Managed Care
Privacy Regulations: Implications for Practicing Psychologists and Mental Health Consumers
What are the Privacy Regulations? With the passage of the Health Insurance Portability and Accountability Act (HIPAA) in 1996, Congress had three years to create companion legislation to protect personal health information. Failing that, HIPAA authorized the Secretary of Health and Human Services to create regulations, which HHS did. These Standards for Privacy of Individually Identifiable Health Information (45 CFR Subtitle A, Subchapter C, Parts 160 and 164) were published as a Final Rule in the Federal Register 12/28/2000. Part 160 deals with administrative requirements and Part 164 contains the security and privacy provisions. In brief, the regulations…present standards with respect to the rights of individuals who are the subjects of this information, procedures for the exercise of those rights, and the authorized and required uses and disclosures of this information … including standards to protect the privacy of individually identifiable health information.
To whom do the regulations apply? They apply to health plans, health care clearing houses and health care providers…who transmit(s) any health information in electronic form in connection with a transaction covered…. A health care provider is further defined as, a provider of…medical or health ser vices…and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.
What health information is covered? All medical records and other individually identifiable health information held or disclosed by a cover ed entity in any form, communicated electronically, on paper, or orally are covered. One of the controversial aspects of the final regulations is that they expanded coverage to written and spoken communication; the initial intent was to cover elec tr onic data only.
What are some of the protections for health care consumers? Consumers will have greater control over their health care information including the right to consent in advance for most disclosures , to see and amend the records , to obtain a record of when and to whom their information has been disclosed, and the right to be notified of their rights under the regulations. Health information generally may not be disclosed or used without consent for non-health purposes such as employment decisions.
Of particular importance to mental health consumers and professionals, psychotherapy notes are explicitly defined and afforded additional protections.
Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individuals medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date (164.501).
Psychotherapy notes may not be used or disclosed without client c onsent except for use by the originating therapist; use by mental health students, trainees or practitioners in training or under supervision by the originating professional/ent ity; or to defend a legal act ion or othe r pro ceeding brought by the client against the originating professional or entity. All other uses and disclosures require specific client authorization.
Under the regulations, psychotherapy notes are not considered to be pa rt of the medical record if maintained separately, based on the principle that such notes were never intended to be used by anyone other than the originating therapist. Clients do not have a right to inspect psychotherapy notes under this definition, and may be refused access. Clients do have a right to timely access to their medical record, including the information noted above considered to be excluded from psychotherapy notes and which might be documented at each treatment visit. However, access to the medical record may be denied by the health care professional for a number of r easons, some reviewable and some not. For instance, if a health care professional believes allowing access to the record will endanger the life or safety of the individual or another person, access to the record may be denied, and that is a reviewable decision. When access is denied for a reviewable reason, the health care professional or entity must have a process in place to allow review by a licensed health professional not directly involved in the original decision.
There certainly may be important reasons to maintain information in the formal medical record beyond the exclusions to psychotherapy notes indicated previously, for example to meet ethical and clinical requirements and to meet documentation requirements for specific payers and accrediting bodies. In addition, psychotherapy notes as defined in the Standards may well be discoverable through other means and in other forums, such as when a clients mental health condition is at issue in litigation.
A few states currently allow personal notes to be maintained by psychotherapists, separate from the medical record, but these would appear to be a minority of jurisdictions. The new federal definition of psychotherapy notes may well have a profound impact on documentation standards and practices among psychologists. This is particularly so because the Standards also preempt existing state laws regarding protection of health information unless the state law is more stringent (i.e., protective of disclosure) or pertains to public health protections such as disease or abuse reporting or requirements of health plans to report for licensing and monitoring functions, or if an exception is granted by HHS. The privacy standards now appear to allow mental health professionals in all jurisdictions to maintain psychotherapy notes separate from the medical record.
An interesting dilemma on the horizon is the potential conflict between documentation and disclosure standards of accrediting bodies and payers and the requirements of the Standards. Another key component of the Standards holds that when individually identifiable health information is used or disclosed, information must be the minimum necessary for the purpose of disclosure. This probably has implications for disclosure of information for the purpose benefits and payment determinations in a mental health context. For example, local Medicare review policies may require documentation of psychotherapy to include information such as session content, observed behavior and affect, and patient response to interventions. APAs recent Medicare handbook indicates some LMRPs require psychotherapy documentation to include a List of general topics addressed, risk factors (and) briefly, how present session relates to therapeutic treatment goals (Medicare handbook: A guide for psychologists, Practice Directorate, 2000, p. 18.) While such documentation may enhance clinical care, the requirements of the standards suggest that automatic (i.e., non-authorized by the patient) disclosure of this type of information may go beyond the minimum necessary principle if only for the purpose of determining benefits and payment. Patients may well need to be asked to consent (or refuse to) disclose such information routinely in progress notes. It will be particularly interesting to see how the potential conflict between Medicare documentation requirements and federal regulation requiring more restr ictive disclosure evolve. Base on initial re adings though, it appears that the burden may well be on third party payers to establish the need for documentation of psychotherapy beyond medication, session length, type and frequency of treatment, test results, and a summary of diagnosis, functional status, plan, symptoms, prognosis, and progress.
One additional important principle in the Standards which appears to add strong protections for mental health consumer is the prohibition on conditioning of authorizations. The Standards state, A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization except ....for the health plans eligibility determinations or enrollment or...underwriting or risk rating determinations; and (B) The authorization is not for a use or disclosure of psychotherapy notes... (164.508). The preamble to the Standards describes the rationale. This prohibition extends to all authorizations, not just authorizations for use or disclosure of psychotherapy notes. This prohibition is intended to prevent covered entities from coercing individuals into signing an authorization for a use or disclosure that is not necessary to carry out the primary services that the covered entity provides to the individual....Health plans may not condition payment, eligibility, or enrollment on the receipt of an authorization for the use or disclosure of psychotherapy notes, even if the health plan intends to use the information for underwriting or payment purposes. It appears that enrollment, benefit and payment determinations may not be made contingent on a patient release of psychotherapy notes as defined in the Standards.
What do the Standards require? The Standards span hundreds of pages of fine print in the Federal Register. Suffice it to say there is no succinct answer to this question. The following appear to be the most obvious requirements. At a minimum, practitioners will need to:
- Create and document a compliance program and identify a person within the practice to handle complaints
- Create and display notices to inform clients of their rights
- Create and use consent and authorization forms and processes that comply with the standards.
By when must I comply as a practit ioner? Covered health care providers, health plans and health care clearinghouses must comply within 24 months of the effective date, or by 4/14/2003. Small health plans have 36 months to comply.
What if I fail to comply? The regulations have real teeth. The Office for Civil Rights has enforcement authority. This in itself is a fascinating aspect of the Standards. In a sense, citizens may now reasonably consider maintaining the privacy of their individually identifiable health information to be a federally enforceable civil right. Under HIPAA, non-criminal violations including improper disclosures may be subject to fines of $100 per violation up to $25,000 per year, per standard. Criminal penalties particularly for violations done knowingly may be subject to a $50,000 fine and one year in prison for obtaining or disclosing protect ing health information, up to $100,000 and five years in prison for obtaining or disclosing protected information under false pretenses, and up to $250,000 and 10 years in prison for obtaining protected information with the intent to use the information for co mmercial or personal gain or harm.
Where can I find more information? The Standards are available online in the web version of the 12/28/2000 Federal Register (Vol. 65, No. 250) in text or pdf format at http://www.access.gpo.gov/su_docs/fedreg/a001228c.html under the Health and Human Services heading.
The Office for Civil Rights at http://www.hhs.gov/ocr/hipaa/posts the regulations in pdf, html and rtf formats.
A wealth of information is available online at HIPAAdvisory at http://www.hipaadvisory.com/ including a very well indexed version of the Standards themselves at http://www.hipaadvisory.com/regs/standardsprivacyindividid/index.htm
In between the time the regulations were published 12/28/2000 and the official implementation date 4/14/2001, I made an effort to write a Privacy Notice as required by the regulations, as well as a possible format for a Session Note that appears to comply and excludes information that might otherwise be maintained in psychotherapy notes. The Privacy Notice may be viewed at http://www.mentalhealth-madison.com/PrivacyRegulations.htm and the Session Note is at http://www.mentalhealth-madison.com/SessionNote.pdf
Return to Managed Care Table of Contents (click here.)