the health or safety of the patient or others and the disclosure may reasonably prevent or lessen the risk of harm. 

State laws also may impose an affirmative “duty to warn” on mental health professionals when a patient poses an imminent threat.  Providers regulated under Part 2 may have additional duties. 

Psychotherapy Notes           

The Guidance emphasizes that HIPAA provides extra protection to psychotherapy notes maintained separately since the therapist’s personal notes are not required for treatment, payment or healthcare operations.  With few exceptions, providers must obtain a separate authorization to disclose psychotherapy notes.

Minor Mental Health Records

HHS also discusses 45 C.F.R. § 164.502(g), which contains several exceptions to the general rule that a provider may disclose PHI to a parent or guardian as the personal representative of a minor child:

A parent is not treated as a minor’s personal representative when: (1) State or other law does not require the consent of a parent before a minor can obtain a particular health care service, the minor consents to the service, and the minor has not requested the parent be the personal representative; (2) someone besides the parent is authorized by law to consent to the service and provides such consent; or (3) a parent agrees to a confidential relationship between the minor and provider with respect to the service.

The Guidance also states that parents do not have a right to a minor’s psychotherapy notes, although providers have discretion under HIPAA to disclose an individual’s PHI (including psychotherapy notes) to the individual’s personal representative.  HHS advises providers to consult State or local law for any restrictions on such disclosures.