HIPAA, Psychotherapy Notes, and Other Mental Health Records

/in ,

By Kim Stanger

The HIPAA privacy rules give special protection to “psychotherapy notes,” but providers often misunderstand what are and are not covered and how they differ from other mental health records.

I. “Psychotherapy Notes” Defined.

Contrary to popular belief, HIPAA does not provide special protection to mental health records in general, but it does give added protection to “psychotherapy notes”. As defined by HIPAA,

Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

(45 C.F.R. § 164.501). To be considered “psychotherapy notes”, the notes must be separate from the medical record. The 2000 commentary explains the reason for this rule along with HHS’s practical view of what constitutes “psychotherapy notes”:

Comment: Some commenters thought the definition of psychotherapy notes was contrary to standard practice. They claimed that reports of psychotherapy are typically part of the medical record and that psychologists are advised, for ethical reasons and liability risk management purposes, not to keep two separate sets of notes….

Response: We conducted fact-finding with providers and other knowledgeable parties to determine the standard practice of psychotherapists and determined that only some psychotherapists keep separate files with notes pertaining to psychotherapy sessions. These notes are often referred to as “process notes,” distinguishable from “progress notes,” “the medical record,” or “official records.” These process notes capture the therapist’s impressions about the patient, contain details of the psychotherapy conversation considered to be inappropriate for the medical record, and are used by the provider for future sessions. We were told that process notes are often kept separate to limit access, even in an electronic record system, because they contain sensitive information relevant to no one other than the treating provider. These separate “process notes” are what we are calling “psychotherapy notes.” Summary information, such as the current state of the patient, symptoms, summary of the theme of the psychotherapy session, diagnoses, medications prescribed, side effects, and any other information necessary for treatment or payment, is always placed in the patient’s medical record. Information from the medical record is routinely sent to insurers for payment.

Comment: … Many commenters believed that the psychotherapy notes should include frequencies of treatment, results of clinical tests, and summary of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date. They claimed that this information is highly sensitive and should not be released without the individual’s written consent, except in cases of emergency….

Response: As discussed above and in the NPRM, the rationale for providing special protection for psychotherapy notes is not only that they contain particularly sensitive information, but also that they are the personal notes of the therapist, intended to help him or her recall the therapy discussion and are of little or no use to others not involved in the therapy. Information in these notes is not intended to communicate to, or even be seen by, persons other than the therapist. Although all psychotherapy information may be considered sensitive, we have limited the definition of psychotherapy notes to only that information that is kept separate by the provider for his or her own purposes. It does not refer to the medical record and other sources of information that would normally be disclosed for treatment, payment, and health care operations.

Comment: One commenter was particularly concerned that the use of the term “counseling” in the definition of psychotherapy notes would lead to confusion because counseling and psychotherapy are different disciplines.

Response: In the final rule, we continue to use the term “counseling” in the definition of “psychotherapy.” During our fact-finding, we learned that “counseling” had no commonly agreed upon definition, but seemed to be widely understood in practice. We do not intend to limit the practice of psychotherapy to any specific professional disciplines.

Comment: One commenter noted that the public mental health system is increasingly being called upon to integrate and coordinate services among other providers of mental health services and they have developed an integrated electronic medical record system for state-operated hospitals, part of which includes psychotherapy notes, and which cannot be easily modified to provide different levels of confidentiality. Another commenter recommended allowing use or disclosure of psychotherapy notes by members of an integrated health care facility as well as the originator.

Response: The final rule makes it clear that any notes that are routinely shared with others, whether as part of the medical record or otherwise, are, by definition, not psychotherapy notes, as we have defined them. To qualify for the definition and the increased protection, the notes must be created and maintained for the use of the provider who created them i.e., the originator, and must not be the only source of any information that would be critical for the treatment of the patient or for getting payment for the treatment. The types of notes described in the comment would not meet our definition for psychotherapy notes.

Comment: Many providers expressed concern that if psychotherapy notes were maintained separately from other protected health information, other health providers involved in the individual’s care would be unable to treat the patient properly…

Response: The final rule retains the policy that psychotherapy notes be separated from the remainder of the medical record in order to receive additional protection. We based this decision on conversations with mental health providers who have told us that information that is critical to the treatment of individuals is normally maintained in the medical record and that psychotherapy notes are used by the provider who created them and rarely for other purposes. A strong part of the rationale for the special treatment of psychotherapy notes is that they are the personal notes of the treating provider and are of little or no use to others who were not present at the session to which the notes refer.

(65 F.R. 82622-23, emphasis added).

II. Limits on Use or Disclosure of Psychotherapy Notes.

  1. Permissible Uses; Authorizations. Unlike other protected health information, only the creator of the psychotherapy notes may use the notes for treatment purposes; use or disclosure by others for purposes of treatment payment or healthcare operations or for other reasons generally require the patient’s HIPAA-compliant authorization. The relevant rule states:

    Authorization required: psychotherapy notes. Notwithstanding any provision of this subpart, … a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:
    1. To carry out the following treatment, payment, or health care operations:
      1. Use by the originator of the psychotherapy notes for treatment;
      2. Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or
      3. Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and
    2. A use or disclosure that is required by § 164.502(a)(2)(ii) [i.e., a disclosure to HHS] or permitted by § 164.512(a) [i.e., disclosure required by another law, such as reporting abuse]; § 164.512(d) with respect to the oversight of the originator of the psychotherapy notes [i.e., health oversight activities]; § 164.512(g)(1) [i.e., coroners]; or § 164.512(j)(1)(i) [i.e., disclosures to avoid harm to patient or others].

    (45 C.F.R. § 164.508(a)(2)). “An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.” (Id. at § 164.508(b)(3)(ii)).

    The Office for Civil Rights has explained the differing standards that apply to psychotherapy notes as compared to other mental health records:

    Generally, the Privacy Rule applies uniformly to all protected health information, without regard to the type of information. One exception to this general rule is for psychotherapy notes, which receive special protections….

    Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment, or health care operations purposes, other than by the mental health professional who created the notes. Therefore, with few exceptions, the Privacy Rule requires a covered entity to obtain a patient’s authorization prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes. See 45 CFR 164.508(a)(2). A notable exception exists for disclosures required by other law, such as for mandatory reporting of abuse, and mandatory “duty to warn” situations regarding threats of serious and imminent harm made by the patient (State laws vary as to whether such a warning is mandatory or permissible).

    (OCR, HIPAA Privacy Rule and Sharing Information Related to Mental Health, emphasis added.).

  2. Denial of Access. Unlike other protected health information, a healthcare provider may deny a patient or their personal representative access to psychotherapy notes. (45 C.F.R. § 164.524(a)(1)(ii)). The OCR has published the following FAQ on the issue:

    Does a parent have a right to receive a copy of psychotherapy notes about a child’s mental health treatment?

    No. The Privacy Rule distinguishes between mental health information in a mental health professional’s private notes and that contained in the medical record. It does not provide a right of access to psychotherapy notes…. Psychotherapy notes are primarily for personal use by the treating professional and generally are not disclosed for other purposes. Thus, the Privacy Rule includes an exception to an individual’s (or personal representative’s) right of access for psychotherapy notes. See 45 CFR 164.524(a)(1)(i).

    (OCR, HIPAA Privacy Rule and Sharing Information Related to Mental Health).

    HHS commentary affirms that the right to deny access only applies to psychotherapy notes, not other mental health records:

    We generally agree with the commenters concerns that denying access specifically to mental health records could create distrust. To balance this concern with other commenters’ concerns about the potential for psychological harm, however, we exclude psychotherapy notes from the right of access. This is the only distinction we make between mental health information and other types of protected health information in the access provisions of this rule. Unlike other types of protected health information, these notes are not widely disseminated through the health care system. We believe that the individual’s privacy interests in having access to these notes, therefore, are outweighed by the potential harm caused by such access. We encourage covered entities that maintain psychotherapy notes, however, to provide individuals access to these notes when they believe it is appropriate to do so.

    (65 F.R. 82733, emphasis added). In the context of parental access, the OCR explained:

    [P]arents generally are the personal representatives of their minor child and, as such, are able to receive a copy of their child’s mental health information contained in the medical record, including information about diagnosis, symptoms, treatment plans, etc. Further, although the Privacy Rule does not provide a right for a patient or personal representative to access psychotherapy notes regarding the patient, HIPAA generally gives providers discretion to disclose the individual’s own protected health information (including psychotherapy notes) directly to the individual or the individual’s personal representative. As any such disclosure is purely permissive under the Privacy Rule, mental health providers should consult applicable State law for any prohibitions or conditions before making such disclosures.

    (OCR, HIPAA Privacy Rule and Sharing Information Related to Mental Health). Thus, there is no general right to deny access to other mental health records that are not psychotherapy notes. If the patient requests psychotherapy notes along with other records, “[t]he covered entity must, to the extent possible, give the individual access to any other protected health information requested, after excluding the [psychotherapy notes].” (45 C.F.R. § 164.524(d)(1)). That should be relatively easy because, by definition, psychotherapy notes must be maintained separately from other medical records.

    To deny access to mental health records beyond psychotherapy notes, the provider would have to fit within one of the other exceptions in § 164.524, including but not limited to the following:

    1. The “information was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information;”
    2. “A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person;”
    3. “The protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person;” or
    4. “The request for access is made by the individual’s personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.”

    (Id. at § 164.524(a)(2)-(3)). A patient who is denied access to their mental health records under situations (2) to (4), above, is entitled to have the denial reviewed by a licensed independent practitioner identified by the provider. (Id. at § 164.524(a)(4)).

  3. Psychotherapy Notes and Health Information Organizations. Because of the special protection given psychotherapy notes, providers generally may not share psychotherapy notes with healthcare databanks absent the patient’s authorization. The OCR published the following FAQ:

    Does the HIPAA Privacy Rule permit a covered entity to disclose psychotherapy notes to or through a health information organization (HIO)?

    Yes, provided the covered entity has obtained the individual’s written authorization in accordance with 45 C.F.R. § 164.508…. With few exceptions, the Privacy Rule requires a covered entity to obtain individual authorization prior to a disclosure of psychotherapy notes, even for a disclosure to a health care provider other than the originator of the notes, for treatment purposes. For covered entities operating in an electronic environment, the Privacy Rule does, however, allow covered entities to disclose protected health information pursuant to an electronic copy of a valid and signed authorization, as well as to obtain HIPAA authorizations electronically from individuals, provided any electronic signature is valid under applicable law.

    (OCR FAQ, emphasis added).

III. Other Laws.

Although HIPAA does not give special protection to mental health records as compared to psychotherapy notes, state laws may. To the extent those state laws are more restrictive than HIPAA, providers are required to comply with those laws in addition to HIPAA. (45 C.F.R. § 160.203).

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913

This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.