1. OCR’s Guidance on the HIPAA Privacy Rule and Sharing Information Related to Mental Health
Sherri Morgan, JD, MSW
Health Information Privacy Specialist
U.S. Dept. of Health & Human Services, Office for Civil Rights
April 4, 2014

2. HIPAA Privacy Rule and Sharing Information Related to Mental health
Context for guidance includes President’s Executive Actions on Reducing Gun Violence and Congressional inquiries.
Guidance clarifies how the Privacy Rule applies in certain situations to the disclosure of protected health information (PHI) of a patient who is being treated for a mental health condition.
Does not create a new rule or amend existing standards.

3. OCR Guidance on Sharing Information Related to Mental health
Available at:
ing/special/mhguidance.html

4. Background
Strong privacy protections are critical for maintaining individuals’ trust in health care providers and willingness to access treatment, particularly for mental health conditions.
At times, sharing health and mental health information is needed to enhance treatment and for the health and safety of the patient or others.
The HIPAA Privacy Rule is balanced to protect privacy and allow uses and disclosures of information for treatment and other appropriate purposes.

5. 45 CFR § 164.508(a)(2)—Protections for psychotherapy notes
HIPAA Protections for Mental Health Information
HIPAA generally applies uniformly to all PHI, including mental health information.
An exception exists for psychotherapy notes, which receive special protections.
Psychotherapy notes:
document the content of a counseling session;
are maintained separately from the medical record; and
excludes medications, dates and times of treatment, treatment modalities and frequencies, clinical test results, and summary clinical information.

6. Psychotherapy Notes ̶ Access and Disclosure
Patients and personal representatives do not have a right to access psychotherapy notes under HIPAA.
Generally, separate written authorization is required to disclose psychotherapy notes to a third party.
An exception: authorization is not required to disclose psychotherapy notes to prevent serious and imminent threats and for mandatory reporting, such as reporting of abuse.

7. Sharing Information with Family and Friends
45 CFR § (b)—Uses and disclosures of PHI requiring an opportunity for the individual to agree or object
45 CFR § (g)—Personal representatives of adults and minors
45 CFR § (a)(1)(i)—No right to access psychotherapy notes

8. Communications with Family, Friends and
45 CFR § (b)
Communications with Family, Friends and
Others Involved in a Patient’s Care—Individuals Who are Present and Have Decision Making Capacity
Must give patient opportunity to agree or object:
Ask patient’s permission
Inform patient of intent to inform family or friends and give opportunity to object
Infer from circumstances, using professional judgment, that patient does not object
May disclose only the PHI directly relevant to person’s involvement in patient’s care/payment for care

9. Communications with Family, Friends and
45 CFR § (b)(3)
Communications with Family, Friends and
Others Involved in a Patient’s Care—Individuals Not Present or Without Decision Making Capacity
Health care provider determines, based on professional judgment, that sharing information is in best interests of the patient
May disclose only the PHI directly relevant to person’s involvement in patient’s care/payment for care

10. Mental Condition May Constitute Incapacity
Incapacity may be temporary or long-term.
If a patient does not have capacity to agree or object due to current mental state, the provider may disclose limited information to family and friends if provider determines, based on professional judgment, that disclosure is in the patient’s best interests, taking into account the patient’s prior expressed preferences and circumstances of the current situation.
Once patient regains capacity, provider should offer patient opportunity to agree or object to any future sharing of information.

11. Examples of Sharing Patients’ PHI With Family
Permissible, where patient does not object:
A psychiatrist discusses with a patient’s sister who is present at an appointment, the drugs the patient needs to take
A mental health clinician gives information to a patient’s spouse about warning signs that may signal a developing mental health emergency
Impermissible:
A nurse discusses a patient’s mental health information with the patient’s brother after the patient stated she does not want family to know about her condition.

12. Disclosing Patients’ Medication Non-compliance
Rules on sharing information with family and friends generally apply.
If a patient with capacity objects to disclosure, the provider may only disclose if:
Doing so is consistent with applicable law and standards of ethical conduct; and
Provider has a good faith belief that patient poses a serious and imminent threat to self or others, and family member or friend is reasonably able to prevent or lessen that threat.

13. Options for Concerned Family and Friends
45 CFR § (a)(2)(v)
Options for Concerned Family and Friends
HIPAA protects the confidentiality decisions of patients if they choose not to allow disclosure of mental health information to family and friends.
HIPAA doesn’t prevent providers from listening to family members or other caregivers who may have concerns about the health and well-being of the patient.
If patient later requests access to record, provider may withhold from the patient information that was shared by another person under a promise of confidentiality, if disclosing the information would reveal its source.

14. Related OCR Resources
Fact Sheet for Providers on Disclosures to Family Members and Friends

15. 45 CFR § (g)
Parents and Minors
Generally, parents are the personal representatives of their minor children for HIPAA purposes, and providers may share patient information with a patient’s personal representative.
However, there are certain exceptions, e.g., where a minor may obtain certain health care services without parental consent under State or other law.
HIPAA defers to state law to determine age of majority.
See OCR Guidance on Personal Representatives, es/personalreps.html

16. Disclosures for Health and Safety Purposes
45 CFR § (j)—Disclosures to prevent or lessen a serious and imminent threat to health or safety
45 CFR § (f)(2)—Disclosures to locate or identify suspects, fugitives, material witnesses, or missing persons
45 CFR § (f)(1)—Disclosures due to court orders, warrants, and subpoenas; and administrative requests
45 CFR § (a), (c)—State law mandatory disclosures (e.g., abuse, domestic violence injuries, etc.)

17. Dangerous Patients and Public Safety Disclosures
45 CFR (j)
Dangerous Patients and Public Safety Disclosures
Disclosures are permitted to law enforcement, family, friends or others who are in a position to lessen the threatened harm—when disclosure “is necessary to prevent or lessen a serious and imminent threat to the health or safety of the patient or others.”
Disclosures must be consistent with applicable law and standards of ethical conduct.
See Letter to Nation’s Health Care Providers (1/15/2013)

18. Temporary Psychiatric Holds by Law Enforcement
45 CFR §
Temporary Psychiatric Holds by Law Enforcement
Notification to law enforcement of psychiatric patients’ release from health care facility may be based on:
Law enforcement requests, if the patient is a suspect, fugitive, material witness
Court orders, warrants, judicial subpoenas, written administrative requests
Mandatory disclosures
Prevention of serious and imminent threats.

19. Dually-diagnosed Patients with Drug or Alcohol Abuse
42 CFR Part 2 Programs
Dually-diagnosed Patients with Drug or Alcohol Abuse
Concurrent diagnosis for a mental health disorder and drug or alcohol abuse is not uncommon.
Providers in federally funded drug and alcohol abuse treatment programs are subject to 42 USC § 290dd-2 and 42 CFR § 2.11, et. seq. (“Part 2”).
Part 2 confidentiality rules are more stringent than HIPAA and may apply in dual diagnosis cases, if treatment is in a Part 2 program.

20. School Personnel Notifications to Parents or Law Enforcement
FERPA, not HIPAA, generally applies to schools’ information about students.
OCR Guidance on FERPA and HIPAA tities/hipaaferpajointguide.pdf

21. Recent OCR Activity on Other HIPAA Topics
Spanish version of model Notices of Privacy Practices published online,
CLIA Related Amendments—patients have a right to access test results directly from clinical laboratories
NICS NPRM—reporting “mental health prohibitor” status; public comment period closed on March 10, 2014
Marketing Guidance on Refill Reminders and Similar Communications (implementing HITECH Act, § 13406(a)(2)), tities/marketingrefillreminder.html

22. Marissa Gordon-Nguyen, JD, MPH
Q & A
Sherri Morgan, JD, MSW
Health Information Privacy Specialist
HHS, Office for Civil Rights
Marissa Gordon-Nguyen, JD, MPH