By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
June 20, 2024
Under Health Insurance Portability and Accountability Act (HIPAA) Privacy Law, there’s a distinction between mental health records, part of a patient’s overall medical record, and psychotherapy notes, which are provided special consideration to be separate pieces of information. Healthcare professionals shouldn’t consider extra privacy protections afforded to psychotherapy notes as applicable to general mental health records, or the overall care and treatment of a patient could be impacted. We discuss how clients wish to label mental/behavioral records within their patients’ medical records. As with any HIPAA regulations, circumstances occur in which state laws supersede regulations set by federal law, so it is imperative health organizations understand their state laws. Our documentation and process adjusts to state when extra patient authorization is required for such information to be released. This information isn’t meant to be legal counsel, rather it’s a general guide to understanding the intricacies of HIPAA regulation.
Mental Health Records vs. Psychotherapy Notes
The U.S. Department of Health and Human Services (HHS) distinguishes between mental (which includes behavioral) health records compared with psychotherapy notes. HHS states, “Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment or health care operations purposes other than by the mental health professional who created the notes.”
HHS uses the HIPAA Privacy Rule to define psychotherapy notes “as notes recorded by a healthcare provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint or family counseling session and that are separate from the rest of the patient’s medical record.”
Mental health records, on the other hand, are considered to fall within general protected health information (PHI) and be part of the general health record. HHS outlines psychotherapy notes aren’t inclusive of medical prescriptions, session start and stop times, frequency of treatment, clinical tests, summaries of diagnosis, symptoms, prognosis, etc. These pieces of information are considered mental health records, thus part of the patient’s general medical record. It’s important to always consider individual states may have their own definition of mental or behavioral health. In these cases, you’ll want to know and understand any differences between state and federal definitions so you can determine if you need to apply additional privacy protections. As patients move between different healthcare providers, its critical health information be appropriately documented and shared for proper continuity of care of the patient. Diagnosis and medication information is imperative for any healthcare provider to properly and confidently provide care to a patient. Because mental health records and psychotherapy notes differ, HHS outlines they’ve different protections under the Privacy Rule: “Generally, the Privacy Rule applies uniformly to all PHI, without regard to the type of information. One exception to this general rule is for psychotherapy notes, which receive special protections.” Records related to mental health don’t receive these extra protections because they’re considered part of the general record. This distinction means thought and care should be put into how this information is stored and possibly shared, as most are not privy to the sensitive information contained in psychotherapy notes.
As organizations continue to implement protocols for managing medical records, they must consider how mental health records and psychotherapy notes differ in content and storage. Best practices state mental health records be stored within the patient’s general medical chart, while psychotherapy notes should be stored separately from the patient’s general medical record. If an organization wishes to store the psychotherapy notes within their electronic health record (EHR) system, special naming and filing standards should be documented and communicated. Staff members should be trained on the differences between psychotherapy notes and mental health records. Mental health records should be coded as such and included in the patient’s general electronic record. The psychotherapy notes should then receive an individualized designation which communicates the relevant patient while not being added to that patient’s general medical record.
Professional Discretion and Extenuating Circumstances
The term “professional discretion” is used throughout medical records regulatory law, pertaining to the rules surrounding psychotherapy notes. Healthcare providers maintain professional discretion on when and what information should, or shouldn’t, be released. Circumstances pertaining to family access to psychotherapy notes, law enforcement inquiries, and third-party requestors are especially dependent on this caveat to determine compliance.
The importance of professional discretion serves to indicate how critical it is organizations maintain a well-articulated system for the storage of psychotherapy notes. An example of professional discretion playing a part in the release of psychotherapy notes would be if a provider felt there was an imminent threat of a patient causing harm to themselves or others. A provider must use their professional discretion to determine if the situation meets the requirements for disclosure of psychotherapy notes to law enforcement for the purpose of prevention.
Patient Access to Psychotherapy Notes
As dictated by the HIPAA “Right to Access” provision, a patient must be allowed to gain access to their current medical records as defined by an organization’s “designated record set” in a timely manner, without undue burden. If the maintenance and contents of mental health professional’s notes fall within the definition of psychotherapy notes as defined in the Privacy Rule, they aren’t to be considered part of an organization’s designated record set, or the patient’s medical record. Since psychotherapy notes fall under this Privacy Rule exception, covered entities aren’t obligated to release a patient’s psychotherapy notes pertaining to their treatment. It’s of great importance the psychotherapy notes are maintained separately, or clearly noted as separate, from the patient’s medical record. If this step isn’t taken, the Privacy Rule exception doesn’t apply and a records custodian must include the notes when releasing information.
Third-party Requestors
If a third-party requestor is seeking to obtain medical records from the healthcare organization, the records custodian should follow normal protocol seeking required authorization. If psychotherapy notes relating to the requested records are also present at the organization, it must seek separate patient authorization – which states psychotherapy notes may be included – before releasing the notes to the third-party requestor. This is of paramount importance as inappropriate release of psychotherapy notes is noncompliant and may have undesirable effects for the related patient.