OCR’s Guidance on the HIPAA Privacy Rule and Sharing Information Related to Mental Health Sherri Morgan, JD, MSW Health Information Privacy Specialist U.S. Dept. of Health & Human Services, Office for Civil Rights April 4, 2014

HIPAA Privacy Rule and Sharing Information Related to Mental health Context for guidance includes President’s Executive Actions on Reducing Gun Violence and Congressional inquiries. Guidance clarifies how the Privacy Rule applies in certain situations to the disclosure of protected health information (PHI) of a patient who is being treated for a mental health condition. Does not create a new rule or amend existing standards.

OCR Guidance on Sharing Information Related to Mental health Available at: http://www.hhs.gov/ocr/privacy/hipaa/understand ing/special/mhguidance.html

Background Strong privacy protections are critical for maintaining individuals’ trust in health care providers and willingness to access treatment, particularly for mental health conditions. At times, sharing health and mental health information is needed to enhance treatment and for the health and safety of the patient or others. The HIPAA Privacy Rule is balanced to protect privacy and allow uses and disclosures of information for treatment and other appropriate purposes.

45 CFR § 164.508(a)(2)—Protections for psychotherapy notes HIPAA Protections for Mental Health Information HIPAA generally applies uniformly to all PHI, including mental health information. An exception exists for psychotherapy notes, which receive special protections. Psychotherapy notes: document the content of a counseling session; are maintained separately from the medical record; and excludes medications, dates and times of treatment, treatment modalities and frequencies, clinical test results, and summary clinical information.

Psychotherapy Notes ̶ Access and Disclosure Patients and personal representatives do not have a right to access psychotherapy notes under HIPAA. Generally, separate written authorization is required to disclose psychotherapy notes to a third party. An exception: authorization is not required to disclose psychotherapy notes to prevent serious and imminent threats and for mandatory reporting, such as reporting of abuse.

Sharing Information with Family and Friends 45 CFR § 164.510(b)—Uses and disclosures of PHI requiring an opportunity for the individual to agree or object 45 CFR § 164.502(g)—Personal representatives of adults and minors 45 CFR § 164.524(a)(1)(i)—No right to access psychotherapy notes

Communications with Family, Friends and 45 CFR § 164.510(b) Communications with Family, Friends and Others Involved in a Patient’s Care—Individuals Who are Present and Have Decision Making Capacity Must give patient opportunity to agree or object: Ask patient’s permission Inform patient of intent to inform family or friends and give opportunity to object Infer from circumstances, using professional judgment, that patient does not object May disclose only the PHI directly relevant to person’s involvement in patient’s care/payment for care

Communications with Family, Friends and 45 CFR § 164.510(b)(3) Communications with Family, Friends and Others Involved in a Patient’s Care—Individuals Not Present or Without Decision Making Capacity Health care provider determines, based on professional judgment, that sharing information is in best interests of the patient May disclose only the PHI directly relevant to person’s involvement in patient’s care/payment for care

Mental Condition May Constitute Incapacity Incapacity may be temporary or long-term. If a patient does not have capacity to agree or object due to current mental state, the provider may disclose limited information to family and friends if provider determines, based on professional judgment, that disclosure is in the patient’s best interests, taking into account the patient’s prior expressed preferences and circumstances of the current situation. Once patient regains capacity, provider should offer patient opportunity to agree or object to any future sharing of information.

Examples of Sharing Patients’ PHI With Family Permissible, where patient does not object: A psychiatrist discusses with a patient’s sister who is present at an appointment, the drugs the patient needs to take A mental health clinician gives information to a patient’s spouse about warning signs that may signal a developing mental health emergency Impermissible: A nurse discusses a patient’s mental health information with the patient’s brother after the patient stated she does not want family to know about her condition.

Disclosing Patients’ Medication Non-compliance Rules on sharing information with family and friends generally apply. If a patient with capacity objects to disclosure, the provider may only disclose if: Doing so is consistent with applicable law and standards of ethical conduct; and Provider has a good faith belief that patient poses a serious and imminent threat to self or others, and family member or friend is reasonably able to prevent or lessen that threat.

Options for Concerned Family and Friends 45 CFR § 164.524(a)(2)(v) Options for Concerned Family and Friends HIPAA protects the confidentiality decisions of patients if they choose not to allow disclosure of mental health information to family and friends. HIPAA doesn’t prevent providers from listening to family members or other caregivers who may have concerns about the health and well-being of the patient. If patient later requests access to record, provider may withhold from the patient information that was shared by another person under a promise of confidentiality, if disclosing the information would reveal its source.

Related OCR Resources Fact Sheet for Providers on Disclosures to Family Members and Friends www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/provider_ffg.pdf

45 CFR § 164.502(g) Parents and Minors Generally, parents are the personal representatives of their minor children for HIPAA purposes, and providers may share patient information with a patient’s personal representative. However, there are certain exceptions, e.g., where a minor may obtain certain health care services without parental consent under State or other law. HIPAA defers to state law to determine age of majority. See OCR Guidance on Personal Representatives, http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentiti es/personalreps.html

Disclosures for Health and Safety Purposes 45 CFR § 164.512(j)—Disclosures to prevent or lessen a serious and imminent threat to health or safety 45 CFR § 164.512(f)(2)—Disclosures to locate or identify suspects, fugitives, material witnesses, or missing persons 45 CFR § 164.512(f)(1)—Disclosures due to court orders, warrants, and subpoenas; and administrative requests 45 CFR § 164.512(a), (c)—State law mandatory disclosures (e.g., abuse, domestic violence injuries, etc.)

Dangerous Patients and Public Safety Disclosures 45 CFR 164.512(j) Dangerous Patients and Public Safety Disclosures Disclosures are permitted to law enforcement, family, friends or others who are in a position to lessen the threatened harm—when disclosure “is necessary to prevent or lessen a serious and imminent threat to the health or safety of the patient or others.” Disclosures must be consistent with applicable law and standards of ethical conduct. See Letter to Nation’s Health Care Providers (1/15/2013) www.hhs.gov/ocr/office/lettertonationhcp.pdf

Temporary Psychiatric Holds by Law Enforcement 45 CFR § 164.512 Temporary Psychiatric Holds by Law Enforcement Notification to law enforcement of psychiatric patients’ release from health care facility may be based on: Law enforcement requests, if the patient is a suspect, fugitive, material witness Court orders, warrants, judicial subpoenas, written administrative requests Mandatory disclosures Prevention of serious and imminent threats.

Dually-diagnosed Patients with Drug or Alcohol Abuse 42 CFR Part 2 Programs Dually-diagnosed Patients with Drug or Alcohol Abuse Concurrent diagnosis for a mental health disorder and drug or alcohol abuse is not uncommon. Providers in federally funded drug and alcohol abuse treatment programs are subject to 42 USC § 290dd-2 and 42 CFR § 2.11, et. seq. (“Part 2”). Part 2 confidentiality rules are more stringent than HIPAA and may apply in dual diagnosis cases, if treatment is in a Part 2 program.

School Personnel Notifications to Parents or Law Enforcement FERPA, not HIPAA, generally applies to schools’ information about students. OCR Guidance on FERPA and HIPAA http://www.hhs.gov/ocr/privacy/hipaa/understanding/covereden tities/hipaaferpajointguide.pdf

Recent OCR Activity on Other HIPAA Topics Spanish version of model Notices of Privacy Practices published online, http://www.hhs.gov/ocr/privacy/hipaa/modelnotices.html CLIA Related Amendments—patients have a right to access test results directly from clinical laboratories NICS NPRM—reporting “mental health prohibitor” status; public comment period closed on March 10, 2014 Marketing Guidance on Refill Reminders and Similar Communications (implementing HITECH Act, § 13406(a)(2)), http://www.hhs.gov/ocr/privacy/hipaa/understanding/covereden tities/marketingrefillreminder.html

Marissa Gordon-Nguyen, JD, MPH Q & A Sherri Morgan, JD, MSW Health Information Privacy Specialist HHS, Office for Civil Rights Marissa Gordon-Nguyen, JD, MPH