HHS has issued a new document entitled: Guidance on HIPAA and Sharing Information Related to Mental Health. The Guidance answers questions regarding when it is appropriate under the Privacy Rule for a health care provider to share the protected health information (PHI) of a patient who is being treated for a mental health condition. For example, disclosures regarding:
- Psychotherapy Notes;
- Where a mental health patient has the opportunity to “agree or object”;
- Where a mental health patient is incapacitated;
- Disclosure of mental health information to law enforcement;
- Disclosure of mental health information with legal representatives; and
- The intersection of HIPAA, mental health information, and more “stringent” state laws.
The Guidance does NOT provide any new regulatory requirements, BUT does provide an excellent summary of some of the more confusing HIPAA issues that come up often and are complex to parse.
In addition, the guidance clarifies when HIPAA permits health care providers to:
- Communicate with a patient’s family members, friends, or others involved in the patient’s care;
- Communicate with family members when the patient is an adult;
- Communicate with the parent of a patient who is a minor;
- Consider the patient’s capacity to agree with or object to the sharing of his or her information;
- Involve a patient’s family members, friends or others in dealing with patient failures to adhere to medication or other therapy;
- Listen to family members about their loved ones receiving mental health treatment;
- Communicate with family members, law enforcement or others when the patient presents a serious and imminent threat of harm to self or others; and
- Communicate to law enforcement about the release of a patient brought in for an emergency psychiatric hold.
Covered entities and business associates reviewing the new guidance should remember that if a state law is more protective of the patient’s mental health information than HIPAA, the state law takes precedence over HIPAA.
The guidance also provides relevant reminders about related issues, such as the heightened protections afforded to psychotherapy notes by the Privacy Rule, a parent’s right to access the protected health information of a minor child as the child’s personal representative, the potential applicability of Federal alcohol and drug abuse confidentiality regulations or state laws that may provide more stringent protections for the information than HIPAA, and the intersection of HIPAA and FERPA in a school setting.
The complete guidance is available at:http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/mhguidance.html