Providers beware: HHS guidance for release of mental health information may be preempted by more protective state laws



February 28, 2014

HIPAA Alert

Author(s): Laurie T. Cohen

The U.S. Department of Health and Human Services (HHS) recently released guidance explaining how mental health information is protected by the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the circumstances under which health care providers are permitted to communicate this information with patients’ family members, friends or others involved in a patient’s care.

The guidance responds to frequently asked questions regarding disclosure of a patient’s mental health information, including topics such as access to psychotherapy notes, disclosures to parents of minor patients, disclosures on behalf of incapacitated patients, communication with family and friends if the patient fails to adhere to medication or other therapy and disclosures permitted under the “duty to warn” exception when a patient makes threats of serious and imminent harm. With the exception of psychotherapy notes, which are afforded extra protections due to their highly sensitive nature, the federal HIPAA Privacy Rule does not distinguish between different types of protected health information.

Providers are strongly encouraged to review applicable state privacy laws prior to relying upon the guidance issued by HHS, as in many cases, state health information laws are often more stringent and, therefore, may preempt federal regulations. Specifically, HIPAA provides that if state law imposes requirements that are more stringent than the HIPAA regulations for uses and disclosures of health information, then the state law applies and must be followed.

In total, 46 states and the District of Columbia have a mental health treatment records confidentiality statute. However, many states have laws that only govern the records in state mental hospitals and programs, while others have laws that govern the records of specific mental health practitioners, such as psychologists and social workers. Finally, there are some states that have laws that govern records of patients specifically committed to mental institutions. Each state law must be consulted by the health care provider to assure compliance before sharing mental health information with family members or other third parties.

The spectrum of applicable state laws range from very strict to none at all. An example of one of the more stringent health information disclosure laws is the Hawaii statute, Haw. Rev. Stat. § 334-5, where “all certificates, applications, records, and reports” of mental health treatment that “directly or indirectly identify a person,” must be “kept confidential and shall not be disclosed by any person.” This statute permits consent to disclose these records only by “the person identified or the person’s legal guardian,” the director or administrator of a psychiatric or special treatment facility, or by court order, in accordance with the federal Protection and Advocacy for Mentally Ill Individuals Act of 1986. This applies to all hospitals, nursing homes, community facilities for mentally ill individuals, boarding homes and care homes.

It is important for health care organizations and providers to be mindful of federal and state protections for all health information, particularly sensitive mental health information. Health care organizations and providers must ensure they comply with state-specific requirements before implementing use and disclosure policies related to mental health treatment records.

The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

Back to top