IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy Use and Disclosure of Psychotherapy Notes 10130

Transcription

1 IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy Use and Disclosure of Psychotherapy Notes POLICY INFORMATION Major Functional Area (MFA): MFA X - Office of General Counsel & Compliance Policy Title: Use and Disclosure of Psychotherapy Notes Responsible Executive (RE): General Counsel Sponsoring Organization (SO): Office of General Counsel Dates: Effective Date: Revised: Annual Review: I. POLICY STATEMENT In accordance with 45 CFR and , ISU adopts and implements this policy in order to: A. Provide guidance on the use and disclosure of a patient s psychotherapy notes for treatment, payment, or health care operations, and other specific purposes. B. Designate the form to be used to obtain authorization for the use and disclosure of psychotherapy notes. II. AUTHORITY AND RESPONSIBILITIES ISU is a hybrid entity in accordance with ISU s HIPPA Privacy Policy Only the health care component (i.e., the covered functions) of ISU must comply with this policy. All references in this policy to ISU shall be construed to refer only to the health care component of ISU. III. DEFINITIONS See HIPAA Privacy Policy IV. PROCEDURES TO IMPLEMENT A. Use and/or Disclosure of Psychotherapy Notes Without Authorization: HIPAA Privacy Use and Disclosure of Psychotherapy Notes Page 1 of 7

2 1. Psychotherapy notes are defined as notes recorded by a mental health professional that: a. Document or analyze the contents of a counseling session, and b. are separated from the rest of the medical record. Psychotherapy notes are used only by the therapist who wrote them. The definition expressly excludes the following information: i. Medication prescription and monitoring; ii. Modalities and frequencies of treatment furnished; iii. Results of clinical tests, and summary of: diagnosis, functional status, treatment plan, symptoms, prognosis, progress, and progress to date. 2. Special rules apply to the use and/or disclosure of psychotherapy notes under HIPAA. A covered entity may use and/or disclose psychotherapy notes for treatment, payment or health care operations in the following situations without authorization; a. Use by the originator of the psychotherapy notes for treatment; b. Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health work to improve their skills in group, joint, family, or individual counseling; c. Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; d. Use or disclosure required by the Secretary of the Department of Health and Human Services (DHHS) to investigate or determine the covered entity s compliance with HIPAA regulations; e. Use or disclosure required by law and limited to its relevant requirements; f. Disclosure to a health oversight agency for activities with respect to the oversight of the originator of the psychotherapy notes; g. Disclosure to coroners and medical examiners for the purpose of identifying a deceased individual, determining a cause of death, or other duties as authorized by law; or h. In a good faith belief that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. 3. The individual s authorization is required for the use or disclosure of psychotherapy notes in situations not listed above. B. Use and/or Disclosure of Psychotherapy Notes With Authorization: 1. An authorization for Use and/or Disclosure of Psychotherapy Notes must be used to obtain written authorization from individuals for use and/or disclosure of psychotherapy notes to carry out treatment, payment or health care operations in situations not described above. A sample form is attached to this policy (Attachment A Authorization for Use and/or Disclosure of Psychotherapy Notes) HIPAA Privacy Use and Disclosure of Psychotherapy Notes Page 2 of 7

3 2. The patient or his/her personal representative may authorize the use and/or disclosure psychotherapy notes for other than treatment, payment or health care operations by completing Attachment A. 3. Authorization for use and/or disclosure of psychotherapy notes is in addition to any other authorization given by the individual for the disclosure of other PHI to carry out treatment, payment, or health care operations. 4. The covered entity may not condition treatment on the individual signing Attachment A. 5. An authorization for use and/or disclosure of psychotherapy notes may only be combined with another authorization for use and/or disclosure of psychotherapy notes, and may not be combined with authorizations for the use and/or disclosure of other PHI. 6. An authorization must be obtained for disclosure of psychotherapy notes to family, close personal friends, and others involved in the individual s care. 7. Any authorization executed must include the following to be considered valid: a. A description of the information to be used or disclosed that identifies the information in a specific and meaningful manner; b. The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure; c. A description of each purpose of the requested use or disclosure. The statement at the request of the individual is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose; d. An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement end of the research study, none, or similar language is sufficient if the authorization is for a use or disclosure of PHI for research, including the creation and maintenance of a research database or research repository. See HIPAA Privacy Policy Use and Disclosure of PHI for Research; e. Statement that the individual has a right to revoke the authorization in writing, except to the extent that the covered entity has taken action in reliance thereon; f. Statement that the covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization; g. A statement that information used or disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and no longer protected by the HIPAA regulations; and HIPAA Privacy Use and Disclosure of Psychotherapy Notes Page 3 of 7

4 h. Be signed and dated by the individual; if the authorization is signed by a personal representative of the individual, a description of the representative s authority to act for the individual. 8. In addition to the above core elements and required statements, the authorization must be written in plain language. 9. The authorization is considered to be defective, and therefore invalid and may not be acted upon, if: a. The expiration date has passed or the expiration event is known by the covered entity to have occurred; b. The authorization has not been filled out completely, with respect to the required elements listed above; c. The authorization is known by the covered entity to have been revoked; d. The authorization for use and disclosure of psychotherapy notes is combined with an authorization for any other PHI; or e. The covered entity knows any material information in the authorization to be false. 10. If an invalid authorization is received, the covered entity must identify why it is invalid and return it to the requestor for completion. 11. If the authorization is valid, the covered entity must comply with the terms of the authorization. If the covered entity is concerned that a request for an individual s psychotherapy notes is not warranted or is excessive, the covered entity may consult with the individual to determine or not the authorization is consistent with the individual s wishes. 12. An individual s authorization for use or disclosure of psychotherapy notes to carry out treatment, payment, or health care operations must be maintained for six (6) years from its last effective date. 13. Transition Provisions The covered entity may use or disclose PHI that is created or received prior to April 14, 2003, pursuant to an authorization or other express legal permission obtained from the individual, regardless of whether such authorization satisfies the requirements of this policy, provided that the authorization or other express legal permission specifically permits such use and disclosure and there is no agreed to restriction in effect. C. Special Consideration: HIPAA Privacy Use and Disclosure of Psychotherapy Notes Page 4 of 7

5 1. Inmates See HIPAA Privacy Policy 011 Use and Disclosure of PHI Without Authorization. 2. Personal Representatives A covered entity must treat a personal representative of an adult or unemancipated minor as the individual per applicable state laws. 3. Revocation of Authorization The patient has the right to revoke an authorization, See HIPAA Privacy Policy Use and Disclosure of PHI With Authorization for requirements. V. REFERENCES HIPAA Privacy Policies 10020, 10110, 10120, HIPAA Regulations, 45 CFR , VI. ATTACHMENTS Attachment A Authorization for Use and/or Disclosure of Psychotherapy Notes PRESIDENTIAL CERTIFICATION Approved by Arthur C. Vailas President, Idaho State University Date: OGC use only: Received by OGC on by (initial). Published to ISUPP on by (initial) HIPAA Privacy Use and Disclosure of Psychotherapy Notes Page 5 of 7

6 Attachment A Idaho State University Authorization for Use and/or Disclosure of Psychotherapy Notes Patient Identification Printed Name: Date of Birth: Address: Social Security #: Telephone: Information To Be Released Psychotherapy Notes Only From (date) to (date) From (date) to (date) Purpose of Request Treatment or consultation Health care operations of ISU At the request of the patient Billing or claims payment Other, (specify) Person Authorized to Receive Information Name: Address: - Drug and/or Alcohol Abuse and/or Psychiatric, and/or HIV/AIDS Records Release I understand that if my medical or billing record contains information in reference to drug and/or alcohol abuse, psychiatric care, sexually transmitted disease, Hepatitis B or C testing, and/or other sensitive information, I agree to its release. Check One: Yes No Initials I understand that if my medical or billing record contains information in reference to HIV/AIDS (Human Immunodeficiency Virus/Acquired Immunodeficiency Syndrome) testing and/or treatment, I agree to its release. Check One: Yes No Initials Time Limit and Right to Revoke Authorization Except to the extent that action has already been taken in reliance on this authorization, at any time I can revoke this authorization by submitting a notice in writing to ISU Privacy Officer at [location and mailing address]. Unless revoked, this authorization will expire on the following date or event HIPAA Privacy Use and Disclosure of Psychotherapy Notes Page 6 of 7

7 Attachment A Idaho State University Authorization for Use and/or Disclosure of Psychotherapy Notes Re-disclosure I understand the information disclosed by this authorization may be subject to re-disclosure by the recipient and will no longer be protected by the Health Insurance Portability and Accountability Act of ISU, its employees, officers and physicians are hereby released from any legal responsibility or liability for disclosure of the above information to the extent indicated and authorized herein. Signature of Patient or Personal Representative Who May Request Disclosure I understand that ISU may not condition my treatment on whether I sign this authorization form unless specified above under Purposes of Request. I can inspect or copy the protected health information to be used or disclosed. I authorize Idaho State University to use and disclose the protected health information specified above. Signature: Date: Authority to Sign if not patient: Identity of Requestor Verified via: Photo ID Matching Signature Other, specify Verified by: HIPAA Privacy Use and Disclosure of Psychotherapy Notes Page 7 of 7