What Does HIPAA Require of Mental Health Professionals: Psychotherapy Notes
Mental health professionals, like other healthcare providers, must follow the HIPAA Privacy Rule, the HIPAA Breach Notification Rule, and the HIPAA Security Rule. However, the HIPAA Privacy Rule also benefits mental health professionals. The Privacy Rule allows psychotherapists to create a kind of treatment record apart from the regular medical record. This “other” kind of record is psychotherapy notes. Psychotherapy notes document or analyze the contents of conversation during a private counseling session. Notes may contain conclusions, beliefs, and theories about a patient’s condition. Psychotherapists frequently rely on the notes produced in one session to provide treatment in the next session. A psychotherapist may note, in one session, that a patient appeared to be agitated or depressed. Over several sessions, the notes may eventually reveal a trend in behavior that allows the doctor to reach a diagnosis.
If a psychotherapist were forced to disclose their own private thinking, in the form of psychotherapy notes, to patients, family members, the government, or other third parties, the therapist might be less inclined to keep the notes in the first place. They might feel that their own privacy – privacy of their thought process – would be invaded if their notes could be made available to either the patient or the public. Quality of treatment might suffer if disclosure of notes were required.
Therefore, the Privacy Rule provides special protection and benefit to psychotherapists. Unlike the case with other protected health information, only the creator of the psychotherapy notes may use the notes for treatment purposes. Use or disclosure of the notes by others for purposes of treatment, payment, or healthcare operations generally requires a patient’s written authorization. Use or disclosure of the notes for other reasons also requires a patient’s written authorization. There are only a few instances in which psychotherapists can be made to share psychotherapy notes without authorization. A psychotherapist may be required to disclose notes, without authorization, when required to by law, such as for mandatory reporting of abuse, and in mandatory “duty to warn” situations regarding threats of serious and imminent harm made by the patient (some states require the psychotherapist to warn individuals whom a patient has threatened with immediate and serious harm; other states simply permit the psychotherapist to give the warning).
Since the purpose of psychotherapy notes is to assist and benefit the provider, even patients do not have a right of access to therapy notes. A psychotherapist may choose to share these notes, but is not required to. A patient cannot file a right of access complaint over a refusal to share the notes.