On February 20, the U.S. Department of Health and Human Services Office of Civil Rights (HHS OCR) released new guidance explaining how the HIPAA Privacy Rule operates to protect individuals’ privacy rights with respect to their mental health information and in what circumstances the Privacy Rule permits health care providers to communicate with patients’ family members and others to enhance treatment and assure safety.
The guidance is essentially a set of answers to frequently asked questions. Set out below is a highly truncated version of those FAQs (please view the entire Q&A for the full position and explanation of HHS OCR on these questions):
- Does HIPAA allow a health care provider to communicate with a patient’s family, friends, or other persons who are involved in the patient’s care?
Yes.
- Does HIPAA provide extra protections for mental health information compared with other health information?
Only for psychotherapy notes.
- Is a health care provider permitted to discuss an adult patient’s mental health information with the patient’s parents or other family members?
Yes, in situations where the patient is given the opportunity and does not object.
- When does mental illness or another mental condition constitute incapacity under the Privacy Rule?
Where a provider determines that such a disclosure is in the patient’s best interests, the provider would be permitted to disclose only the PHI that is directly relevant to the person’s involvement in the patient’s care or payment for care.
- If a health care provider knows that a patient with a serious mental illness has stopped taking a prescribed medication, can the provider tell the patient’s family members?
So long as the patient does not object, HIPAA allows the provider to share or discuss a patient’s mental health information with the patient’s family members.
- Can a minor child’s doctor talk to the child’s parent about the patient’s mental health status and needs?
Yes, with respect to general treatment situations.
- At what age of a child is the parent no longer the personal representative of the child for HIPAA purposes?
HIPAA defers to state law to determine the age of majority and the rights of parents to act for a child in making health care decisions.
- Does a parent have a right to receive a copy of psychotherapy notes about a child’s mental health treatment?
No.
- What options do family members of an adult patient with mental illness have if they are concerned about the patient’s mental health and the patient refuses to agree to let a health care provider share information with the family?
The HIPAA Privacy Rule permits a health care provider to disclose information to the family members of an adult patient who has capacity and indicates that he or she does not want the disclosure made, only to the extent that the provider perceives a serious and imminent threat to the health or safety of the patient or others and the family members are in a position to lessen the threat.
- Does HIPAA permit a doctor to contact a patient’s family or law enforcement if the doctor believes that the patient might hurt herself or someone else?
Yes.
- If a law enforcement officer brings a patient to a hospital or other mental health facility to be placed on a temporary psychiatric hold, and requests to be notified if or when the patient is released, can the facility make that notification?
The Privacy Rule permits a HIPAA covered entity, such as a hospital, to disclose certain protected health information, including the date and time of admission and discharge, in response to a law enforcement official’s request, for the purpose of locating or identifying a suspect, fugitive, material witness, or missing person.
- If a doctor believes that a patient might hurt himself or herself or someone else, is it the duty of the provider to notify the family or law enforcement authorities?
A health care provider’s “duty to warn” generally is derived from and defined by standards of ethical conduct and State laws and court decisions such as Tarasoff v. Regents of the University of California. HIPAA permits a covered health care provider to notify a patient’s family members of a serious and imminent threat to the health or safety of the patient or others if those family members are in a position to lessen or avert the threat.
- Does HIPAA prevent a school administrator, or a school doctor or nurse, from sharing concerns about a student’s mental health with the student’s parents or law enforcement authorities?
Student health information held by a school generally is subject to the Family Educational Rights and Privacy Act (FERPA), not HIPAA. In the limited circumstances where the HIPAA Privacy Rule, and not FERPA, may apply to health information in the school setting, the Rule allows disclosures to parents of a minor patient or to law enforcement in various situations.