OCR s Guidance on the HIPAA Privacy Rule and Sharing Information Related to Mental Health Sherri Morgan, JD, MSW Health Information Privacy Specialist U.S. Dept. of Health & Human Services, Office for Civil Rights April 4, 2014 1
HIPAA Privacy Rule and Sharing Information Related to Mental health Context for guidance includes President s Executive Actions on Reducing Gun Violence and Congressional inquiries. Guidance clarifies how the Privacy Rule applies in certain situations to the disclosure of protected health information (PHI) of a patient who is being treated for a mental health condition. Does not create a new rule or amend existing standards. 2
OCR Guidance on Sharing Information Related to Mental health Available at: http://www.hhs.gov/ocr/privacy/hipaa/understand ing/special/mhguidance.html 3
Background Strong privacy protections are critical for maintaining individuals trust in health care providers and willingness to access treatment, particularly for mental health conditions. At times, sharing health and mental health information is needed to enhance treatment and for the health and safety of the patient or others. The HIPAA Privacy Rule is balanced to protect privacy and allow uses and disclosures of information for treatment and other appropriate purposes. 4
45 CFR 164.508(a)(2) Protections for psychotherapy notes HIPAA Protections for Mental Health Information HIPAA generally applies uniformly to all PHI, including mental health information. An exception exists for psychotherapy notes, which receive special protections. Psychotherapy notes: 1. document the content of a counseling session; 2. are maintained separately from the medical record; and 3. excludes medications, dates and times of treatment, treatment modalities and frequencies, clinical test results, and summary clinical information. 5
Psychotherapy Notes Access and Disclosure Patients and personal representatives do not have a right to access psychotherapy notes under HIPAA. Generally, separate written authorization is required to disclose psychotherapy notes to a third party. An exception: authorization is not required to disclose psychotherapy notes to prevent serious and imminent threats and for mandatory reporting, such as reporting of abuse. 6
Sharing Information with Family and Friends 45 CFR 164.510(b) Uses and disclosures of PHI requiring an opportunity for the individual to agree or object 45 CFR 164.502(g) Personal representatives of adults and minors 45 CFR 164.524(a)(1)(i) No right to access psychotherapy notes 7
45 CFR 164.510(b) Communications with Family, Friends and Others Involved in a Patient s Care Individuals Who are Present and Have Decision Making Capacity Must give patient opportunity to agree or object: Ask patient s permission Inform patient of intent to inform family or friends and give opportunity to object Infer from circumstances, using professional judgment, that patient does not object May disclose only the PHI directly relevant to person s involvement in patient s care/payment for care 8
45 CFR 164.510(b)(3) Communications with Family, Friends and Others Involved in a Patient s Care Individuals Not Present or Without Decision Making Capacity Health care provider determines, based on professional judgment, that sharing information is in best interests of the patient May disclose only the PHI directly relevant to person s involvement in patient s care/payment for care 9
Mental Condition May Constitute Incapacity Incapacity may be temporary or long term. If a patient does not have capacity to agree or object due to current mental state, the provider may disclose limited information to family and friends if provider determines, based on professional judgment, that disclosure is in the patient s best interests, taking into account the patient s prior expressed preferences and circumstances of the current situation. Once patient regains capacity, provider should offer patient opportunity to agree or object to any future sharing of information. 10
Examples of Sharing Patients PHI With Family Permissible, where patient does not object: A psychiatrist discusses with a patient s sister who is present at an appointment, the drugs the patient needs to take A mental health clinician gives information to a patient s spouse about warning signs that may signal a developing mental health emergency Impermissible: A nurse discusses a patient s mental health information with the patient s brother after the patient stated she does not want family to know about her condition. 11
Disclosing Patients Medication Non compliance Rules on sharing information with family and friends generally apply. If a patient with capacity objects to disclosure, the provider may only disclose if: Doing so is consistent with applicable law and standards of ethical conduct; and Provider has a good faith belief that patient poses a serious and imminent threat to self or others, and family member or friend is reasonably able to prevent or lessen that threat. 12
45 CFR 164.524(a)(2)(v) Options for Concerned Family and Friends HIPAA protects the confidentiality decisions of patients if they choose not to allow disclosure of mental health information to family and friends. HIPAA doesn t prevent providers from listening to family members or other caregivers who may have concerns about the health and well being of the patient. If patient later requests access to record, provider may withhold from the patient information that was shared by another person under a promise of confidentiality, if disclosing the information would reveal its source. 13
Related OCR Resources Fact Sheet for Providers on Disclosures to Family Members and Friends www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/ provider_ffg.pdf 14
45 CFR 164.502(g) Parents and Minors Generally, parents are the personal representatives of their minor children for HIPAA purposes, and providers may share patient information with a patient s personal representative. However, there are certain exceptions, e.g., where a minor may obtain certain health care services without parental consent under State or other law. HIPAA defers to state law to determine age of majority. See OCR Guidance on Personal Representatives, http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentiti es/personalreps.html 15
Disclosures for Health and Safety Purposes 45 CFR 164.512(j) Disclosures to prevent or lessen a serious and imminent threat to health or safety 45 CFR 164.512(f)(2) Disclosures to locate or identify suspects, fugitives, material witnesses, or missing persons 45 CFR 164.512(f)(1) Disclosures due to court orders, warrants, and subpoenas; and administrative requests 45 CFR 164.512(a), (c) State law mandatory disclosures (e.g., abuse, domestic violence injuries, etc.) 16
45 CFR 164.512(j) Dangerous Patients and Public Safety Disclosures Disclosures are permitted to law enforcement, family, friends or others who are in a position to lessen the threatened harm when disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of the patient or others. Disclosures must be consistent with applicable law and standards of ethical conduct. See Letter to Nation s Health Care Providers (1/15/2013) www.hhs.gov/ocr/office/lettertonationhcp.pdf 17
45 CFR 164.512 Temporary Psychiatric Holds by Law Enforcement Notification to law enforcement of psychiatric patients release from health care facility may be based on: Law enforcement requests, if the patient is a suspect, fugitive, material witness Court orders, warrants, judicial subpoenas, written administrative requests Mandatory disclosures Prevention of serious and imminent threats. 18
42 CFR Part 2 Programs Dually diagnosed Patients with Drug or Alcohol Abuse Concurrent diagnosis for a mental health disorder and drug or alcohol abuse is not uncommon. Providers in federally funded drug and alcohol abuse treatment programs are subject to 42 USC 290dd 2 and 42 CFR 2.11, et. seq. ( Part 2 ). Part 2 confidentiality rules are more stringent than HIPAA and may apply in dual diagnosis cases, if treatment is in a Part 2 program. 19
School Personnel Notifications to Parents or Law Enforcement FERPA, not HIPAA, generally applies to schools information about students. OCR Guidance on FERPA and HIPAA http://www.hhs.gov/ocr/privacy/hipaa/understanding/covereden tities/hipaaferpajointguide.pdf 20
Recent OCR Activity on Other HIPAA Topics Spanish version of model Notices of Privacy Practices published online, http://www.hhs.gov/ocr/privacy/hipaa/modelnotices.html CLIA Related Amendments patients have a right to access test results directly from clinical laboratories NICS NPRM reporting mental health prohibitor status; public comment period closed on March 10, 2014 Marketing Guidance on Refill Reminders and Similar Communications (implementing HITECH Act, 13406(a)(2)), http://www.hhs.gov/ocr/privacy/hipaa/understanding/covereden tities/marketingrefillreminder.html 21
Q & A Sherri Morgan, JD, MSW Health Information Privacy Specialist HHS, Office for Civil Rights Marissa Gordon Nguyen, JD, MPH Health Information Privacy Specialist HHS, Office for Civil Rights 22