Bottom Line
Under HIPAA Privacy Law, there is a distinction between mental health records, which are part of a patient’s overall medical record, and psychotherapy notes, which are provided special consideration and considered to be separate pieces of information. Healthcare professionals should not consider the extra privacy protections afforded to psychotherapy notes as applicable to general mental health records, or the overall care and treatment of a patient could be impacted. ScanSTAT will discuss with our clients how they wish to label mental/behavioral records within their patients’ medical records. As with any other HIPAA regulations, certain circumstances occur in which state laws supersede the regulations set by federal law, so it is imperative health organizations understand their state’s laws. ScanSTAT documentation and processes will adjust to individual states when extra patient authorization is required for such information to be released. This FAQ information is not meant to be legal counsel, rather it is a general guide to understanding the intricacies of HIPAA regulation.
Mental Health Records versus Psychotherapy Notes
The Department of Health and Human Services’ (HHS) draws a distinction between mental (which includes behavioral) health records compared with psychotherapy notes. HHS states their reasoning as, “Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment or health care operations purposes other than by the mental health professional who created the notes.”
HHS uses the HIPAA Privacy Rule to define psychotherapy notes “as notes recorded by a healthcare provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint or family counseling session and that are separate from the rest of the patient’s medical record.”
Mental health records, on the other hand, are considered to fall within general protected health information (PHI) and be part of the general health record. HHS outlines psychotherapy notes are not inclusive of medical prescriptions, session start and stop times, frequency of treatment, clinical tests, summaries of diagnosis, symptoms, prognosis, etc. These pieces of information are considered mental health records, and thus part of the patient’s general medical record.
As patients move between different healthcare providers, it is critical that health information be appropriately documented and shared for proper continuity of care of the patient. Diagnosis and medication information is imperative for any healthcare provider to properly and confidently provide care to a patient. Because mental health records and psychotherapy notes differ, HHS outlines that they have different protections under the Privacy Rule: “Generally, the Privacy Rule applies uniformly to all PHI, without regard to the type of information. One exception to this general rule is for psychotherapy notes, which receive special protections.” Records related to mental health do not receive these extra protections because they are considered part of the general record. Essentially, this distinction means thought and care should be put into how this information is stored and possibly shared, as most are not privy to the sensitive information contained in psychotherapy notes.
As organizations continue to implement protocols for managing their medical records, they must consider how mental health records and psychotherapy notes differ not only in content but also in storage. Best practices state mental health records be stored within the patient’s general medical chart, while psychotherapy notes should be stored separately from the patient’s general medical record. If an organization wishes to store the psychotherapy notes within their electronic health record (EHR) system, then special naming and filing standards should be documented and communicated. Staff members should be trained on the differences between psychotherapy notes and mental health records. Mental health records should be coded as such and included in the patient’s general electronic record. The psychotherapy notes should then receive an individualized designation which communicates the relevant patient while not being added to that patient’s general medical record.
Professional Discretion and Extenuating Circumstances
The term “professional discretion” is used throughout medical records regulatory law, especially pertaining to the rules surrounding psychotherapy notes. Essentially, healthcare providers maintain professional discretion on when and what information should or should not be released. Circumstances pertaining to family access to psychotherapy notes, law enforcement inquiries, and third party requestors are especially dependent on this caveat to determine compliance.
The importance of professional discretion serves to indicate how critical it is that organizations maintain a well-articulated system for the storage of psychotherapy notes. An example of professional discretion playing a part in the release of psychotherapy notes would be if a provider felt that there was an imminent threat of a patient causing harm to themselves or others. A provider must use their professional discretion to determine if the situation meets the requirements for disclosure of psychotherapy notes to law enforcement for the purpose of prevention.
Patient Access to Psychotherapy Notes
As dictated by the HIPAA “Right to Access” provision, a patient must be allowed to gain access to their current medical records as defined by an organization’s “designated record set” in a timely manner and without undue burden. If the maintenance and contents of mental health professional’s notes fall within the definition of psychotherapy notes as defined in the Privacy Rule, then they are not to be considered part of an organization’s designated record set, or the patient’s medical record. Since psychotherapy notes fall under this Privacy Rule exception, covered entities are not under an obligation to release to a patients psychotherapy notes pertaining to their treatment. It is of great importance that the psychotherapy notes are maintained separately or clearly noted as separate from the patient’s medical record if this step is not taken then the Privacy Rule exception does not apply and a records custodian must include the notes when releasing information.
Third Party Requestors
If a third party requestor is seeking to obtain medical records from the healthcare organization then the records custodian should follow their normal protocol in seeking the required authorization. If psychotherapy notes relating to the requested records are also present at the organization, an organization must seek separate patient authorization, which specifically states that psychotherapy notes may be included, before releasing the notes to the third party requestor. This is of paramount importance as the inappropriate release of psychotherapy notes would not only be noncompliant but it may have undesirable effects on the related patient.