How We Protect Your Information (HIPAA Policy)

The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996 to:

• Protect patients’ confidential health information;
• Allow American workers and their families to continue or transfer their health insurance coverage when they change jobs;
• Reduce healthcare fraud and abuse; and
• Create an industry-wide standard for healthcare billing and other processes.

HIPAA’s Privacy Rule creates national standards to protect patients’ individually identifiable health information, which it refers to as protected health information (PHI). PHI is any information that relates to:

1. the individual’s past, present, or future physical or mental health or condition;
2. The provision of healthcare to the individual; or
3. The past, present, or future payment of health care to the individual,

In other words, health information, if coupled with common identifiers such as the patient’s name, address, or birthdate, must remain private and in the confines of the clinic.

The Privacy Rule exists to create a trusting environment between patients and their caregivers. A clinician cannot disclose PHI unless the patient consents or an exception applies.

There may be times when health care providers are required to share mental and behavioral health information to enhance patient treatment and to ensure the health and safety of the patient or others. The Privacy Rule, added to this legislation in 2000, set further standards to prevent inappropriate use or disclosure of protected health information. Importantly, it also:

• Clarified when therapists and counselors were able to share treatment information with other care providers and a client’s family members.
• Made provisions to allow therapists and counselors to keep psychotherapy notes separate and confidential.

This is relevant for the mental health profession since privacy concerns may act as a barrier to many individuals who might otherwise seek help.

Therapists are allowed to discuss information that’s relevant to a person’s care with other members of their health care team. This wouldn’t include information from psychotherapy notes or any information about substance abuse treatment from a licensed treatment program.

It’s important to note that HIPAA requirements provide that a therapist (or other health care provider) must protect the information of the person they’re working with, but it’s always permitted for family members and loved ones to share information about a person’s mental health with the care provider.

Provisions under HIPAA allowing therapists to communicate certain information can help therapists, doctors, and family members collaborate on treatment, which can lead to improved, more supportive care.
It should be noted that under HIPAA, health care professions such as therapists may share pertinent information (information directly related to treatment) with people involved in a person’s care if the person in treatment:

• Has agreed.
• Has been given an opportunity to object and has not objected.
• Has indicated they don’t object by bringing a partner to treatment or having a parent help schedule sessions and pick up prescriptions.
• Is unconscious, delirious, experiencing psychosis, intoxicated, or otherwise incapable of making decisions.

In additional circumstances, HIPAA allows for the release of PHI. In these situations, rule-makers acknowledge that the benefits of releasing protected information may outweigh the drawbacks. Permitted disclosures include those that:

• Prevent imminent harm. A healthcare provider may release PHI as necessary to prevent a serious imminent threat to the health or safety of a person or the public. However, the provider should disclose the minimum amount of information necessary and only disclose PHI to someone capable of reducing the risk of harm, such as the target of the harm or law enforcement personnel.
• Facilitate treatment, payment, and healthcare operations. A provider can disclose PHI for treatment and payment. For example, a physician can discuss a patient’s treatment with other treatment team members or release PHI to train employees.
• Are required by law, including specific state regulations or court orders that mandate disclosure of PHI.