Psychoanalysts would be surprised to learn how little legal protection exists for the confidentiality of their patient information once it has left their offices for third-party payers—both private and governmental.
Within our offices, of course, statutes, legal precedents, and the common law carefully protect confidentiality. The forms of this protection vary from state to state, but New York can be considered typical. There, the laws governing confidentiality of the practitioner's records can be overridden without a court order only under certain conditions: divulging confidential information to a third party requires the patient's consent; confidential information can be given to the patient (except where it would be detrimental to the patient or to the treatment or to a third party who provided the information originally). Confidential information can be provided to the government only in cases of child abuse, in which case the need for information absolutely overrides confidentiality.
A number of states have either statutory or judicial precedents for the practitioner's duty to warn or protect other persons who might be endangered by the patient In a few states, the duty to protect extends to others beyond specifically identified persons, and in one state it has even been extended to property. This duty to warn and protect has not yet been defined in New York State (although the therapist is permitted to warn and protect), but sooner or later it will, in all probability, be instituted.
The strict guidelines under which patient information is held confidential in the practitioner's office apply as well to case reports presented by practitioners at meetings and conferences, in publications and research reports, and in supervisory sessions (unless the cases are adequately disguised). These guidelines also apply to the records of patients in control analyses and to the records of the training analyses of the candidates themselves. Any breach of confidentiality on any level requires the informed consent of the patient involved and must be reviewed not merely by the legal counsels of the national associations, but by their local chapters and affiliates as well, for this country's legal system consists of a patchwork of relatively autonomous and overlapping legal jurisdictions—federal, state, and local—and the laws governing disclosure vary from place to place.
Mental health information contained in the records of insurance carriers presents a serious problem. No federal statutes govern this information, other than the strict regulations regarding the treatment of patients for alcoholism or substance abuse disorders; where alcohol or substance abuse is a primary diagnosis for which the patient is receiving treatment special release forms are needed for disclosure. But there is nothing in the law governing mental health records in general. Guidelines are virtually nonexistent in many states.
In New York, no law adequately prevents an insurance carrier from disclosing patient information to a life insurance division of its own company, to other insurance carriers' life insurance divisions, to credit card companies, or to others. Even first-level claims review records containing such sensitive information as the diagnosis and treatment procedures are often readily available to employers and others in the firm. Where the employers are self-insured (in New York State, perhaps 50%) there is even less regulation.
The Committee on Mental Health of the Medical Society of the State of New York (MSSNY) has been actively attempting to remedy this situation, although previous efforts by the Attorney General's office, initiated by the clinical psychologists, received very little support. The first attempt was a bill ruling out the need for insured persons to disclose more than their diagnoses, treatment, dates, and the like. The insurance carriers strongly opposed this proposal, as did many psychiatrists and others who felt that the carriers were entitled to some degree of cost and quality control and that without such control they would decrease or discontinue all mental health coverage—as they had done in a few instances already. The initiative quickly failed in the legislature.
Another attempt, this time by the Department of Law and the psychologists, was modeled on the New Jersey law (for psychologists only) under which all claims and peer review procedures are organized through state government-appointed panels. This proposal too was strongly opposed by the insurance carriers and did not even make it to the legislature. The MSSNY Committee then worked with the Chair of the New York State Senate Committee on Mental Hygiene and his staff, along with the Assistant Attorney General for Legislative Affairs, to produce a mild, almost “motherhood,” bill—a good “first step” it seemed. This proposed legislation merely required that the carriers protect their patient information as practitioners must in their offices. The bill was acceptable to the New York State Psychiatric Association, the psychologists, the clinical psychologists, and the social workers, but again, it was opposed by the carriers. Although introduced into committees in the state Senate and Assembly, it never made its way out of them. Currently, MSSNYs Committee is working with the New York State Chapter of the American Civil Liberties Union to try to enact effective guidelines in the upcoming legislative session.
Of even greater concern than the insurance issue, perhaps, are the pools of patient information held by the government New York State has taken a large step to insure patient protection from government intrusion with its SPARCS program. SPARCS governs all the patient information held in the central data bank of the State Department of Health. These data include the patient information from all the hospitals in the state other than those included in the Office of Mental Health system. Access to this data bank is controlled by a professionally constituted Data Protection Review Board. Legitimate access (that is, access by epidemiologists, researchers, and so forth) is permitted only in a way that prevents identification of individual patients. Even the criminal justice system and fraud and abuse agencies must go through the courts to gain entry to the data bank.
Unfortunately other governmental pools of information are not so well protected (such as the triplicate prescription program in the New York State Department of Health). The problem exists on the federal level as well. While strong privacy laws in the Public Health Service, the Department of Health and Human Services (which holds all the Medicare information and, potentially,
the “bad practitioners pool”) grant confidentiality protection, access to the information is often ultimately in the hands of one person—a systems manager or some such bureaucrat Can one expect a person on that level to resist intrusions from the White House or the Congress? Recently, during the debate on Tower's appointment as Secretary of Defense, the mental health records of a retired Air Force sergeant were disclosed on the floor of the Senate in order to disqualify his reports of John Tower's alleged lack of sobriety. This disclosure was a clear violation of the Privacy Act, and one that could have been prevented in all probability if there had been a Data Protection Review Board modeled on the New York State SPARCS program.
The MSSNY Committee on Mental Health has, with Congressmen Charles Schumer, Thomas Downey, and others, been advocating such a board on the federal level, but the problem is not solved yet Support for the Committee's work from colleagues at the state and national levels is vital. Until patient confidentiality is protected both within and outside the office, MSSNY can only warn its members and those of other professional associations of the dangers that exist.
Herbert S. Peyser, MD is the Chair, Committee on Mental Health Medical Society of the State of New York; Member, Committee on Psychiatry and the Law, New York State Psychiatric Association.