By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
August 30, 2024

In most electronic health record (EHR) systems, patients have one chart all providers within that organization share. Additionally, providers may receive and make treatment decisions based on records from providers outside of the organization. When a practice receives a record request for a provider to fulfill, should they only limit the records generated by that provider? Or include all records in the patient chart, even if from other providers?

What is the designated record set?

To know what to include, you’ll need to start with the designated record set. The HIPAA Privacy Rule indicates when a patient or requestor asks for a medical record, the information in the designated record set may be disclosed. The Privacy Rule defines the designated record set as:

• Medical and billing records about individuals maintained by, or for a, covered healthcare provider
• The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan
• Other records used, in whole or in part, by or for the covered entity to make decisions about individuals

Any record a provider uses for treatment decisions, generated by him or her, is part of the designated record set. If a provider references outside notes or labs from another provider, they become part of the designated record set. Multiple providers in an organization may use the same patient chart and have the same designated record set for the patient.

What do I release?

There’s often confusion over what to release when a designated record set includes records from multiple providers. An authorization, or Right to Access, request often indicates where the records should come from, but it’s the what that’s often most important.

If the request is directed at a specific doctor or organization and states “any and all records,” this indicates the designated record set utilized in caring for the patient. The designated record set could include labs and office visit notes from an outside provider if those records were used for treatment purposes. It’s rare for a provider to utilize only records created in the care of a patient.

However, if the request says “any and all records created by or limited to” a specific doctor or organization, this limits the authorization or access request to only those specified records – the what in this scenario has changed. So, the designated record set would be limited to the what specified in the request.

For most release of information (ROI) requests, it’s important to receive the appropriate records referenced in caring for the patient. This typically includes the entire designated record set and isn’t a restriction on what provider created the information. Occasionally requestors claim this scenario constitutes a HIPAA violation because the records provided have more than one provider name included. Requests for a provider’s records are for his or her designated record set. Because the designated record set may contain information from other providers, and requests for the provider’s records are asking for his or her designated record set, providing records from other providers doesn’t constitute a HIPAA violation or breach.

Release record requests to a partner

If record requests and compliance concerns take too much of your staff’s valuable time, consider releasing this administrative burden to a partner. Verisma processes hundreds of millions of requests annually with the industry’s highest accuracy rate. If you need to focus more on patient care and leave record requests and compliance questions to a partner, request a demo today to see how we can help.

By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
July 12, 2024

Combine the words HIPAA, protected health information (PHI) and email, and you’ve just found a topic that’ll leave many healthcare professionals uneasy. Nevertheless, email is frequently used for sharing PHI with patients and their caregivers. All healthcare organizations should develop policies and procedures to comply with HIPAA while delivering PHI via email.

It’s not as simple as citing a policy forbids emailing PHI. One of the key initiatives of the Office of Civil Rights (OCR) is to increase access for patients to their health information, including unencrypted email. So, while it may seem counterintuitive to email patients medical records and health information, providers and healthcare organizations may need to do exactly that to meet a patient’s requested format.

Why use email to send PHI?

As our world becomes more reliant on technology to communicate and manage our daily lives, the healthcare industry has seen their own technological revolution with electronic health records (EHR), e-prescribing, patient portals, wearable tech, and many other advancements. With email a main means of communication, it’s only natural patients would like to communicate in a way they’re familiar with.

Many healthcare organizations have their own email systems needed to function for business. But when it comes to communicating with patients, practices are often confused over what they can, and cannot, do. The U.S. Department of Health and Human Services (HHS) provides guidance on emails used in healthcare. They note the HIPAA Privacy and Security Rules don’t prohibit the use of email but do require proper policies and procedures to protect PHI. Guidance on a patient’s right to access their PHI underscored the ability for patients to request this information via email. And they consider email to be readily producible by nearly all covered entities, with exceptions if a file is too large to transmit via email.

While practices should defer to utilizing secure, encrypted email while transmitting PHI, the guidance from the OCR indicates if a patient wants their PHI to be delivered via unencrypted email, covered entities and business associates must comply.

How can I send an unencrypted email with PHI? Isn’t that against HIPAA?

Sending PHI via unencrypted email doesn’t violate HIPAA, but covered entities and business associates must take reasonable steps to ensure patients understand and acknowledge the risk of unsecured email transmission. The OCR provided this guidance because they want patients to easily receive their PHI in accordance with their right to access PHI.

In an interview with Report on Patient Privacy, Deven McGraw, Deputy Director of the HHS OCR, said, “We are trying to make it as easy as possible [for people] to exercise their HIPAA rights in a way that works best for them. But it is not meant to be a sort of blanket, ‘Get Out of Jail Free’ card on security.”

Meaning, if a patient requests their records be delivered via unencrypted email, the covered entity or business associate must comply with the request after assurance from the patient they understand the risk of unsecured email. Denying a patient their access request be sent via unsecured email could mean an OCR complaint.

But isn’t email a breach waiting to happen?

Email can be difficult to protect at rest and in transit. It’s important healthcare organizations follow industry best practices for utilizing email, which typically include dual authentication and encryption, to prevent a PHI breach.

Unsecure email is much more difficult to protect. If a patient acknowledges, verbally or in writing, the risks of their PHI being sent via unsecure or unencrypted means, the patient accepts the risk of potential disclosures occurring in transit, or upon arrival, to the intended email address.

Considerations for delivering PHI via email

With email a frequent transmission method for PHI, healthcare practices need to consider the risks and best practices for utilizing email in their own organization.

Some initial suggestions for appropriately transmitting email include:

• Servers containing email should be encrypted.
• When communicating PHI externally, utilize encrypted email technology.
• Ensure all staff are trained on email best practices.
• Develop a policy and procedure for working with patients when the PHI file size is too large to be delivered via email.
• Develop a policy and procedure to alert patients to the risks of delivering PHI via unencrypted or unsecure email.
• Create your duty to warn statement and receive written or verbal confirmation.
• If the email address is received verbally, confirm the address using the NATO Phonetic Alphabet.

Rely on a partner to navigate the changing regulatory landscape

With the rapid evolution of technology, it can be difficult to keep up with the regulatory landscape of what is, and isn’t, allowed – all while trying to avoid an unauthorized disclosure (UAD). Luckily, covered entities can work with business associate partners like Verisma to handle PHI disclosures – transferring the work burden and duty to warn.

And, while many patients can access data via portals, Verisma Request App® (VRA) opens up secure electronic delivery to third-party requestors, such as commercial health plans and attorneys – offering the same record-ordering convenience enjoyed by patients – and avoids the risks associated with email all together.

Does emailing PHI (encrypted or unencrypted) seem like more work than it’s worth? Our healthcare data experts are extensively trained in PHI delivery best practices including utilizing encrypted and unencrypted email, as well as responding to complicated right to access requests. We’ll take on these tricky situations for you. Find out how we relieve the burden of PHI email exchange by requesting a demo today.

By Elizabeth McElhiney, MHA, CHPS, CPHIMS, CRIS
Director of Compliance and Government Affairs
Verisma
June 20, 2024

Under Health Insurance Portability and Accountability Act (HIPAA) Privacy Law, there’s a distinction between mental health records, part of a patient’s overall medical record, and psychotherapy notes, which are provided special consideration to be separate pieces of information. Healthcare professionals shouldn’t consider extra privacy protections afforded to psychotherapy notes as applicable to general mental health records, or the overall care and treatment of a patient could be impacted. We discuss how clients wish to label mental/behavioral records within their patients’ medical records. As with any HIPAA regulations, circumstances occur in which state laws supersede regulations set by federal law, so it is imperative health organizations understand their state laws. Our documentation and process adjusts to state when extra patient authorization is required for such information to be released. This information isn’t meant to be legal counsel, rather it’s a general guide to understanding the intricacies of HIPAA regulation.

Mental Health Records vs. Psychotherapy Notes

The U.S. Department of Health and Human Services (HHS) distinguishes between mental (which includes behavioral) health records compared with psychotherapy notes. HHS states, “Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment or health care operations purposes other than by the mental health professional who created the notes.”

HHS uses the HIPAA Privacy Rule to define psychotherapy notes “as notes recorded by a healthcare provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint or family counseling session and that are separate from the rest of the patient’s medical record.”

Mental health records, on the other hand, are considered to fall within general protected health information (PHI) and be part of the general health record. HHS outlines psychotherapy notes aren’t inclusive of medical prescriptions, session start and stop times, frequency of treatment, clinical tests, summaries of diagnosis, symptoms, prognosis, etc. These pieces of information are considered mental health records, thus part of the patient’s general medical record. It’s important to always consider individual states may have their own definition of mental or behavioral health. In these cases, you’ll want to know and understand any differences between state and federal definitions so you can determine if you need to apply additional privacy protections. As patients move between different healthcare providers, its critical health information be appropriately documented and shared for proper continuity of care of the patient. Diagnosis and medication information is imperative for any healthcare provider to properly and confidently provide care to a patient. Because mental health records and psychotherapy notes differ, HHS outlines they’ve different protections under the Privacy Rule: “Generally, the Privacy Rule applies uniformly to all PHI, without regard to the type of information. One exception to this general rule is for psychotherapy notes, which receive special protections.” Records related to mental health don’t receive these extra protections because they’re considered part of the general record. This distinction means thought and care should be put into how this information is stored and possibly shared, as most are not privy to the sensitive information contained in psychotherapy notes.

As organizations continue to implement protocols for managing medical records, they must consider how mental health records and psychotherapy notes differ in content and storage. Best practices state mental health records be stored within the patient’s general medical chart, while psychotherapy notes should be stored separately from the patient’s general medical record. If an organization wishes to store the psychotherapy notes within their electronic health record (EHR) system, special naming and filing standards should be documented and communicated. Staff members should be trained on the differences between psychotherapy notes and mental health records. Mental health records should be coded as such and included in the patient’s general electronic record. The psychotherapy notes should then receive an individualized designation which communicates the relevant patient while not being added to that patient’s general medical record.

Professional Discretion and Extenuating Circumstances

The term “professional discretion” is used throughout medical records regulatory law, pertaining to the rules surrounding psychotherapy notes. Healthcare providers maintain professional discretion on when and what information should, or shouldn’t, be released. Circumstances pertaining to family access to psychotherapy notes, law enforcement inquiries, and third-party requestors are especially dependent on this caveat to determine compliance.

The importance of professional discretion serves to indicate how critical it is organizations maintain a well-articulated system for the storage of psychotherapy notes. An example of professional discretion playing a part in the release of psychotherapy notes would be if a provider felt there was an imminent threat of a patient causing harm to themselves or others. A provider must use their professional discretion to determine if the situation meets the requirements for disclosure of psychotherapy notes to law enforcement for the purpose of prevention.

Patient Access to Psychotherapy Notes

As dictated by the HIPAA “Right to Access” provision, a patient must be allowed to gain access to their current medical records as defined by an organization’s “designated record set” in a timely manner, without undue burden. If the maintenance and contents of mental health professional’s notes fall within the definition of psychotherapy notes as defined in the Privacy Rule, they aren’t to be considered part of an organization’s designated record set, or the patient’s medical record. Since psychotherapy notes fall under this Privacy Rule exception, covered entities aren’t obligated to release a patient’s psychotherapy notes pertaining to their treatment. It’s of great importance the psychotherapy notes are maintained separately, or clearly noted as separate, from the patient’s medical record. If this step isn’t taken, the Privacy Rule exception doesn’t apply and a records custodian must include the notes when releasing information.

Third-party Requestors

If a third-party requestor is seeking to obtain medical records from the healthcare organization, the records custodian should follow normal protocol seeking required authorization. If psychotherapy notes relating to the requested records are also present at the organization, it must seek separate patient authorization – which states psychotherapy notes may be included – before releasing the notes to the third-party requestor. This is of paramount importance as inappropriate release of psychotherapy notes is noncompliant and may have undesirable effects for the related patient.