Re: Proposed Rule on Standards for Privacy of Individually Identifiable Health Information, as published in 64 Federal Register 59917, November 3, 1999.

A. The psychotherapy notes exception from disclosure without authorization for "treatment, payment, and health care operations." We are particularly pleased that the Secretary shares with psychology the recognition of the importance of ensuring the privacy of the psychologist and patient treatment relationship by requiring that "psychotherapy notes" require specific patient authorization before they may be disclosed to third parties for "treatment, payment, and health care operations."

We appreciate the Secretary’s reliance on the United States Supreme Court decision of Jaffee v. Redmond, 518 U.S. 1 (1996), to provide for the psychotherapy notes exception. While upholding the existence of the psychotherapist-patient Federal evidentiary privilege, the Supreme Court found in Jaffee that the relationship is "rooted in the imperative need for confidentiality and trust" and that the "mere possibility" of disclosure could impede the development of a confidential relationship necessary for successful treatment.

To reflect fully the spirit of the Supreme Court’s decision, we suggest that the definition of "psychotherapy notes" be more comprehensively defined to protect the unauthorized disclosure of all particularly sensitive mental health information related to psychotherapeutic treatment, such as assessment results and clinical observations. In so doing, the "psychotherapy notes" exception will more adequately preserve the confidence and trust between the psychotherapist and patient and help eliminate the mere possibility of disclosures that would otherwise hamper treatment.

B. Non-preemption of stronger State patient records’ privacy laws. We are also pleased that stronger State laws that protect the confidentiality of patient records are not preempted by this proposed rule. Many States have enacted laws that more stringently protect the privacy of mental health records than the standards provided by the proposed rule. We agree with the Secretary that the proposed rule should "act as a floor, but not a ceiling on privacy protections."[1] We are concerned, however, with the Secretary’s interpretation of those States laws which are sufficiently "related to" the privacy of patient records to be saved from Federal preemption. We suggest that the proposed rule’s "related to" requirement is unnecessarily restrictive and may be inappropriately interpreted to preempt many State laws that protect the privacy of mental health records.

A. Disclosure of individually identifiable patient information for "emergency circumstances." With regard to the provision that permits use and disclosure of patient records without authorization for "emergency circumstances," we believe that this provision is drafted too broadly, permitting any number of persons in health plans or providers to disclose patient information based on a reasonable belief of endangerment. The provisions should be redrafted to ensure that only a licensed mental health care professional exercising his or her reasonable professional judgment should make disclosure determinations in emergency circumstances.

B. Patient inspection of information that may cause psychological harm. The rule does not recognize, as some States have recognized, that patients can be psychologically harmed if permitted to see sensitive information in their mental health records. We urge that the inspection provisions be amended to permit licensed mental health care professionals to prevent such disclosure upon a determination that such disclosure could cause substantial psychological harm to the patient who is the subject of the record.

C. Law enforcement access to patient records. We raise a number of concerns regarding the unauthorized disclosure of patient records to law enforcement officials. As an overarching concern, assuming that appropriately limited disclosure to a law enforcement official has been made, the proposed rule does not provide for limitations for further use and re-disclosure of the records. We urge that limitations be incorporated into the rule.

We additionally focus on specific permitted disclosures to law enforcement entities. These are disclosures related to: (1) information about the victim of a crime, abuse or other harm, (2) information disclosure pursuant to a legal process, and (3) the investigation of health care fraud. We seek additional regulatory language regarding these provisions to narrow their scope or to clarify their meaning and application.

Where patients are concerned about a lack of privacy protections, they might fail to get medical treatment that they would otherwise seek. This failure to get treatment may be especially likely for certain conditions, including mental health, substance abuse, and conditions such as HIV. Similarly, patients who are concerned about lack of privacy protections may report inaccurately to their providers when they do seek treatment. For instance, they might decide not to mention that they are taking prescription drugs that indicate that they have an embarrassing condition. These inaccurate reports may lead to mis-diagnosis and less-than optimal treatment, including inappropriate medications. In short, the lack of privacy safeguards can lead to efficiency losses in the form of foregone or inappropriate treatment.[4]

Rapid changes in the health care delivery system have meant that parties other than health care providers have access to patient records for a host of reasons, including those related to payment for and financial review of services. Technological advances in record-keeping now permit computerized and electronically transferable patient records. While federal and state statutes and case law have generally established the duty of health care providers to protect the confidentiality of patient records, the duty of many third parties must still be legally defined.[7]

The purpose of our proposal is to define and limit the circumstances in which an individual’s protected health information may be used or disclosed by others. We are proposing to make the use and exchange of protected health information relatively easy for health care purposes, and more difficult for purposes other than health care.[11]

Treatment means the provision of health care by, or the coordination of health care (including health care management of the individual through risk assessment, case management, and disease management) among, health care providers; the referral of a patient from one provider to another; or the coordination of health care or other services among health care providers and third parties authorized by the health plan or the individual. [14]

1. Blanket authorization. A blanket patient authorization for all of these administrative activities should be required. Patients have a right to their privacy. Therefore they should be afforded the opportunity to exercise their right to protect their patient record information by signing off on its disclosure. Not permitting patient authorization presumes that patients have no right to the privacy of their records. Since blanket authorizations are standard practice today, such authorizations will cause no more inconvenience or increased expense to managed health plans or other entities requesting the records, and at the very least such authorization gives patients the opportunity to read or discuss the possible future disclosure of their records.

We agree with the Secretary that the current practice of blanket authorization provides patients with little control over their health records. We suggest, however, that rather than eliminating blanket authorizations, the Secretary and individuals involved in the health care delivery system work together to improve such authorizations. For example, the Secretary could develop and publish a model authorization form so that patients might more readily understand their rights and responsibilities when signing the authorization. Perhaps the Secretary could propose a model blanket authorization to be used by health care providers and payers. The APA would welcome the opportunity to assist the Secretary in this endeavor, particularly as it would affect those patients seeking and receiving mental health services.

2. Additional patient authorization for disclosures for administrative purposes. The Secretary should reexamine the definitions of "treatment, payment, and health care operations," and particularly those of "treatment" and "health care operations." These definitions permit very broad administrative activities, some of which could be narrowed or eliminated. Further, we suggest that some of these administrative functions should require specific patient authorization in addition to an initial blanket authorization. For example, we suggest that within the definitions of "payment" or "health care operations" that improvement of payment methodologies for risk adjustment or of clinical guidelines development are isolated activities mainly for administrative purposes, which should require additional patient authorization.

3. Enforcement of use and disclosure limitations. The Secretary should stress that the general rules that apply to patient records, such as requiring that the minimum amount of the patient record be used for the specific purpose of disclosure and that de-identified information be used where possible, apply to managed health plans for "treatment, payment, and health care operations" purposes. The Secretary should impose a process whereby managed health plans and providers must demonstrate to the Secretary that they have specific procedures in place to accomplish these standards and are meeting these requirements.

4. Enforcement of the psychotherapy notes disclosure exception. Regarding disclosure of mental health records, the Secretary should ensure that the exception from disclosure without patient authorization for "psychotherapy notes" is strictly enforced and improved. We now offer specific comments on how the "psychotherapy notes" exception may be improved.

A. Requiring that patients must authorize disclosure of psychotherapy notes to managed health plans and other entities for "treatment, payment, and health care operations" purposes is of central importance to preserving the privacy of the psychologist-patient relationship. The APA urges that this provision be included in the final rule and offers specific improvements to ensure that it appropriately protects all sensitive mental health information.

We have mentioned above that mental health records are particularly "sensitive" to disclosure. This sensitivity exists for several reasons, many of which are rooted in societal stigmatization of mental disorders, and more intimately to the individual patient, in the fear that disclosure to loved ones, family, friends, business associates, even acquaintances could harm these relationships, perhaps irreparably. We need not discuss the sensitivity of mental health records in depth since the Secretary clearly shares this view. We agree, for example, with the Secretary’s comments that a greater intrusion in privacy occurs when mental health records are disclosed than when records regarding physical health are disclosed:

Due to the particular sensitivity of mental health records, we suggest that patients seeking and receiving mental health treatment have different, generally greater, privacy and confidentiality needs than persons receiving general health services. Therefore, greater protection must be afforded mental health records when medical records’ confidentiality legislation or regulation is considered.

State legislatures and governments have long recognized this need for heightened protection of mental health records. The most recent and comprehensive survey of state records confidentiality laws conducted by the Institute for Health Care Research and Policy of Georgetown University concluded that "[b]y far, state legislation concerning mental health is among the most detailed and complex. All states have some statutory provision addressing mental health communications and records." [17]

The Secretary has implemented her recognition that mental health information must be afforded heightened protection through the psychotherapy notes patient authorization requirement. Specifically, the proposed rule will permit records to be disclosed to managed health plans, other health providers, and their agents without patient authorization for "treatment, payment, and health care operations purposes." Patients must, however, authorize disclosure of psychotherapy notes to these entities for such purposes.

The APA appreciates the Secretary’s reliance on and extensive quotation of the recent United States Supreme Court decision of Jaffee v. Redmond, 518 U.S. 1 (1996) to provide for the psychotherapy notes disclosure requirement in the proposed rule. In Jaffee, a decision upholding the existence of the psychotherapist-patient evidentiary privilege under the Federal Rules of Evidence, the Supreme Court found that psychotherapist-patient relationship is:

In recognizing the particular sensitivity of mental health records, the Secretary is right to apply the Jaffee decision as the underlying rationale for requiring patient authorization for the disclosure of psychotherapy notes. However, the Secretary’s definition of "psychotherapy notes" in the proposed rule encompasses a narrower range of sensitive mental health information than that recognized by the Supreme Court in the Jaffee decision.

Psychologists and other mental health professionals typically create and maintain records, in addition and related to psychotherapy notes. The privacy of these records must also be protected to ensure effective psychotherapy and to preserve an atmosphere of confidence and trust so that the patient "is willing to make a frank and complete disclosure of facts, emotions, memories, and fears." A patient can not feel secure in the privacy of his or her relationship with a psychologist if he or she perceives that some records require specific authorization for release, while other records with similar and highly sensitive information do not. As the Supreme Court states, "the mere possibility of disclosure may impede development of the confidential relationship necessary for successful treatment." Patients need to know that all sensitive information related to their psychotherapy and treatment is secure and requires their specific authorization for release.

Therefore, the Secretary should define "psychotherapy notes" to include notes and all other records, which contain highly sensitive information related to treatment. These records would include, for example, those clinical observations made by the psychologist outside of a psychotherapy session, and perhaps most importantly, psychological assessment, responses and assessment results.

An expanded definition of "psychotherapy notes," as we propose, is appropriate and justified in the context of the Jaffee decision upon which the Secretary relies. The Supreme Court’s decision is a carefully tailored examination of the psychotherapist-patient relationship in the context of a Federal evidentiary privilege. In contrast, the Secretary is proposing a rule with broad application to mental health records and their disclosure to third parties. To fully reflect the spirit of the Supreme Court’s decision—to ensure the preservation of "confidence and trust" in the psychotherapist-patient relationship—the Secretary should apply the disclosure requirement broadly to all particularly sensitive mental health information.

We offer specific suggestions to amend the current "psychotherapy notes" patient authorization requirement to ensure that the provision protects all sensitive mental health records detailing the psychotherapist-patient relationship. We begin with an examination of the proposed rule’s "psychotherapy notes" definition, which states that:

We suggest that the "psychotherapy notes" definition should be improved as follows:

Incorporating these changes into the "psychotherapy notes" definition, we suggest that the definition read as follows with the text of our amendments underlined:

In addition to amending the definition of "psychotherapy notes" we offer additional suggestions to ensure that the psychotherapy notes authorization requirement works in practice and that it accomplishes the goal of providing patients the ability to determine when their psychotherapy notes may be disclosed to managed health plans and other entities:

B. Many States have laws that more stringently protect the privacy of mental health records than those requirements provided in the proposed rule. The APA believes that the proposed rule’s non-preemption of these State laws is vitally important for the preservation of the psychologist-patient relationship. We are concerned, however, with the proposed rule’s and the Secretary’s interpretation of those States laws that are sufficiently "related to" the privacy of patient records to be saved from Federal preemption. We suggest that the proposed rule’s "related to" requirement is unnecessarily restrictive and may be inappropriately interpreted to preempt many State laws that protect the privacy of mental health records.

As we have mentioned, States across the country currently protect the privacy of the psychotherapist-patient relationship and the confidentiality of the records that are created as a result of this relationship. The APA appreciates that the Secretary acknowledges and accepts the importance of this body of mental health privacy law throughout her commentary and by providing that these laws, when mandating stronger protections, will not be preempted by the proposed rule. We strongly support the non-preemption of these State laws.

We are concerned, however, with the manner in which the Secretary has interpreted and implemented the "related to" requirement. As proposed, only a State mental health law which is sufficiently related to the privacy of individually identifiable health information is saved from preemption. To be sufficiently related, the State law must have "the specific purpose of protecting the privacy of health information or the effect of affecting the privacy of health information in a direct, clear, and substantial way." [23] While the second part of the requirement—that the law is saved when it has the "effect of affecting the privacy of health information in a direct, clear, and substantial way"—may preserve State laws addressing mental health records, we suggest that the "specific purpose" first part requirement may be unnecessarily restrictive and inappropriately interpreted to preempt these laws.

Many States currently afford a range of patient confidentiality protections for persons receiving mental health services. Some of these laws may not be interpreted as having been created for the "specific purpose of protecting the privacy of health information." For example, psychologists’ and other professionals’ licensure laws often provide and laws related to a psychotherapist’s duty to warn others of potential harm from his or her dangerous patients provide requirements related to the privacy of health information. These laws, however, were not created for the specific purpose of protecting health information and therefore could be seen as preempted by the proposed rule.

The statutory basis for the proposed rule’s non-preemption of stronger State laws may be found in section 264(c)(2) and section 1178 of the Health Insurance Portability and Accountability Act (HIPAA). The language of these sections together, as the Secretary concludes, provides that State laws relating to the privacy of individually identifiable health information, which are contrary to and more stringent than the Federal requirements are not preempted. No provision of the statute qualifies non-preemption through the additional requirement that the State laws must have the "specific purpose of protecting the privacy of health information."

The Secretary relies on and cites the House Report language leading to the passage of HIPAA as authority for this additional requirement:

Based on this report language alone, the Secretary concludes State laws that relate to the privacy of individually identifiable health information are "simply those that are specifically or explicitly designed to regulate the privacy of personal health information and not ones that might have the incidental effect of doing so." [24] The APA does not understand how the Secretary could have reached this conclusion based on House Report language, which merely restates the general non-preemption standard. More importantly, we suggest that the additional "specific purpose" requirement to be implemented in the proposed rule could be interpreted to preempt State laws that Congress intended to save.

For this reason, we suggest that the Secretary amend section 160.202 of the proposed rule to more closely reflect Congressional intent regarding non-preemption of stronger state laws. We suggest, for example, that the words "the specific" be deleted and replaced with the word "a".

A. In mental health case, the authority to use and disclose patient information in "emergency circumstances" should be restricted to licensed mental health care professionals exercising their professional judgment.

The APA is greatly troubled by the breadth of the proposed provision allowing unauthorized use and disclosure of patient information in emergencies, particularly with respect to mental health records. Quite simply, the proposed rule appears to open up the ability to invade patients’ privacy to too many people in too many circumstances. Specifically, the Secretary is proposing that health plans, health care clearinghouses, and providers be permitted to:

On its face, this provision would permit virtually anyone working for a health plan or a health care clearinghouse -- even a receptionist or clerk with no mental health training whatsoever -- to breach a patient’s confidentiality if in their lay opinion the circumstances warrant. The APA firmly believes and strongly urges the Secretary to propose that, in the case of patients’ mental health records, only licensed mental health care professionals based upon their professional judgment should be authorized to assess whether the circumstances justify invading patients’ privacy. Only if the mental health care professional recommends disclosure, should the individual provider, health plan or health care clearinghouse be permitted to release confidential patient records. This change would ensure that only persons with professional expertise in mental health care would be making these extremely difficult decisions.

The Secretary already has proposed that only a licensed health care professional based upon his or her reasonable professional judgment of possible harm to the patient may deny a patient’s request to inspect or copy the patient’s medical records. [26] Health plans that choose to deny patients their right to inspect and copy their records must first consult with a licensed health care professional. The assessment of potential for harm to the patient is precisely the same here. Therefore, requiring that only licensed health care professionals judge whether an emergency of sufficient severity exists to warrant disclosure of a patient’s private information would be fully consistent with the Secretary’s own proposals for other sections of this rule.

Further, the Secretary’s proposal to allow disclosure by simply anyone who believes an emergency exists is a tremendous unprecedented expansion of Tarasoff v. Regents of the University of California, [27] and similar State laws throughout the country. We understand and agree with the California Supreme Court’s finding in Tarasoff that "the protective privilege ends where public safety begins." We also understand the Secretary’s very practical desire to ensure that health care professionals and law enforcement officials have access to the medical records of an individual who, for example, is injured in an automobile accident and cannot consent to disclosure in order to ensure that proper medical care can be provided. In the context of mental health, however, confidential communications between psychotherapists and their patients deserve greater protection.

As the Supreme Court has stated in Jaffe, as the Secretary already has recognized, and as we have commented throughout this letter, communications between patients and their psychotherapists deserve heightened protection due to the records’ greater sensitivity and the special need for confidentiality and trust in the psychotherapeutic relationship. The Secretary also has recognized that nearly all States have adopted some form of additional privacy protection for mental health records.[28] Under California law, for example, the psychotherapist-patient privilege is considered to be a broader privilege than the physician-patient privilege. [29]

Moreover, the need to balance the patient’s need for confidentiality against the public interest of health and safety is already addressed by many States under their "duty to protect" laws, which impose an obligation on psychotherapists and other providers to protect readily identifiable third parties from potential harm. As the Secretary already has acknowledged, this duty was first established in Tarasoff, but has since been adopted in similar form by many States. [30] For more than two decades, these States have worked carefully and meticulously to achieve an appropriate balance between the need for confidentiality and the need to protect the health and safety of others. If there is the possibility of danger to a readily identifiable third party, the psychotherapist must take steps to warn and protect that third party. These steps might include warning the potential victim of the danger, notifying the police, or even involuntarily committing the patient to the hospital.

To better balance the need for public safety and patient privacy, the APA strongly urges the Secretary to more narrowly tailor the "emergency circumstances" provision in the manner suggested above. We offer below our recommended revisions to this provision with the following underlined amendments:

B. The proposed rule should provide an exception to the right of patients to inspect and copy their mental health records if, in the opinion of a licensed mental health care professional, disclosure could reasonably be expected to cause substantial psychological harm to the individual who is the subject of the record.

The APA appreciates that the provision protecting patients’ right to inspect, copy, and correct their records is consistent with evolving legal recognition of these rights. However, we strongly urge the Secretary to reverse her decision to remove the exception for psychological harm and include it in the final rule.

As presently drafted, the provision permits health plans, health care clearinghouses and providers to deny patients’ requests for access to their records where licensed health care professionals judge that access is reasonably likely to endanger only "the life or physical safety of the individual or another person." [31] The Secretary has made clear that she considered, but declined to include, a similar exception where the information has the potential to cause emotional or psychological harm. The Secretary apparently arrived at this determination after concluding: "in the current age of health care, it is critical that the individual is aware of his or her health information." [32]

The APA agrees that in today’s environment it is important for individuals to have access to their health care information. However, the exception to this principle, where the life and safety of the individual are at stake, is no less critical for patients endangered psychologically than physically. The potential for serious psychological injury in this regard is not the equivalent of just a broken arm, but could be far more serious, even permanent. For example, if a patient suffering from paranoid delusions believes he or she is hearing voices, then inspects and reads in a therapist’s record that the therapist believes these voices are auditory hallucinations rather than "real" voices, distrust of the therapist could occur if revealed too early in the treatment. To ignore the possibility of psychological harm in mental health treatment works contrary to the very purpose of the treatment.

In fact, the psychological harm exception to patients’ right of access to their records also is consistent with evolving law. For example, legislation proposed in this congressional session by Senator Jeffords, "The Health Care Personal Information Nondisclosure Act of 1999," (S. 578), included a psychological harm exception. Specifically, the bill would permit denial of patient access to their records if "the disclosure of the information could reasonably be expected to endanger the life or physical safety of, or cause substantial mental harm to, the individual who is the subject of the record (emphasis added)." [33]

Similarly, as the Secretary herself has acknowledged, a number of States allow an exception for psychological harm including, but not limited to: California, Connecticut, the District of Columbia, Indiana, and Maine. [34] In the District of Columbia, for example, the treating mental health care professional may refuse a patient’s request to see the patient’s records if the professional "reasonably believes that such refusal or limitation on disclosure is necessary to protect the client from a substantial risk of imminent psychological impairment . . ."[35]

The APA understands that concerns have been raised that the psychological harm exception is often too vague or too broadly worded because it permits the covered entity subjectively to determine whether there is a risk of psychological harm. To ensure greater accuracy in assessing the potential for psychological harm, the APA strongly recommends that the determination whether to deny access be made solely by a licensed mental health care professional, who has the requisite training to assess whether serious psychological harm is likely to occur.

Accordingly, incorporating the above referenced changes into the "harm" exception to patients’ right to inspect and copy their records, we suggest that the regulation read as follows with the text of our amendments underlined:

In the alternative, because so many State laws already contain exceptions for psychological harm, the APA respectfully requests that the Secretary at the very least not preempt State laws governing patients’ right to inspect and copy their records.

C. Law enforcement officials should be limited in their use and re-disclosure of patient records. Permissible disclosures under the proposed rule (1) related to victims of crime or abuse, (2) pursuant to legal processes, and (3) related to the investigation of health care fraud should be narrowed in scope or their meaning clarified.

We raise a number of concerns regarding section 164.510(f) of the proposed rule, which permits health providers and plans to disclose records to law enforcement officials without patient authorization. Generally, we believe that law enforcement access to patient records should be limited to the absolute minimum disclosure and use necessary in the interest of justice. The law enforcement access provisions of the proposed rule do not provide and therefore should be clarified to meet this burden.

We first discuss an overarching concern with the law enforcement disclosure provision: Assuming that disclosure to a law enforcement official has been made, the proposed rule provides no limitation for further use and re-disclosure of the records. Limitations on law enforcement use and re-disclosure should be included in the final rule.

By not imposing use and re-disclosure safeguards, the Secretary may have assumed that a court, grand jury, or judicial official in an administrative proceeding would impose such limitations. It seems reasonable to believe, however, that various administrative law bodies may not have specific procedures for use and re-disclosure in place. In addition, the proposed rule allows disclosure of patient records in other instances unrelated to legal processes or proceedings. These include release of patient records to a law enforcement entity: (1) to identify as suspect, fugitive, material witness, or missing person, (2) regarding the victim of a crime, abuse, or other harm, or (3) pursuant to an investigation of health care fraud. The proposed rule should specify use and re-disclosure requirements for disclosures to law enforcement in these instances.

Both Senators Jeffords and Leahy specify limitations on law enforcement use and re-disclosure of patient records in their proposed patient records privacy bills (S. 578 and S. 573, respectively). Both the Jeffords and Leahy bills, for example, require that a law enforcement entity either destroy the patient information or return it to the disclosing party when the matter or need for which the information was disclosed has concluded. Both bills require redaction of personally identifiable information prior to public disclosure in a judicial or administrative procedure. Senator Leahy’s bill additionally requires the court granting law enforcement access to impose appropriate safeguards to ensure the privacy of the information and to protect against unauthorized or improper use and disclosure. [36] The provisions of these bills could serve as starting points for limitations recommended by the Secretary.

In addition to the lack of limitations specified for use and re-disclosure of records by law enforcement officials, we raise three other issues concerning certain permissible disclosures to law enforcement: