New OCR Guidance on Disclosure of Mental Health Information under the HIPAA Privacy Rule
On February 20, 2014, the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) issued guidance (the “Guidance”) addressing frequently asked questions about sharing mental health information under the HIPAA Privacy Rule. The Guidance clarifies when HIPAA permits a health care provider to share information with a patient’s family, friends or law enforcement, taking into account whether the patient is an adult or minor, has capacity to agree or object to sharing information, or presents a danger to the patient’s self or others. The Guidance also touches on a number of related issues, including the special protections for psychotherapy notes, the potential applicability of federal or state alcohol or drug abuse confidentiality regulations, and the treatment of school records.
The Guidance highlights the balance struck by the Privacy Rule, to protect sensitive health information while ensuring the patient receives appropriate care and promoting the safety of the patient and others. In addressing common scenarios about such disclosures, the Guidance reiterates the relevant regulatory requirements and, more significantly, provides examples that help illuminate application of the Privacy Rule. Below, we summarize some of the notable examples and commentary.
Disclosures to Family and Friends. When certain conditions are met, a health care provider is permitted to communicate with a patient’s family, friends or other persons involved in the patient’s care or payment for care. The Guidance provides the following examples of appropriate disclosures to family or friends when the patient is given the opportunity and does not object:
- “A psychiatrist may discuss the drugs a patient needs to take with the patient’s sister who is present with the patient at a mental health care appointment.” • “A therapist may give information to a patient’s spouse about warning signs that may signal a developing emergency.”
These examples are contrasted with the following:
- “A nurse may not discuss a patient’s mental health condition with the patient’s brother after the patient has stated she does not want her family to know about her condition.”
The Guidance also discusses situations where a patient has capacity and objects to the provider sharing information. In these cases, the provider may only disclose if (i) the provider has a good faith belief that the patient poses a threat to the health or safety of the patient or others, (ii) the person to whom the disclosure is made is able to lessen the threat, and (iii) the disclosure is otherwise consistent with legal and ethical obligations, including state “duty to warn” laws. § 164.512(j). Although this exception is typically associated with disclosures to law enforcement, the Guidance makes clear that it applies to family and friends as well. For example:
- “If a doctor knows from experience that, when a patient’s medication is not at a therapeutic level, the patient is at high risk of committing suicide, the doctor may believe in good faith that disclosure is necessary to prevent or lessen the threat of harm to the health or safety of the patient who has stopped taking the prescribed medication, and may share information with the patient’s family or other caregivers who can avert the threat.”
In addition, the Guidance reminds providers that they are able to listen to concerned family members and caregivers and use this information as a factor in treatment decisions, while protecting the confidentiality of the person voicing such concerns under §164.524(a)(2)(v).
The Guidance also addresses situations where the patient is not present or is incapacitated. In these situations, the provider may disclose information if the provider determines it is in the best interest of the patient. The Guidance explains that incapacity includes situations where the patient is unconscious, suffering from temporary psychosis, or is under the influence of drugs or alcohol. For instance:
- “If the provider believes the patient cannot meaningfully agree or object to the sharing of the patient’s information with family, friends, or other persons involved in their care due to her current mental state, the provider is allowed to discuss the patient’s condition or treatment with a family member, if the provider believes it would be in the patient’s best interests.”
The Guidance recommends that when determining whether disclosure is in the patient’s best interest, the provider should consider the patient’s prior expressed preferences as well as the current circumstances, and provide the patient with the opportunity to consent or object to future disclosures when the patient regains capacity. In addition, the Guidance states that if someone other than a family member or friend is involved, the provider must be reasonably sure that the patient asked the person to be involved in his care or payment for care.
Disclosures to Parents of Minor Children. In general, a health care provider is permitted to share PHI belonging to a minor child with the child’s parent, guardian, or other person acting in loco parentis, because of their status as the patient’s personal representative. The Guidance provides a relevant example of one of the exceptions to this rule, which are outlined in § 164.502(g):
- “If State law provides an adolescent the right to obtain mental health treatment without parental consent, and the adolescent consents to such treatment, the parent would not be the personal representative of the adolescent with respect to that mental health treatment information.”
The guidance reiterates that the Privacy Rule does not provide a parent access to their child’s psychotherapy notes, although as the minor child’s personal representative, a parent is able to obtain a copy of the child’s mental health information contained in the medical record. As in the regulations, the Guidance stresses the importance of state law in dictating disclosure obligations and restrictions in this area.
Disclosures to Law Enforcement. The Guidance provides an example of a permissible disclosure to law enforcement when the provider reasonably believes the patient might hurt him or herself or others, pursuant to § 164.512(j):
- “If a mental health professional has a patient who has made a credible threat to inflict serious and imminent bodily harm on one or more persons, HIPAA permits the mental health professional to alert the police, a parent or other family member, school administrators or campus police, and others who may be able to intervene to avert harm from the threat.”
The Guidance also outlines additional provisions impacting law enforcement that covered entities should be aware of, including disclosure of certain PHI in response to a law enforcement official’s request, for purposes of locating or identifying a suspect, fugitive, material witness, or missing person under § 164.512(f)(2); response to administrative requests and court orders, court ordered warrants, subpoenas and summonses under § 164.512(f)(1); and “required-by-law” disclosures under § 164.512(a).
Student Records. The Guidance briefly touches on student health records, noting that student health records held by a school are generally subject to the Family Educational Rights and Privacy Act (“FERPA”) and not HIPAA. In situations where HIPAA does apply, disclosures to parents or law enforcement are permitted in various situations. More guidance on the intersection of HIPAA and FERPA is available at http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/hipaaferpajointguide.pdf.
For more information, the Guidance is available at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/mhguidance.html.