According to the U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) guidance on HIPAA Privacy Rule and Sharing Information Related to Mental Health, there are times when it is appropriate for a health care provider to share Protected Health Information (PHI) of a patient being treated for a mental health condition.
Communication with Family, Friends, or Others
HIPAA allows a health care provider to communicate with a patient's family, friends or other persons who are involved in the patient's care. The Privacy Rule allows routine and often critical communications between health care providers and these persons, as long as the patient is present, has the capacity to make health care decisions, and as long as the patient does not object.
A provider may choose to ask for the patient's permission, may explain to the patient he or she plans on discussing information, giving the patient an opportunity to agree or object; or if necessary, may infer from the circumstances, using professional judgment, that the patient does not object.
Extra Protections for Mental Health Information
The Privacy Rule applies uniformly to PHI without regard to the type information, except for psychotherapy notes, which receive special protections. With few exceptions the Privacy Rule requires a covered entity to obtain a patient's authorization prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes. Exceptions are when a disclosure is required by law or in mandatory "duty to warn" situations. State laws vary if a warning is mandatory or permissible.
Communication with Adult Patient's Parents or Other Family Members
A health care provider is permitted to discuss an adult patient's mental health information with a patient's parent's or other family if a patient is given the opportunity and does not object.
Health care providers may share or discuss only the information the person involved needs to know about the patient's care or payment for care. There may be other applicable laws or professional ethics that impose stricter limitations on sharing PHI, especially where the information related to a patient's mental health.
Mental Health Illness or Mental Condition Constitutes Incapacity
The HIPAA Privacy Rule permits a health care provider, when a patient is not present or is unable to agree or object to a disclosure due to incapacity (e.g. patient is unconscious) or emergency circumstances, to determine whether disclosing a patient's information to the patient's family, friends, or others involved in the patient's care or payment for care, is in the best interests of the patient.
A Patient Stopped Taking Prescribed Medications
The doctor must respect the wishes of the patient with respect to the disclosure. If a patient does not object, a provider may discuss a patient's mental health information with the patient's family members. The provider may also discuss information if based on the provider's professional judgment, the patient does not have the capacity to agree or object the sharing of the information, and the sharing of that information is in the patient's best interests. In both cases, only the information that the family member involved needs to know about the patient's care or payment for care should be disclosed.
The sharing of information must be consistent with applicable law and standards of ethical conduct. An exception is if a provider has a good faith belief a patient is a high risk for committing suicide. A doctor may believe a good faith disclosure is necessary. A provider is allowed to disclose health information if there is a good faith belief that the disclosure is necessary to prevent a serious and imminent threat to the health safety of the patient or others.
Discussion of a Minor Child Patient's Mental Health Status and Needs
HIPAA defers to state law to determine the age of majority and the rights of parents to act for a child in making health care decisions. A parent, guardian, or other person acting in loco parentis usually is the personal representative of the child under the Privacy Rule with respect to general treatment situations.
Exceptions of this general rule in the Privacy Rule include:
(1) State or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, the minor consents to the health care service, and the minor child has not requested the parent be treated as a personal representative;
(2) someone other than the parent is authorized by law to consent to the provision of a particular health service to a minor and provides such consent; or
(3) a parent agrees to a confidential relationship between the minor and a health care provider with respect to the health care service.
In situations where a minor patient is being treated for a mental health disorder and a substance abuse disorder, additional laws may be applicable.
Copy of Psychotherapy Notes about a Child's Mental Health Treatment
A parent does not have a right to receive a copy of psychotherapy notes about a child's mental health treatment. The Privacy Rule distinguishes between mental health information in a mental health professional's private notes and the information contained in the medical record. It does not provide a right to access psychotherapy notes. Psychotherapy notes are primarily for personal use by the treating professional and generally are not disclosed for other purposes.
Parents generally are the personal representatives of their minor child. Parents are able to receive a copy of their child's mental health information contained in the medical record, including information about the diagnosis, symptoms, treatment plans, etc.
What if a Patient is Going to Hurt Self or Others?
The Privacy Rule permits a health care provider to disclose necessary information about a patient to law enforcement, family members of the patient, or other persons, when the provider believes the patient presents a serious and imminent threat to self or others.
What about Mental Health Information Held by a School?
Student health information held by a school generally is subject to the Family Educational Rights and Privacy Act. In limited circumstances the HIPAA Privacy Rule and not the Family Educational Rights and Privacy Act may apply in a school setting. The Rule allows disclosures to parents of a minor patient or to law enforcement in various situations. For example, disclosures to prevent or lessen serious and imminent threats to the health and safety of the patient or others are permitted.
If you have any additional questions about the HIPAA Privacy Rule and the sharing of information related to mental health, please do not hesitate to contact one of our professional consultants.