This is not an article about HIPAA. This is about using HIPAA to simplify your documentation of services, to simplify your release of records, and to resist intrusions by third parties who tell you how to create a record and what to release to obtain payment. This is about how we, as practicing psychologists, reestablish ourselves as the primary authority to create standards for documentation. Third parties who seek to “sit in” the therapy room by viewing our records – under illegitimate and sometimes unlawful pretenses – are voyeurs who should not set documentation standards. Payers do not set documentation standards. Practicing psychologists do.

This article will describe a largely unrecognized and underutilized basis we have now by virtue of the HIPAA “Privacy Standards” (Office for Civil Rights, 2003) to effectively prevent anyone other than the profession defining what “should be” in the record. Using this approach, we will also be able to vigorously and effectively prevent release of massive amounts of patient information and the ensuing unwarranted intrusions into doctor-patient privacy essential to psychotherapy. To paraphrase that wonderful sentence from the Evidence Based Practice Task Force Draft Policy Statement (APA,2005),
“The ultimate judgment regarding documentation must be made by the treating psychologist in collaboration with the patient.”

To simplify your documentation, decide what to release, release only what must be released and nothing more to protect patient privacy despite claims by third party payers who say they need more information in order to pay you, read on.

What the HIPAA Privacy Regulations Say

Let us begin with the relevant sections of the “Privacy Standards”:

“§ 164.501 Definitions. Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

§ 164.502 (b) Standard: minimum necessary. (1) Minimum necessary applies. When using or disclosing protected health information or when requesting protected health information from another covered entity, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

§ 164.508 (a) (2) Authorization required: psychotherapy notes. Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:

(i) To carry out the following treatment, payment, or health care operations:
(A) Use by the originator of the psychotherapy notes for treatment;
(B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or
(C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by § 164.502(a)(2)(ii) or permitted by § 164.512(a); § 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; § 164.512(g)(1); or § 164.512(j)(1)(i).

(4) Prohibition on conditioning of authorizations. A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except:...(B) The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section...”

Simply put, the HIPAA Privacy Regulations define what is medical record, what is not medical record, what may and may not be released, and how. This probably runs counter to much of the “popular wisdom” that HIPAA allows wholesale unauthorized release of patient information. It does not. Most importantly, HIPAA requires that treatment, payment, enrollment and eligibility decisions may not be made contingent on release of psychotherapy notes. That bears emphasis: HIPAA requires that payment decisions may not be made contingent on the release of psychotherapy notes.

We ought to recognize the power of these definitions and standards. Recall that, unless your state has laws and regulations which are more protective of patient privacy or more permissive regarding patient access to their health care records, these regulations apply to you (the vast majority of psychologists in independent practice are “covered entities.”)

These requirements should guide professional standards and daily practice in documentation and release of records for psychologists providing psychotherapy in the outpatient office setting. They may also apply to psychologists providing services in inpatient settings, and indeed any other context in which psychologists provide and document treatment and in which communication with other health professionals – and payers and anyone else claiming a need for “oversight” – occurs.

How to implement these definitions and standards

(1) Required documentation for every and psychotherapy visit should include ‘minimum necessary’ elements, and no more. A standard progress note would be brief and rapid to complete. It would document medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment furnished and results of clinical tests. An ‘extensive’ progress note a psychologist might choose to create could include a summary of any of the following items if these are recorded for a particular visit: diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. A sample note format is shown in Appendix I.

Based on the ‘minimum necessary’ and psychotherapy notes definitions in HIPAA, this could be all the psychologist needs to complete to document psychotherapy on the record. Such a note may easily be completed during sessions or in a few minutes after sessions. Such notes are the psychological record. Assuming that the client provides an appropriate authorization to release even this much information, this is the only information to be released to any third party without additional patient authorization.

(2) By default, the psychologist should define everything else maintained about a patient – any record made in any medium – as “psychotherapy notes.” There is no minimum or maximum that the psychologist “should” produce. This leaves the judgment and discretion precisely where it belongs: up to the psychologist in collaboration with and taking into account the needs of a particular patient.

(3) When ‘the record’ is properly requested for use by another health professional, the standard progress notes in (1) may be supplied. Indeed, the ‘minimum necessary’ notes are all that may be supplied without additional authorization by the patient. That is all that exists as ‘the record.’ All else is, by definition and sequestration from the rest of the record, ‘psychotherapy notes.’

(4) When a ‘comprehensive’ subpoena or similar demand for ‘every record in your possession made about this patient in every medium’ is issued by an attorney either on the client’s behalf or adversarial to the client, or by any other third party, any record beyond the ‘minimum necessary’ defined in (1) above could not be released without the additionally required authorization by the patient or authorized representative. Recall that 164.508 (a) (2) mandates specific additional patient authorization to release psychotherapy notes. Requiring the additional authorization provides the opportunity for the psychologist to review with the client the risks associated with authorizing such a release, bringing true meaning to “informed consent.”

(5) When an insurance company or other third party issues an intrusive request for all sorts of data about a patient in order to pay the psychologist, only the ‘minimum necessary’ information for the purpose of that disclosure should be provided. That means, no matter what the insurance company is asking for, the ‘minimum necessary’ notes are all that go, without additional patient authorization. A standard release to a payer ensures that the psychologist releases only medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment furnished and results of clinical tests. The psychologist would also release a summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date if these exist in the record for a particular visit.

Discussion

Any other requests from payers for extended documentation in any format including “Outpatient Treatment Reports” (OTRs) go well beyond the ‘minimum necessary’ standard. Requests or demands for such releases may well violate HIPAA if these are requested in a direct or implied context that payment for services is contingent on the release of such information. Such OTRs and similar extensive documentation routinely requested by managed care companies include reports of substance abuse, developmental, occupational, marital or sexual history, history of physical or sexual abuse, or ratings ostensibly for “outcomes research” or “quality measurement.” These data may be present as part of the ‘minimum necessary’ record should they happen to be associated with diagnoses which are a focus of treatment. But if they are not, demands for such data in the context of a payment determination would appear to violate § 164.508 (4).

Practicing psychologists should define ‘minimum necessary’ as a professional standard for the release of information for the purposes of payment. Indeed we are held to this standard. Psychologists should – and have at our disposal this method to – actively resist disclosure of any more than the minimum necessary. When an insurance company demands extensive information in the context of direct (or veiled) threats of disempaneling you or of withholding referrals, payment is, in essence, contingent on that release. A ‘minimum necessary’ professional standard would allow providers to respond to such requests with a reference to § 164.508, and, if necessary, a complaint to the Office for Civil Rights, which monitors and enforces HIPAA-related violations.

There may be concern that this approach creates an additional burden for the psychologist to maintain “two charts.” On the contrary. For a practical matter, this method simplifies record-keeping and release. The psychologist is free to take notes in writing or any other medium during sessions. Those simply must be labeled ‘Psychotherapy Notes,’ and stored separately from the patient’s record.

‘Separated from the rest of the individual’s medical record’ is not defined in the Privacy Standards and has not yet been defined through litigation. So this may create a record storage issue. However, there need be only one “chart,” which is maintained by completing a standard progress note during or in a few minutes after each session. Or, the psychologist may choose to complete an ‘extended’ note for a particular visit. It may be sufficient to keep handwritten psychotherapy notes in a separate tabbed section of ‘the chart,’ clearly labeled as ‘psychotherapy notes,’ or in another storage area if in a medium other than handwritten. A functionally similar sequestered and labeled “area” may be readily be created in an electronic medical record. When a request for ‘the record’ comes in, the psychologist knows exactly where to look and what to release.

The American Psychiatric Association has adopted a standard similar to what is described here (American Psychiatric Association, 2001). In their formulation, guidelines for outpatient treatment authorized for payment, outpatient treatment requiring pre-authorization, and inpatient treatment have been defined. In none of these cases does documentation include extensive “process” or “content” information for routine claims.

The American Psychiatric Association also provides a model for a “Universal Outpatient Treatment Report Form” which does include rather extensive information well beyond ‘minimum necessary’ (e.g., functioning in multiple psychosocial domains, mental status, additional clinical information). However, this model OTR includes disclaimer language: ‘Optional assessment to be sent only with the consent of the patient’ and ‘Psychiatrists should fill out applicable sections only. Release only necessary information and whenever possible discuss with the patient or legal guardian’ for the initial or continuing OTR. Clearly the intent is to release only the minimum necessary for payment decisions, and that the profession sets the standard for documentation and release, not the payer.

The American Psychological Association is in the process of revising its current (APA, 1993) documentation guidelines. Given that these are “guidelines,” they are described to be “aspirational in intent.” The current draft includes language pertinent to construction of a chart taking HIPAA into account: “The psychologist may consider dividing client files into two or more sections. Psychotherapy notes, as defined by HIPAA, are necessarily kept apart from other parts of the record” (APA, 2006).

The draft guidelines also include consideration of documentation in third party payer contexts: “Many third party payer contracts require specific information to be included within the record. Psychologists who sign but do not abide by contracts with such payers will potentially experience a number of adverse consequences (e.g., required reimbursement of previously received funds, legal actions).” The draft guidelines go on to describe “The record of psychological services may include information of three kinds....Information in the client’s file...for each substantive contact with a client...the record may also include other specific information, depending upon circumstances.”

While the entire ‘record of psychological services’ certainly may be extensive, it is more narrowly the documentation of psychotherapy I wish to address. Aspirational guidelines are wonderful, but may also create dangers. It is exactly backwards should the APA produce guidelines which aspire to create a chart based on the coercive demands of payers who make contracting and payment contingent on chart content.
Specific to documenting psychotherapy and releasing records for the purpose of insurance companies making payment determinations, professional standards should be the ‘minimum necessary’ standard and method described here. In that condition, third party payers seeking to obtain more – to obtain psychotherapy notes – with payment contingent on release, could not create adverse consequences for the psychologist. Rather, the adverse consequences would fall on the third party payer seeking such improper release.

It has been said that these standards may well protect the psychological record but could provide the opportunity for payers simply to deny payment for lack of sufficient information to determine ‘medical necessity.’ If that is the response from a payer, that will have to be met directly with a complaint that the HIPAA Privacy Standards have been violated and that the payer is attempting to make payment contingent on release of psychotherapy notes. Since payers predictably will assert they have the right to define what is in the record and what is released, this issue undoubtedly will have to be litigated in the future. One hopes for the full financial and legal support of our professional organizations.

Payers do not set professional standards for the content and release of psychological records. Psychologists in collaboration with our clients do.

References

American Psychiatric Association. (2001). Minimum necessary guidelines for third-party payers for psychiatric treatment position statement (superceded). Retrieved December 17, 2006, http://www.psych.org/edu/other_res/lib_archives/archives/200108.pdf.

American Psychological Association. (1993). Record keeping guidelines. American Psychologist, September 1993, Vol. 48, No. 9, 984-986. Retrieved December 17, 2006, http://www.apa.org/practice/recordkeeping.html.

American Psychological Association. (2005). President’s column: Evidence-based practice in psychology. Monitor on psychology, Vol. 36, No. 2, February 2005. Retrieved December 17, 2006, http://www.apa.org/monitor/feb05/pc.html

American Psychological Association. (2006). Record keeping guidelines: September 2006 draft. Retrieved December 17, 2006, http://forms.apa.org/practice/recordkeeping/RKGforComment.pdf

Office for Civil Rights. (2003). Standards for privacy of individually identifiable health information regulation text. Retrieved December 17, 2006, http://hhs.gov/ocr/hipaa/finalreg.html

Appendix I

Sample ‘Minimum Necessary’ Session Note

Session Note

Client: Session date:
Session start time: Session end time:
Modalities of treatment:
Frequency of treatment:
Results of clinical tests:

If recorded this session (not necessary to record every visit):
Tests administered and results:

Medication prescription and monitoring:
Summary of:
Diagnosis:
Symptoms:
Functional status:
Treatment plan:

Progress to date:

Prognosis:

Practitioner: Date:

Pursuant to Federal Regulations at 45 CFR §164.501, the above information is documented at each client visit, and may be used or disclosed upon specific written consent of the client or authorized representative for treatment, payment or health care operations. No other information about this client will be released by this mental health professional/mental health care entity unless specific, fully informed authorization from the client or authorized representative is obtained and provided in writing, or as otherwise allowed by law. Statutes and regulations in this State regarding release of health care information may be more restrictive than Federal Regulation, further limiting disclosure of the above and other individually identifiable health information.

YOU AS THE RECEIVING ENTITY MAY BE SUBJECT TO CIVIL AND FEDERAL
CRIMINAL PENALTIES FOR IMPROPER RE-DISCLOSURE OF THIS INFORMATION.