HIPAA Compliance for Therapists: What You Need to Know

HIPAA Compliance for Therapists

You probably already know that you need to meet specific HIPAA standards to be compliant. That’s why you’re reading this in the first place. But what are those standards, and how can you be sure that you meet all of them? HIPAA compliance for therapists has the same basic requirements as other medical specialties, with some minor exceptions.

Use and Disclosure of PHI

A significant component of HIPAA regulates the proper uses and disclosures of protected health information (PHI). Generally, the use and disclosure of PHI is allowed for treatment, payment, and healthcare operations. This means that PHI can only be shared for these purposes unless the patient provides written authorization for another use or disclosure.

To be HIPAA compliant, therapists must provide patients with a Notice of Privacy Practices upon intake that outlines how the practice will use and disclose their PHI.

HIPAA also allows therapists to discuss information relevant to a person’s care with other members of their healthcare team. HIPAA permits the sharing of factual information, such as names of medications, symptoms, appointment start and end times, and diagnosis. 

Under HIPAA, therapists may share pertinent information (information directly related to treatment) with people involved in a person’s care if the person in treatment:

  • Has agreed
  • Has been given an opportunity to object and has not objected
  • Has indicated they want the other person’s involvement, by, for example, bringing the other person to treatment, or having the other person help schedule sessions and pick up prescriptions
  • Is incapable of making decisions as a result of being unconscious, delirious, or otherwise unable to object or agree

HIPAA Release Forms

If your practice requires a disclosure of PHI not covered by payment, treatment, or healthcare operations, then you must ensure that you obtain a HIPAA release form BEFORE any PHI can be disclosed. This is essential to both maintaining the privacy of your patients and protecting your practice from potential HIPAA violations and fines.

Some instances when a HIPAA waiver form is required include for:

  • Disclosure of PHI to a third party for any reason other than treatment, payment, or healthcare operations
  • PHI used in marketing or fundraising efforts
  • PHI shared for research purposes
  • Disclosure of any psychotherapy notes
  • PHI disclosed or shared for monetary compensation

Let’s Simplify Compliance

Do you need help with HIPAA for therapists? We can help!

Learn More!
HIPAA Seal of Compliance

Psychotherapy Notes Under HIPAA 

Psychotherapy notes under HIPAA are subject to slightly different rules. Psychotherapy notes contain particularly sensitive information. These notes constitute the therapist’s personal notes – notes that usually are not required or useful for treatment, payment, or healthcare operations purposes (other than by the mental health professional who created the notes).

HIPAA Psychotherapy Notes Release Form

HIPAA psychotherapy notes release forms are generally required to be signed by patients for any reason, including disclosure for treatment purposes to a healthcare provider other than the originator of the notes. 

However, a therapist does not need authorization to use or disclose psychotherapy notes:

  • For its own training 
  • To defend itself in legal proceedings brought by the individual
  • For HHS to investigate or determine the covered entity’s compliance with the Privacy Rule
  • To avert a serious and imminent threat to public health or safety
  • To a health oversight agency for lawful oversight of the originator of the psychotherapy notes
  • For the legal activities of a coroner or medical examiner

HIPAA Right of Access

The HIPAA Right of Access requires therapists to provide patients with copies of their medical records upon request. To comply with the right of access standard, requested records must be provided within 30 days of request, in the format the patient requests them in. Therapists are also limited