The Health Insurance Portability and Accountability Act of 1996 includes mandates on privacy standards, electronic transmission standards, and unique health identifier standards. The privacy standards, known as the Privacy Rule, were finalized in August 2002 and went into effect on April 14, 2003. It is this Privacy Rule that most affects analysts and other mental health clinicians.
If you are a healthcare provider and you engage in at least one “standard electronic transaction” during the year, you are a “covered entity.” A standard electronic transaction includes any transmission of information between two parties to carry out financial or administrative activities related to health care, by use of the Internet, leased lines, and dial-up lines, as well as use of tape or disk. It does not include faxing information from a paper fax machine.
The most common example of a covered analyst is a clinician in private practice who accepts insurance and uses electronic transmission to submit insurance claims. If you send all your insurance claims by paper submission, you are not covered. You also may be covered, even if you do not use electronic submission in your private practice, if you work in a clinic or hospital that uses your name and provider ID to electronically bill for services. (This question is currently under review.)
Even if you are not a covered provider, you should know the requirements of the Privacy Rule. Each health-care provider needs his/her own privacy policies and procedures. These are, of course, subject to state law, but the federal law provides a useful guideline. The Privacy Rule may be used by the courts to set a standard by which to measure privacy issues. Medicare has indicated its intent to require electronic submission in the next several years, but practices with fewer than ten full-time equivalent employees are likely to be excluded.
The Privacy Rule establishes a federal “floor” of rights that individuals have with respect to privacy and access to “protected health information” (PHI). PHI is any information that both identifies an individual and contains health information. Health-care providers remain subject to state law, which may provide stronger privacy protections. In addition, health-care providers are subject to ethical and professional practice standards. Health-care providers may decide to offer greater protections than those required by HIPAA.
A written Notice of Privacy practices to be given to patients
A written set of privacy policies and procedures
A “business associate” contract with any entity that handles identifiable health information on behalf of the provider.
To receive adequate notice of PHI uses and disclosures.
To know how to exercise their rights.
To disclose only the minimum PHI necessary.
To request restrictions on uses and disclosure of PHI and to know when that right may not be granted.
To receive confidential communications.
To inspect and copy the medical record, with some exceptions.
To amend the medical record, with some exceptions.
To receive an accounting of any disclosures, with some exceptions.
To provide the patient with a written Notice of Privacy practices.
To make a good faith attempt to obtain written acknowledgment of receipt of the notice.
To have written policies and procedures for the use and disclosure of PHI.
To obtain written authorization for certain non-routine uses and disclosures.
To provide an accounting to the patient upon request for certain non-routine disclosures.
To provide patients with access to medical records, with certain exceptions.
To maintain written documents for a period of 6 years.
When the patient consults with a healthcare provider, he or she is considered to give consent for routine disclosures of protected health information for the following purposes:
Treatment—For example, discussion with others currently providing treatment, consultation on or supervision of treatment issues, obtaining and making referrals, discussion with medical doctors.
Robert S. White, M.D., is a member of the TAP editorial board. He is the president of the Western New England Psychoanalytic Society and an assistant professor of psychiatry at Yale University.
Payment—For example, sending a claim to an insurance company or submitting a managed care treatment plan. Note that the American Psychoanalytic Association ethical standards prohibit the psychoanalyst from ever sharing confidential information with non-clinical third-parties without the patient's consent.
Health-care Operations—For example, quality assessment, hospital privileges, and training programs.
The health-care provider is encouraged, but not required to notify the patient or take patient preferences into account. State law takes precedence if its requirements are stricter In mental health practice, it is always best to inform patients of these routine disclosures and obtain their informal or formal consent.
Most non-routine use and disclosure of PHI require a written authorization.
Subject to state law, there may be a number of exceptions, such as those listed below, when the provider may disclose information without written consent. However it is always good practice to inform the patient when possible.
Danger to self or others
Communication with family in an emergency
Public health activities
Prevention of abuse or neglect
Law enforcement or court subpoena
Research
Workers' compensation
These are notes by a mental health professional documenting or analyzing the contents of a private counseling session. Psychotherapy notes are intended to contain information that is sensitive and to be used only by the treating provider These notes must be separated from the rest of the medical record. Psychotherapy notes may not contain prescription information, time of sessions, modality of treatment, clinical tests, diagnoses, or summary of progress. (All these belong in the official medical record.)
Psychotherapy notes may not be disclosed without a separate written authorization. Moreover, providers are not required to grant patients access to psychotherapy notes unless required by state law. Health-care plans may not make benefits conditional on the patient's authorization of the release of psychotherapy notes. It is not yet clear if psychotherapy notes are discoverable in litigation, so the absolute privacy of such notes is also unclear. This is governed by state law. Some state laws do allow more liberal disclosure of psychotherapy notes.
If you are a covered provider and need to develop these documents, most professional associations have specific guidelines and sample forms. You should consult these sources and legal counsel, as the requirements are complicated and much more detailed than I can indicate here. For more detailed information, see the article on the members section of the APsaA website, Directions for Complying with HIPAA Privacy Standards.