What Does HIPAA Require of Mental Health Professionals?

The HIPAA regulations work by requiring something of one group, to protect or benefit another group. This characteristic is true of most regulations. Securities regulations, for example, are designed to protect investors, by regulating stock brokers and investment advisors. Environmental regulations are designed to protect individuals, land, and air, from pollution by commercial activity. HIPAA requires covered entities to safeguard individual PHI. Covered entities are regulated so that individuals benefit from increased privacy and security. There is one covered entity that HIPAA benefits as well as regulates – mental health professionals. The issues of what does HIPAA require of mental health professionals, and how HIPAA benefits mental health professionals, are discussed below.

What Does HIPAA Require of Mental Health Professionals: What Can be Shared?

Under HIPAA, therapists may share pertinent information (information directly related to treatment) with people involved in a person’s care if the person in treatment:

HIPAA also allows therapists to discuss information that is relevant to a person’s care with other members of their healthcare team. HIPAA permits the sharing of factual information, such as names of medications, symptoms, appointment start and end times, and diagnosis. Another answer to the question of what does HIPAA require of mental health professionals is that they may not share psychotherapy notes, except in limited circumstances.

What Does HIPAA Require of Mental Health Professionals: Psychotherapy Notes

Mental health professionals, like other healthcare providers, must follow the HIPAA Privacy Rule, the HIPAA Breach Notification Rule, and the HIPAA Security Rule. However, the HIPAA Privacy Rule also benefits mental health professionals. The Privacy Rule allows psychotherapists to create a kind of treatment record apart from the regular medical record. This “other” kind of record is psychotherapy notes. Psychotherapy notes document or analyze the contents of conversation during a private counseling session. Notes may contain conclusions, beliefs, and theories about a patient’s condition. Psychotherapists frequently rely on the notes produced in one session to provide treatment in the next session. A psychotherapist may note, in one session, that a patient appeared to be agitated or depressed. Over several sessions, the notes may eventually reveal a trend in behavior that allows the doctor to reach a diagnosis. 

If a psychotherapist were forced to disclose their own private thinking, in the form of psychotherapy notes, to patients, family members, the government, or other third parties, the therapist might be less inclined to keep the notes in the first place. They might feel that their own privacy – privacy of their thought process – would be invaded if their notes could be made available to either the patient or the public. Quality of treatment might suffer if disclosure of notes were required. 

Therefore, the Privacy Rule provides special protection and benefit to psychotherapists. Unlike the case with other protected health information, only the creator of the psychotherapy notes may use the notes for treatment purposes. Use or disclosure of the notes by others for purposes of treatment, payment, or healthcare operations generally requires a patient’s written authorization. Use or disclosure of the notes for other reasons also requires a patient’s written authorization. There are only a few instances in which psychotherapists can be made to share psychotherapy notes without authorization. A psychotherapist may be required to disclose notes, without authorization, when required to by law, such as for mandatory reporting of abuse, and in  mandatory “duty to warn” situations regarding threats of serious and imminent harm made by the patient (some states require the psychotherapist to warn individuals whom a patient has threatened with immediate and serious harm; other states simply permit the psychotherapist to give the warning). 

Since the purpose of psychotherapy notes is to assist and benefit the provider, even patients do not have a right of access to therapy notes. A psychotherapist may choose to share these notes, but is not required to. A patient cannot file a right of access complaint over a refusal to share the notes.