by Wyn Staheli, Director of Research
February 2nd, 2017
Of special interest to all behavioral health practitioners (both Covered Entities and NON-covered entities) is HIPAA's provision for psychotherapy notes. The privacy rule recognizes that psychotherapy notes need more protection than other types of PHI. Even if you are not a covered entity, we recommend understanding and implementing office procedures in regards to the psychotherapy notes provision. In order to qualify as psychotherapy notes, “the information must be separated from the rest of the individual's medical record.”
Psychotherapy notes are defined as “notes recorded (in any medium) by a health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session.” Some professionals refer to these types of notes as 'process notes' or 'personal notes.' The following items are excluded from the HIPAA definition of psychotherapy notes: “medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis and progress.”
It should be noted that there is no HIPAA definition of what is considered “separate.” This is where good clinical judgement determines the action taken. If the clinician feels that the patient’s information does not warrant the extra level of protection, simply having a distinctly separate section in the medical record would mostly likely be sufficient. However, if the information is considered highly sensitive, it would be best to keep those notes in a physically separate record in a different location than your general medical records to avoid any inadvertent disclosures.
Disclosure of psychotherapy notes requires specific “authorization” obtained from the client. According to HIPAA definitions, “authorization” is more than a general “consent.”
Individual authorization is NOT required for the following exemptions:
- the covered entity uses the notes for its own training, to defend itself in legal proceedings brought by the individual,
- for HHS to investigate or determine the covered entity’s compliance with the Privacy Rules,
- to avert a serious and imminent threat to public health or safety,
- to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, or
- for the lawful activities of a coroner or medical examiner or as required by law.
Note: Insurance plans cannot refuse reimbursement if the client does not sign an authorization for the release of psychotherapy notes.