The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that helps protect the privacy of individual health information. For individuals entering into psychotherapy, this law is important, because it helps protect confidential mental health treatment records.

The federal Office of Civil Rights (OCR) at the Department of Health and Human Services (HHS) has enforcement authority over HIPAA. On Feb. 21, 2014, OCR released guidance clarifying how and when healthcare providers may share an individual’s mental health treatment information with others.

 

Below is a set of questions and answers to make sure you know what HIPAA means for you...
 

• Can healthcare providers share mental health treatment information with family members of a person involved in psychotherapy?  

Yes, healthcare providers may share information about treatment with a person's    family if the person involved in psychotherapy does not object.

        

• Are health care providers required to obtain a signed informed consent release before sharing information with family? 
   
  No, citing the “integral role that family and friend’s play in a patient’s health care,” OCR’s guidance states that providers may ask for permission to share relevant information, may tell the person that they intend to discuss information and give him or her the chance to object, or may infer from the circumstances, using professional judgment, that the person does not object. For example, if a person receiving treatment invites a family member or friend to be present in a treatment situation, the provider may assume that the person does not object to disclosure of information.

 

• What happens if the person involved in psychotherapy objects to information sharing?
   
  If the person receiving treatment is an adult, objects to the release of information, and is deemed capable of making healthcare decisions by the healthcare provider, then the healthcare provider may not share information with family or friends. If the healthcare provider determines that a person does not have the capacity to make healthcare decisions, then the provider may choose to share information with family, friends, or other individuals involved in the person’s care if the provider believes it is in the person’s best interest. A court order is not required for a determination that a person lacks capacity. Discretion lies with the treatment provider, based on professional judgment.  

 

• How much information can the healthcare provider share with a person’s family members?
   
  Healthcare providers should exercise professional judgment and disclose only the information that is necessary or directly related to the family member or friend’s involvement in care. Psychotherapy notes—notes that are written by a provider during counseling sessions detailing specific conversations—are treated differently than other healthcare information because they may contain especially private or sensitive information. In most instances, a provider must have a patient’s permission before sharing information contained in psychotherapy notes.

 

• May family members communicate with a healthcare provider if they are worried about a person’s health or well-being?
   
  Yes, family members or friends may share information that they believe might be relevant or helpful to a treatment provider. Healthcare providers are not required to disclose this communication to the individual receiving treatment.

 

• Can healthcare providers share information with parents or guardians of children?
   
  Generally speaking, yes, a healthcare provider may share treatment information with a parent, guardian, or an individual acting as a personal representative for a child.

 

• At what age is a child considered an adult for the purposes of healthcare decisions?
   
  Generally, age 18, but HIPAA defers to state law if a state has a different standard.

 

• Can healthcare providers share protected mental health information with law enforcement officials?
   
  Yes, in certain circumstances, particularly if a person involved in psychotherapy poses a danger to self or others, then healthcare providers may disclose necessary information.