More protections for patients and psychologists under HIPAA

Though the mention of the Health Information Portability and Accountability Act (HIPAA) privacy rule compliance date--April 14--can make some psychologists anxious, most applaud the new law for increasing privacy protections.

Especially interesting to practitioners is the psychotherapy notes provision, says Russ Newman, PhD, JD, APA's executive director for practice. The provision recognizes that certain kinds of mental health information need to be protected more than other types of information. Under HIPAA, psychotherapy notes are defined as "notes recorded in any medium by a mental health professional documenting or analyzing the contents of conversation during a private counseling session." These notes, which capture the psychologist's impressions about the patient and can contain information that is inappropriate for a medical record, are similar to what psychologists have historically referred to as "process notes."

HIPAA affords psychotherapy notes more protection--most notably from third-party payers--than they'd been given in the past. Under HIPAA, disclosure of psychotherapy notes requires more than just generalized consent; it requires patient authorization--or specific permission--to release this sensitive information. And, whereas in the past insurance companies have requested entire patient records--including psychotherapy notes--in making coverage decisions, now health plans cannot refuse to provide reimbursement if a patient does not agree to release information covered under the psychotherapy notes provision.

"In the past, patients could refuse to have this type of information released, but then the company might refuse to cover services," notes Newman. "The HIPAA privacy rule protection stops that kind of practice from taking place."

Psychologists take note

The privacy rule gives rights to health professionals, as well as to their patients. Under the new law, psychologists can decide whether to release their psychotherapy notes to patients, unless patients would have access to their psychotherapy notes under state law (see the article about HIPAA and state laws in last month's Monitor). Though the privacy rule does afford patients the right to access and inspect their health records, psychotherapy notes are treated differently: Patients do not have the right to obtain a copy of these under HIPAA. And when a psychologist denies a patient access to these notes, the denial isn't subject to a review process, as it is with other records.

There is a catch in the psychotherapy notes provision. HIPAA's definition of psychotherapy notes explicitly states that these notes are kept separate from the rest of an individual's record. So, if a psychologist keeps this type of information in a patient's general chart, or if it's not distinguishable as separate from the rest of the record, access to the information doesn't require specific patient authorization. According to the Department of Health and Human Services (HHS), it makes good sense to keep the notes separate since this type of information should not be available automatically.

This may, says Newman, be a practical difference from the way some psychologists have previously stored patient information. But, "if psychologists want higher protections for psychotherapy notes, then they should keep the information separate," he urges.

Daniel Abrahamson, PhD, professional affairs coordinator for the Connecticut Psychological Association, adds that psychologists "shouldn't jump the gun." Keeping records separate is an option and "each practitioner will need to determine whether the benefits of maintaining extra protection outweigh keeping the records distinctly separate from medical records," he says. In other words, some psychologists may decide that, for some patients, the information doesn't particularly need the extra level of protection. If a particular treatment evolves and the psychologist wants to keep the psychotherapy notes separate, he or she can choose to do that. "It's part of good clinical judgment," says Abrahamson. "In the past, clinicians didn't include some information in a record and therefore wouldn't be able to later document that information. Now they have the option to include detailed content in separate notes."

In addition to keeping these notes separate from other patient information, psychologists should be aware, says Newman, that there are certain parts of a record that are expressly not considered psychotherapy notes--and that don't require patient authorization for disclosure--under the HIPAA privacy rule. This information includes medication prescription and monitoring, counseling session start and stop times, modalities and frequencies of treatment, results of clinical tests, and any summary of diagnosis, functional status, treatment plans, symptoms, prognosis or progress.

This portion of the rule is likely to leave some "potential for interpretation," says Newman. "What if a managed-care company says it needs a summary of the themes from psychotherapy sessions? They may say that's outside the psychotherapy notes provision. We'd argue that divulging themes of the conversations in psychotherapy is tantamount to giving away the whole conversation," he says.

In the same vein, testing information, like summary information, isn't included under psychotherapy notes. APA submitted comments to HHS on both the proposed and final rules asking that psychological test data be included in the provision. Disclosing this type of information, says Newman, could divulge intimate details about a patient much like the information from psychotherapy sessions. Unfortunately, he says, HHS declined to expand the definition.

Despite the exclusion of certain information, however, the psychotherapy notes provision should be heralded "as a significant victory for privacy advocates," says Nanci Klein, PhD, professional affairs coordinator for the Utah Psychological Association. "Practitioners have long found it onerous to have to release psychotherapy notes for additional treatment authorization by managed-care companies." Now, she says, managed-care companies are only entitled to certain types of information, not including psychotherapy notes.

"I think this defines the psychologist as the treating expert whose professional analysis and opinion represent the core information necessary for making judgments about the necessity for continued treatment," she adds.

This article is the second in a three-part series on HIPAA topics. The next piece, on HIPAA's minimum necessary requirement, will appear in March.