by Cherie Jones, J.D.

The HIPAA privacy rule includes numerous provisions to protect the privacy of patient records. Of particular significance for psychologists and their clients, the rule provides for a higher level of privacy protection for “psychotherapy notes” (see sidebar for definition) than for other protected health information (PHI, as defined on page 4). At the same time, the rule also offers mental health professionals some protections. Practicing psychologists need to understand their rights as well as their patients’ rights with regard to psychotherapy notes in preparing to comply with the HIPAA privacy rule.

Under this federal rule, much protected health information may be used or disclosed for appropriate purposes on the basis of a general agreement or “consent” that is valid until revoked by the patient in writing. Psychotherapy notes, however, are subject to a more rigorous “authorization” process before they may be used or disclosed (though there are several designated exceptions). In essence, consent is generalized client permission for the psychologist to use PHI for certain purposes related to health care, and it is usually secured from the patient prior to initiating treatment. Authorization is specific client permission, above and beyond general consent, that permits the release of more sensitive information, such as psychotherapy notes.

Among the requirements with which providers must comply (see sidebar on page 14), the authorization has to include a statement that the individual may refuse to sign the authorization. This reflects the privacy rule’s focus on patient protection. Whereas a psychologist or health plan may refuse to provide service or coverage if a patient does not agree to release information covered under a general consent, the same is not true if a patient refuses to a sign an authorization to release psychotherapy notes. Insurers and other entities covered under HIPAA may not require a patient’s authorization as a condition of treatment, payment, enrollment, or eligibility for benefits.

What Are "Psychotherapy Notes"? The HIPAA privacy rule defines psychotherapy notes as: [N]otes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. As a practical matter, the definition of “psychotherapy notes” coincides with what the field has historically considered to be “process notes.” These are records that “capture the therapist’s impressions about the patient, contain details of the psychotherapy conversation considered to be inappropriate for the medical record, and are used by the provider for future sessions.” Parts of the record that are NOT considered psychotherapy notes for purposes of the privacy rule — and thus do not require separate authorization — are: [M]edication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

Rights Apply to Psychologists Too

The privacy rule grants rights to health professionals as well as to their clients. The rule lets psychologists and other health providers use their professional judgment in deciding whether to disclose psychotherapy notes to their patients. While the privacy rule enables patients to access and inspect their other health care records (subject to certain conditions), psychotherapy notes are treated differently: Patients do not have the right to obtain a copy of their therapist’s psychotherapy notes. And if a psychologist denies a patient’s request to do so, the denial is not subject to review, as it is with other records. Of course, as with every provision of the privacy rule, this is subject to preemption by a more stringent state law that allows patients greater access to their records (for more information, see related article on page 6).

The enhanced privacy protection rule for psychotherapy notes follows a landmark U.S. Supreme Court ruling. In the 1996 decision in the Jaffee v. Redmond case, the Supreme Court noted that “the mere possibility of disclosure [of statements made to a therapist during a counseling session] may impede the development of the confidential relationship necessary for successful treatment.” The U.S. Department of Health and Human Services (HHS) relied heavily on Jaffee in designing the privacy rule, and also on the fact that psychotherapy notes play a unique role in the health care system. On the basis of Jaffee, the HIPAA privacy rule concludes that additional protections for psychotherapy notes are justified because of the “significant intrusion when records reveal details about a person’s mental state, such as during treatment for mental health.”

What Does Separate "Patient Authorization" Require Under the HIPAA privacy rule, a “covered entity” such as a practicing psychologist or an insurance or managed care company must obtain from the patient for each intended use or disclosure of psychotherapy notes an authorization in plain language that includes A specific description of the notes to be used or disclosed The identity, name or class of persons to whom the notes will be disclosed The defined purpose of the disclosure An expiration date or event that relates to the purpose A statement that the individual has the right to revoke the authorization in writing and a description of how it may be revoked A statement that the notes may be subject to redisclosure and may no longer be protected The signature of the individual or personal representative and date, with a copy provided to the individual A statement that the individual may refuse to sign the authorization

Organized psychology has long advocated for enhanced protection of other highly sensitive patient record information beyond the heightened protection for psychotherapy notes achieved in the final privacy rule. For example, APA submitted comments on both the proposed and final rules, asking HHS to fully reflect the spirit of the Jaffee decision by defining psychotherapy notes as encompassing other records typically created and maintained by psychologists that contain highly sensitive mental health treatment information. This would include psychological test data and test materials used in psychological assessment, as well as clinical observations made by the psychologist outside of a psychotherapy session.

HHS declined to expand the definition of psychotherapy notes in the final privacy rule. The stated rationale was that, “[a]lthough all psychotherapy information may be considered sensitive, we have limited the definition of psychotherapy notes to only that information that is kept separate by the provider for his or her own purposes [since this is not information] that would normally be disclosed for treatment, payment, and health care operations.” The Practice Directorate is continuing efforts to persuade HHS to afford the same protection for psychological test data and results as is given to psychotherapy notes.

HHS Secretary Tommy Thompson has indicated, that although the privacy rule is now in “final” form, it faces further modification. Doug Walter, J.D., legislative counsel in the APA Practice Directorate’s government relations department, sees this as a potential opportunity for improvement. “We clearly believe that the privacy rule should go even further in protecting mental health records. The APA Practice Organization will continue to advocate for greater privacy protections for patients.”