The Contentious Matter of ‘psychotherapy notes’ under HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) has many elements. None are quite so contentious as the matter of psychotherapy notes. Rather than trying to discuss the several sections in HIPAA regarding psychotherapy notes, I have attempted to define questions useful to psychotherapists, and have answered them with text taken directly from the HIPAA document itself. Those Questions, and HIPAA's answers follow this introduction. [Each Q is a link to its Answer] This has been written/edited in the hope that it will help reduce confusion for some. In spite of what we might wish HIPAA protected, the definite and limited protection of privacy for psychotherapy notes under HIPPA is simply that: narrowly defined, and very limited. Remember: when state and ethical privacy protections are greater, they override HIPAA regulation. 7/2/2002


[Link]: Printable version of this article.

Q1 What records are required under HIPAA?

Q2 What is the definition of psychotherapy notes under HIPAA?

Q3 What is excluded from the definition of

Q4 Under HIPAA must psychotherapy notes be kept separate from other records?

Q5 How and when may psychotherapy notes be disclosed under HIPAA?

Q6 When are the two times that protected health information must be disclosed under HIPAA?

Q7 What is the directive in the HIPAA rule concerning 'authorization for disclosure of psychotherapy notes to carry out treatment, payment and healthcare operations'?

Q8 Psychiatrists, psychologists, counselors, social workers, psychoanalysts. etc. are the

Q9 Are there other circumstances than a legal defense where psychotherapy notes might be disclosed by the psychotherapist without authorization?

Q10 Can payment of an insurance claim be denied solely for not authorizing disclosure of psychotherapy notes?

Q11 Is there agreement about the definition of psychotherapy notes or about the separation of psychotherapy notes from other notes? And how does HIPAA deal with these concerns?

Q12 So, since information about session theme, diagnosis, medications ... and any other information necessary for treatment or payment is always in the medical record, tell me, again, what is left that is protected as a

Q13 Do the notes of counselors, created solely for their own use and kept separate from the clinical record have the same

Q14 When psychotherapy notes are shared with others who provide care to an individual or family are they still

Q15 What happens if I share my psychotherapy notes with a colleague, supervisor or intern who is also providing care for the individual or family?

Q16 If there is no other record of some information than is in my psychotherapy notes, can I protect that information?

Q17 So, what about the special protections based on the Supreme Court decision in Jaffee v Redmond, and other excellent arguments for protecting mental health information?

Q18 And, what about the arguments of health plans, employers and insurers concerning psychotherapy notes?

Q19 So, I'll never have to ask for authorization to disclose psychotherapy notes, or will I?

Q20 There are the situations in which the patient/client is a

Q21 Can psychotherapy notes be demanded in the process of an insurance audit, or when the Secretary of HHS wants to exercise

Q22 How may psychotherapy notes be used in the process of a case against the therapist?

Q23 What about the protection of psychotherapy notes after they have been disclosed (whatever the circumstance of their disclosure)?

Q24 But my managed care plan asserts that they have the right to access all my records on their insureds?

Q25 Must the authorization for disclosure of psychotherapy notes always be separate from authorization to disclose other information?

Q26 What about Medicare's requirements for psychotherapy notes?

Q27 What about psychotherapy notes when someone files a complaint of privacy violation against the therapist under HIPAA?

Q28 Can psychotherapy notes be disclosed to coroners or medical examiners under HIPAA?

Q29 If information is shared by a treatment team is it still protected as psychotherapy notes under HIPAA?

Q1 What records are required under HIPAA?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Section 160.103 Definitions pp82488 - 82498 p 82489 In the final rule, we modify the definition of designated record set to specify certain records maintained by or for a covered entity that are always part of a covered entity's designated record sets and to include other records that are used to make decisions about individuals. We do not use the means of retrieval of a record as a defining criteria. For covered health care providers, designated record sets include, at a minimum, the medical record and billing record about individuals maintained by or for the provider. (emphasis added) In addition to these records, designated record sets include any other group of records that are used, in whole or in part, by or for a covered entity to make decisions about individuals. We note that records that otherwise meet the definition of designated record set and which are held by a business associate of the covered entity are part of the covered entity's designated record sets. we retain, with slight modifications, the definition of record, defining it as any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated.

Q 2 What is the definition of psychotherapy notes under HIPAA?

A.Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82497 Psychotherapy Notes Section 164.508(a)(3)(iv)(A) of the proposed rule defined psychotherapy notes as notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session.

Q3 What is excluded from the definition of "psychotherapy notes" under HIPAA?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82497 The proposed definition excluded medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis and progress. Furthermore, we stated in the preamble of the proposed rule that psychotherapy notes would have to be maintained separately from the medical record.

Q4 Under HIPAA must psychotherapy notes be kept separate from other records?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82497 In this final rule, we retain the definition of psychotherapy notes that we had proposed, but add to the regulation text the requirement that, to meet the definition of psychotherapy notes, the information must be separated from the rest of the individual's medical record.

Q5 How and when may psychotherapy notes be disclosed under HIPAA?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Section 164.502 – General Rules for Uses and disclosures of Protected Health Information pp-82498 - 82502. p 82498: Covered entities must, as under the proposed rule, obtain the individual's authorization’ in order to use or disclose psychotherapy notes for most purposes: see ß 164.508(a)(2) for exceptions to this rule. … p 82499: We permit a covered entity to use or disclose protected health information for other lawful purposes if the entity obtains a written ‘‘authorization’’ from the individual, consistent with the provisions of ß 164.508. Unlike ‘‘consents,’’ these ‘‘authorizations’’ are specific and detailed. (For details on who must obtain such authorizations and the requirements they must meet, see ß 164.508.) They are intended to provide the individuals with concrete information about, and control over, the uses and disclosures of protected health information about themselves.

Q6 When are the two times that protected health information must be disclosed under HIPAA?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82499: The final rule retains the provision that requires a covered entity to disclose protected health information only in two instances: When individuals request access to information about themselves, and when disclosures are compelled by the Secretary for compliance and enforcement purposes.

Q7 What is the directive in the HIPAA rule concerning 'authorization for disclosure of psychotherapy notes to carry out treatment, payment and healthcare operations'?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Section 164.508—Uses and Disclosures for Which an Authorization Is Required Section 164.508(a)—Standard ß 164.522).p 82513: … Specifically, except for psychotherapy notes (see below), covered entities are not required to obtain the individual’s authorization to use or disclose protected health information to carry out treatment, payment, and health care operations. (Covered entities may, however, be required to obtain the individual’s consent for these uses and disclosures. See the preamble regarding ß 164.506 for a discussion of ‘‘consent’’ versus ‘‘authorization’’.) … p 82514: Psychotherapy Notes In the NPRM, (Editor's note: NPRM refers to an early version of the rules, developed in 1997-98)we proposed different rules with respect to psychotherapy notes than we proposed with respect to all other protected health information. The proposed rule would have required covered entities to obtain an authorization for any use or disclosure of psychotherapy notes to carry out treatment, payment, or health care operations, unless the use was by the person who created the psychotherapy notes. With respect to all other protected health information, we proposed to prohibit covered entities from requiring authorization for uses and disclosures for these purposes. We significantly revise our approach to psychotherapy notes in the final rule. With a few exceptions, covered entities must obtain the individual’s authorization to use or disclose psychotherapy notes to carry out treatment, payment, or health care operations. A covered entity must obtain the individual’s consent, but not an authorization, for the person who created the psychotherapy notes to use the notes to carry out treatment and for the covered entity to use or disclose psychotherapy notes for conducting training programs in which students, trainees, or practitioners in mental health learn under supervision to (p 82515) practice or improve their skills in group, joint, family, or individual counseling. (Editor’s note: please compare and contrast the language cited above with later definitions and discussions of psychotherapy notes that follow, they don’t concur.)

Q8 Psychiatrists, psychologists, counselors, social workers, psychoanalysts. etc. are the

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82515 A covered entity may also use psychotherapy notes to defend a legal action or other proceeding brought by the individual pursuant to a consent, without a specific authorization. We note that, while this provision allows disclosure of these records to the covered entity’s attorney to defend against the action or proceeding, disclosure to others in the course of a judicial or administrative proceeding is governed by ß 164.512(e). This special provision is necessary because disclosure of protected health information for purposes of legal representatives may be made under the general consent as part of ‘‘health care operations.’’ Because we require an authorization for disclosure of psychotherapy notes for ‘‘health care operations,’’ an exception is needed to allow covered entities to use protected health information about an individual to defend themselves against an action threatened or brought by that individual without asking that individual for authorization to do so. Editors’ Note: Even though HHS (14780 Federal Register / Vol. 67, No. 59 / Wednesday, March 27, 2002 / Proposed Rules ) has dispensed with the requirement for “consents” in other areas of health care, making them voluntary, it remains necessary for psychotherapists to obtain appropriate written consents prior to creating clinical records, or maintaining psychotherapy notes. State laws and professional ethics codes protect that the privacy of psychotherapy override HIPAA and necessitate consent before any record or billing leave the clinician’s office.

Q9 Are there other circumstances than a legal defense where psychotherapy notes might be disclosed by the psychotherapist without authorization?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82515 Otherwise, a consent under ß 164.506 is not sufficient for the use or disclosure of psychotherapy notes to carry out treatment, payment, or health care operations. Authorization is required. We anticipate these authorizations will rarely be necessary, since psychotherapy notes do not include information that covered entities typically need for treatment, payment, or other types of health care operations. In the NRPM we proposed to permit covered entities to use and disclose psychotherapy notes for all other purposes permitted or required under the rule without authorization. In the final rule, we specify a more limited set of uses and disclosures of psychotherapy notes that covered entities are permitted to make without authorization. P 82515 An authorization is not required for use or disclosure of psychotherapy notes when required for enforcement purposes, in accordance with subpart C of part 160 of this subchapter; when mandated by law, in accordance with ß 164.512(a); when needed for oversight of the health care provider who created the psychotherapy notes, in accordance with ß 164.512(d); when needed by a coroner or medical examiner, in accordance with ß 164.512(g)(1); or when needed to avert a serious and imminent threat to health or safety (emphasis added), in accordance with ß 164.512(j)(1)(i). We also provide transition provisions in ß 164.532 regarding the effect of express legal permission obtained from an individual prior to the compliance date of this rule.

Q10 Can payment of an insurance claim be denied solely for not authorizing disclosure of psychotherapy notes?

A. Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82516 … Prohibition on Conditioning Treatment, Payment, Eligibility, or Enrollment … In the case of authorization for use or disclosure of psychotherapy notes or research information unrelated to treatment, we proposed to prohibit covered entities from conditioning treatment, payment, or enrollment in a health plan on obtaining such an authorization. We retain this basic approach but refine its application in the final rule. In addition to the general prohibition on conditioning treatment and payment, covered entities are also prohibited (with certain exceptions described below) from conditioning eligibility for benefits or enrollment in a health plan on obtaining an authorization. This prohibition extends to all authorizations, not just authorizations for use or disclosure of psychotherapy notes. (emphasis added) This prohibition is intended to prevent covered entities from coercing individuals into signing an authorization for a use or disclosure that is not necessary to carry out the primary services that the covered entity provides.

Q11 Is there agreement about the definition of psychotherapy notes or about the separation of psychotherapy notes from other notes? And how does HIPAA deal with these concerns?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Section 164.501 --- Definitions …pp 82605 – 82629 A. p 82623 Psychotherapy Notes Comment: Some commenters thought the definition of psychotherapy notes was contrary to standard practice. They claimed that reports of psychotherapy are typically part of the medical record and that psychologists are advised, for ethical reasons and liability risk management purposes, not to keep two separate sets of notes. Others acknowledged that therapists may maintain separate notations of therapy sessions for their own purpose. These commenters asked that we make clear that psychotherapy notes, at least in summary form, should be included in the medical record. Many plans and providers expressed concern that the proposed definition would encourage the creation of ‘‘shadow’’ records which may be dangerous to the patient and may increase liability for the health care providers. Some commenters claimed that psychotherapy notes contain information that is often essential to treatment. Response: We conducted fact-finding with providers and other knowledgeable parties to determine the standard practice of psychotherapists and determined that only some psychotherapists keep separate files with notes pertaining to psychotherapy sessions. These notes are often referred to as ‘‘process notes,’’ distinguishable from ‘‘progress notes,’’ ‘‘the medical record,’’ or ‘‘official records.’’ These process notes capture the therapist’s impressions about the patient, contain details of the psychotherapy conversation considered to be inappropriate for the medical record, and are used by the provider for future sessions. We were told that process notes are often kept separate to limit access, even in an electronic record system, because they contain sensitive information relevant to no one other than the treating provider. These separate ‘‘process notes’’ are what we are calling ‘‘psychotherapy notes.’’ Summary information, such as the current state of the patient, symptoms, summary of the theme of the psychotherapy session, diagnoses, medications prescribed, side effects, and any other information necessary for treatment or payment, is always placed in the patient’s medical record. Information from the medical record is routinely sent to insurers for payment.

Q12 So, since information about session theme, diagnosis, medications ... and any other information necessary for treatment or payment is always in the medical record, tell me, again, what is left that is protected as a

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: Various associations and their constituents asked that the exceptions for psychotherapy notes be extended to health care information from other health care providers. These commenters argued that psychotherapists are not the only providers or even the most likely providers to discuss sensitive and potentially embarrassing issues, as treatment and counseling for mental health conditions, drug abuse, HIV/AIDS, and sexual problems are often provided outside of the traditional psychiatric settings. One writer stated, ‘‘A prudent health care provider will always assess the past and present psychiatric medical history and symptoms of a patient.’’ Many commenters believed that the psychotherapy notes should include frequencies of treatment, results of clinical tests, and summary of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date. They claimed that this information is highly sensitive and should not be released without the individual’s written consent, except in cases of emergency. One commenter suggested listing the types of mental health information that can be requested by third party payors to make payment determinations and defining the meaning of each term. A. Response: As discussed above and in the NPRM, the rationale for providing special protection for psychotherapy notes is not only that they contain particularly sensitive information, but also that they are the personal notes of the therapist, intended to help him or her recall the therapy discussion and are of little or no use to others not involved in the therapy. Information in these notes is not intended to communicate to, or even be seen by, persons other than the therapist. Although all psychotherapy information may be considered sensitive, we have limited the definition of psychotherapy notes to only that information that is kept separate by the provider for his or her own purposes. It does not refer to the medical record and other sources of information that would normally be disclosed for treatment, payment, and health care operations.

Q13 Do the notes of counselors, created solely for their own use and kept separate from the clinical record have the same

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: One commenter was particularly concerned that the use of the term ‘‘counseling’’ in the definition of psychotherapy notes would lead to confusion because counseling and psychotherapy are different disciplines. A. Response: In the final rule, we continue to use the term ‘‘counseling’’ in the definition of ‘‘psychotherapy.’’ During our fact-finding, we learned that ‘‘counseling’’ had no commonly agreed upon definition, but seemed to be widely understood in practice. We do not intend to limit the practice of psychotherapy to any specific professional disciplines.

Q14 When psychotherapy notes are shared with others who provide care to an individual or family are they still

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: One commenter noted that the public mental health system is increasingly being called upon to integrate and coordinate services among other providers of mental health services and they have developed an integrated electronic medical record system for state-operated hospitals, part of which includes psychotherapy notes, and which cannot be easily modified to provide different levels of confidentiality. Another commenter recommended allowing use or disclosure of psychotherapy notes by members of an integrated health care facility as well as the originator. A. Response: The final rule makes it clear that any notes that are routinely shared with others, whether as part of the medical record or otherwise, are, by definition, not psychotherapy notes, as we have defined them. To qualify for the definition and the increased protection, the notes must be created and maintained for the use of the provider who created them i.e., the originator, and must not be the only source of any information that would be critical for the treatment of the patient or for getting payment for the treatment. The types of notes described in the comment would not meet our definition for psychotherapy notes.

Q15 What happens if I share my psychotherapy notes with a colleague, supervisor or intern who is also providing care for the individual or family?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: Many providers expressed concern that if psychotherapy notes were maintained separately from other protected health information, other health providers involved in the individual’s care would be unable to treat the patient properly. Some recommended that if the patient does not consent to sharing of psychotherapy notes for treatment purposes, the treating provider should be allowed to decline to treat the patient, providing a referral to another provider. A. Response: The final rule retains the policy that psychotherapy notes be separated from the remainder of the medical record in order to receive additional protection. We based this decision on conversations with mental health providers who have told us that information that is critical to the treatment of individuals is normally maintained in the medical record and that psychotherapy notes are used by the provider who created them and rarely for other purposes. A strong part of the rationale for the special treatment of psychotherapy notes is that they are the personal notes of the treating provider and are of little or no use to others who were not present at the session to which the notes refer.

Q16 If there is no other record of some information than is in my psychotherapy notes, can I protect that information?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: Several commenters requested that we clarify that the information contained in psychotherapy notes is being protected under the rule and not the notes themselves. They were concerned that the protection for psychotherapy notes would not be meaningful if health plans could demand the same information in a different format. A. Response: This rule provides special protection for the information in psychotherapy notes, but it does not extend that protection to the same information that may be found in other locations. We do not require the notes to be in a particular format, such as hand-written. They may be typed into a word processor, for example. Copying the notes into a different format, per se, would not allow the information to be accessed by a health plan. However, the requirement that psychotherapy notes be kept separate from the medical record and solely for the use of the provider who created them means that the special protection does not apply to the same information in another location.

Q17 So, what about the special protections based on the Supreme Court decision in Jaffee v Redmond, and other excellent arguments for protecting mental health information?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Section 164.508 ---Uses and Disclosures for which Authorization is Required pp-82650-82661, p 82652 Psychotherapy Notes Comment: Public response to the concept of providing additional protections for psychotherapy notes was divided. Many individuals and most providers, particularly mental health practitioners, advocated requiring consent for use or disclosure of all or most protected health information, but particularly sensitive information such as mental health information, not necessarily limited to psychotherapy notes. Others thought there should be special protections for psychotherapy information based on the federal psychotherapist-patient privilege created by the U.S. Supreme Court in Jaffee v. Redmond and the need for an atmosphere of trust between therapist and patient that is required for effective psychotherapy. Several consumer groups recommended prohibiting disclosure of psychotherapy notes for payment purposes. Some commenters, however, saw no need for special protections for psychotherapy communications and thought that the rules should apply the same protections for all individually identifiable information. Other commenters who advocated for no special protections based their opposition on the difficulty in drawing a distinction between physical and mental health and that special protections should be left to the states.

Q18 And, what about the arguments of health plans, employers and insurers concerning psychotherapy notes?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Many health plans and employers did not support additional protections for psychotherapy notes because they stated they need access to this information to assess the adequacy of treatment, the severity of a patient’s condition, the extent of a disability, or the ability to monitor the effectiveness of an individual’s mental health care and eligibility for benefits. Other commenters, many from insurance companies, cited the need to have psychotherapy notes to detect fraud. A few commenters said that it was not necessary to provide additional protections to psychotherapy notes because the ‘‘minimum necessary’’ provisions of the NPRM provide sufficient protections. A. Response: In the final rule, a covered entity generally must obtain an authorization for disclosure of psychotherapy notes, or for use by a person other than the person who created the psychotherapy notes. This authorization is specific to psychotherapy notes and is in addition to the consent an individual may have given for the use or disclosure of other protected health information to carry out treatment, payment, and health care operations. This additional level of individual control provides greater protection than a general application of the ‘‘minimum necessary’’ rule. Nothing in this regulation weakens existing rules applicable to mental health information that provide more stringent protections. (emphasis added) We do not intend to alter the holding in Jaffee v. Redmond. Generally, we have not treated sensitive information differently from other protected health information; however, we have provided additional protections for psychotherapy notes because of Jaffee v. Redmond and the unique role of this type of information.

Q19 So, I'll never have to ask for authorization to disclose psychotherapy notes, or will I?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations A. There are few reasons why other health care entities should need access to psychotherapy notes, and in those cases, the individual is in the best position to determine if the notes should be disclosed. As we have defined them, psychotherapy notes are primarily of use to the mental health professional who wrote them, maintained separately from the medical record, and not involved in the documentation necessary to carry out treatment, payment, or health care operations. Since psychotherapy notes have been defined to exclude information that health plans would typically need to process a claim for benefits, special authorization for payment purposes should be rare. (emphasis added) Unlike information shared with other health care providers for the purposes of treatment, psychotherapy notes are more detailed and subjective and are today subject to unique privacy and record retention practices. In fact, it is this separate existence and isolated use that allows us to grant the extra protection without causing an undue burden on the health care system.

Q20 There are the situations in which the patient/client is a

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p 82653 Comment: Many commenters suggested we prohibit disclosure of psychotherapy notes without authorization for uses and disclosures under proposed ß 164.510 of the NPRM, or that protections should be extended to particular uses and disclosures, such as disclosures for public health, law enforcement, health oversight, and judicial and administrative proceedings. One of these commenters stated that the only purpose for which psychotherapy notes should be disclosed without authorization is for preventing or lessening a serious or imminent threat to health or safety (proposed ß 154.510(k)). Another commenter stated that the rule should allow disclosure of psychotherapy notes without authorization for this purpose, or as required by law in cases of abuse or neglect. Other commenters did not want these protections to be extended to certain national priority activities. They claimed that information relative to psychotherapy is essential to states’ activities to protect the public from dangerous mentally ill offenders and abusers, to deliver services to individuals who are unable to authorize release of health care information, and for public health assessments. One commenter requested clarification of when psychotherapy notes could be released in emergency circumstances. Several commenters stated that psychotherapy notes should not be disclosed for public health purposes. A. Response: We agree with the commenters who suggested extending protections of psychotherapy notes and have limited the purposes for which psychotherapy notes may be disclosed without authorization for purposes other than treatment, payment, or health care operations. The final rule requires covered entities to obtain authorization to use or disclose psychotherapy notes for purposes listed in ß 164.512, with the following exceptions: An authorization is not required for use or disclosure of psychotherapy notes when the use or disclosure is required for enforcement of this rule, in accordance with ß 164.502(a)(2)(ii); when required by law, in accordance with ß 164.512(a); when needed for oversight of the covered health care provider who created the psychotherapy notes, in accordance with ß 164.512(d); when needed by a coroner or medical examiner, in accordance with ß 164.512(g)(1); or when needed to avert a serious and imminent threat to health or safety, in accordance with ß 164.512(j)(1)(i).

Q21Can psychotherapy notes be demanded in the process of an insurance audit, or when the Secretary of HHS wants to exercise

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: A commenter suggested that we follow the federal regulations governing confidentiality of alcohol and substance abuse records as a model for limited disclosure of psychotherapy notes for audits or evaluations. Under these regulations, a third party payor or a party providing financial assistance may access confidential records for auditing purposes if the party agrees in writing to keep the records secure and destroy any identifying information upon completion of the audit. (42 CFR part 2) A. Response: We agree that the federal regulations concerning alcohol and drug abuse provide a good model for protection of information. However, according to our fact-finding discussions, audit or evaluation should not require access to psychotherapy notes. Protected health information kept in the medical record about an individual should be sufficient for these purposes. The final rule does not require authorization for use or disclosure of psychotherapy notes when needed for oversight of the covered health care provider (emphasis added) who created the psychotherapy notes

Q22 How may psychotherapy notes be used in the process of a case against the therapist?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: A provider organization urged that the disclosure of psychotherapy notes be strictly prohibited except to the extent needed in litigation brought by the client against the mental health professional on the grounds of professional malpractice or disclosure in violation of this section. A. Response: We agree that psychotherapy notes should be available for the defense of the provider who created the notes when the individual who is the subject of the notes puts the contents of the notes at issue in a legal case. In the final rule, we allow the provider to disclose the notes to his or her lawyer for the purpose of preparing a defense. Any other disclosure related to judicial and administrative proceedings is governed by ß 164.512(e).

Q23 What about the protection of psychotherapy notes after they have been disclosed (whatever the circumstance of their disclosure)?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: One commenter requested that we prohibit mental health information that has been disclosed from being re-disclosed without patient authorization. A. Response: Psychotherapy notes may only be disclosed pursuant to an authorization, except under limited circumstances. Covered entities must adhere to the terms of authorization and not disclose psychotherapy notes to persons other than those identified as intended recipients or for other purposes. A covered entity that receives psychotherapy notes must adhere to the terms of this rule—including obtaining an authorization for any further use or disclosure. We do not have the authority, however, to prohibit noncovered entities from re-disclosing psychotherapy notes or any other protected health information.

Q24 But my managed care plan asserts that they have the right to access all my records on their insureds?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: A provider organization argued for inclusion of language in the final rule that specifies that real or perceived ‘‘ownership’’ of the mental health record does not negate the requirement that patients must specifically authorize the disclosure of their psychotherapy notes. They cited a July 1999 National Mental Health Association survey, which found that or purposes of utilization review, every managed care plan policy reviewed ‘‘maintains the right to access the full medical record (including detailed psychotherapy notes) of any consumer covered under its benefit plan at its whim.’’ At least one of the major managed health plans surveyed considered the patient record to be the property of the health plan and governed by the health plan’s policies. A. Response: Although a covered entity may own a mental health record, the ability to use or disclose an individual’s information is limited by state law and this rule. Under this rule, a mental health plan would not have access to psychotherapy notes created by a covered provider unless the individual who is the subject of the notes authorized disclosure to the health plan.

Q25 Must the authorization for disclosure of psychotherapy notes always be separate from authorization to disclose other information?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: Some commenters expressed concern regarding the burden created by having to obtain multiple authorizations and requested clarification as to whether separate authorization for use and disclosure of psychotherapy notes is required. A. Response: For the reasons explained above, we retain in the final rule a requirement that a separate authorization must be obtained for most uses or disclosures of psychotherapy notes, including those for treatment, payment, and health care operations. The burden of such a requirement is extremely low, however, because under our definition of psychotherapy notes, the need for such authorization will be very rare.

Q26 What about Medicare's requirements for psychotherapy notes?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: One commenter stated that Medicare should not be able to require the disclosure of psychotherapy notes because it would destroy a practitioner’s ability to treat patients effectively. A. Response: We agree. As in the proposed rule, covered entities may not disclose psychotherapy notes for payment purposes without an authorization. (emphasis added) If a specific provision of law requires the disclosure of these notes, a covered entity may make the disclosure under ß 164.512(a). The final rule, however, does not require the disclosure of these notes to Medicare.

Q27 What about psychotherapy notes when someone files a complaint of privacy violation against the therapist under HIPAA?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations p82654 Comment: One commenter expressed concern that by filing a complaint an individual would be required to reveal sensitive information to the public. Another commenter suggested that complaints regarding noncompliance in regard to psychotherapy notes should be made to a panel of mental health professionals designated by the Secretary. This commenter also proposed that all patient information would be maintained as privileged, would not be revealed to the public, and would be kept under seal after the case is reviewed and closed. A. Response: We appreciate this concern and the Secretary will ensure that individually identifiable health information and other personal information contained in complaints will not be available to the public. This Department seeks to protect the privacy of individuals to the fullest extent possible, while permitting the exchange of records required to fulfill its administrative and program responsibilities. The Freedom of Information Act, 5 U.S.C. 552, and the HHS implementing regulation, 45 CFR part 5, protect records about individuals if the disclosure would constitute an unwarranted invasion of their personal privacy, as does the Privacy Act, 5 U.S.C. 552a. See the discussion of FOIA and the Privacy Act in the ‘‘Relationship to Other Federal Laws’’ section of the preamble. Information that the Secretary routinely withholds from the public in its current enforcement activities includes individual names, addresses, and medical information. Additionally, the Secretary attempts to guard against the release of information that might involve a violation of personal privacy by someone being able to ‘‘read between the lines’’ and piece together items that would constitute information that normally would be protected from release to the public. In implementing the privacy rule, the Secretary will continue this practice of protecting personal information. It is not clear whether the commenter with regard to the use of mental health professionals believes that such professionals should be involved because they would be best able to keep psychotherapy notes confidential or because such professionals can best understand the meaning or relevance of such notes. We anticipate that we would not have to obtain a copy or review psychotherapy notes in investigating most complaints regarding noncompliance in regard to such notes. There may be some cases in which a quick review of the notes may be needed, such as when we need to identify that the information a covered entity disclosed was in fact psychotherapy notes. If we need to obtain a copy of psychotherapy notes, we will keep these notes confidential and secure. Investigative staff will be trained in privacy to ensure that they fully respect the confidentiality of personal information. In addition, while the content of these notes is generally not relevant to violations under this rule, we will secure the expertise of mental health professionals if needed in reviewing psychotherapy notes.

Q28 Can psychotherapy notes be disclosed to coroners or medical examiners under HIPAA?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: A mental health organization recommended prohibiting health plans and covered health care providers from disclosing psychotherapy notes to coroners or medical examiners. A. Response: In general, we have severely limited disclosures of psychotherapy notes without the individual’s authorization. One case where the information may prove invaluable, but authorization by the individual is impossible and authorization by a surrogate is potentially contraindicated, is in the investigation of the death of the individual. The final rule allows for disclosures to coroners or medical examiners in this limited case. (emphasis added)

Q29 If information is shared by a treatment team is it still protected as psychotherapy notes under HIPAA?

Federal Register / Vol. 65, No. 250 / Thursday, December 28, 2000 / Rules and Regulations Comment: Several commenters were concerned that in practice, a treatment team in a mental health facility shares information about a patient in order to care for the patient and that the provision requiring authorization for use and disclosure of psychotherapy notes would expose almost all privileged information to disclosure. They requested that we add a provision that any authorization or disclosure under that statute shall not constitute a waiver of the psychotherapist-patient privilege. A. Response: Because of the restricted definition we have adopted for psychotherapy notes, we do not expect that members of a team will share such information. Information shared in order to care for the patient is, by definition, not protected as psychotherapy notes. (emphasis added) With respect to waiving privilege, however, we believe that the consents and authorizations described in ßß 164.506 and 164.508 should not be construed as waivers of a patient’s evidentiary privilege. See the discussions under ß 164.506 and ‘‘Relationship to Other Laws,’’ above.