Understanding What HIPAA Means for Mental Illness

Apr 15, 2014

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that helps protect the privacy of individual health information. For individuals living with mental illness, this law is important, because it helps protect confidential mental health treatment records.

Over the years, however, there have been many misunderstandings about the type and range of information that mental health treatment providers are allowed to share with others. This often resulted in situations where family and friends of a person living with mental illness were unable to communicate with healthcare providers, often to the detriment of a loved one.

The federal Office of Civil Rights (OCR) at the Department of Health and Human Services (HHS) has enforcement authority over HIPAA. On Feb. 21, 2014, OCR released guidance clarifying how and when healthcare providers may share an individual’s mental health treatment information with others. Open communication between a mental health provider and family members or friends of a person living with mental illness can help make sure that the individual receives the best treatment and care possible. Below is a set of questions and answers to make sure you know what HIPAA means for you.

Can healthcare providers share mental health treatment information to family members and friends of a person living with mental illness?

Yes, healthcare providers may share information about treatment with a person’s family or friends if the person with mental illness does not object.

Are health care providers required to obtain a signed informed consent release before sharing information with family and friends?

No, citing the “integral role that family and friend’s play in a patient’s health care,” OCR’s guidance states that providers may ask for permission to share relevant information, may tell the person that they intend to discuss information and give him or her the chance to object, or may infer from the circumstances, using professional judgment, that the person does not object. For example, if a person receiving treatment invites a family member and friend to be present in a treatment situation, the provider may assume that the person does not object to disclosure of information.

What happens if the person living with mental illness objects to information sharing?

If the person receiving treatment is an adult, objects to the release of information, and is deemed capable of making healthcare decisions by the healthcare provider, then the healthcare provider may not share information with family or friends. If the healthcare provider determines that a person does not have the capacity to make healthcare decisions, then the provider may choose to share information with family, friends, or other individuals involved in the person’s care if the provider believes it is in the person’s best interest. A court order is not required for a determination that a person lacks capacity. Discretion lies with the treatment provider, based on professional judgment.  

How much information can the healthcare provider share with a person’s family members or friends?

Healthcare providers should exercise professional judgment and disclose only the information that is necessary or directly related to the family member or friend’s involvement in care. Psychotherapy notes—notes that are written by a provider during counseling sessions detailing specific conversations—are treated differently than other healthcare information because they may contain especially private or sensitive information. In most instances, a provider must have a patient’s permission before sharing information contained in psychotherapy notes.

May family members or friends communicate with a healthcare provider if they are worried about a person’s health or wellbeing?

Yes, family members or friends may share information that they believe might be relevant or helpful to a treatment provider. Healthcare providers are not required to disclose this communication to the individual receiving treatment.

Can healthcare providers share information with parents or guardians of children?

Generally speaking, yes, a healthcare provider may share treatment information with a parent, guardian, or an individual acting as a personal representative for a child.

At what age is a child considered an adult for the purposes of healthcare decisions?

Generally, age 18, but HIPAA defers to state law if a state has a different standard.

Are there any other restrictions on how and when a healthcare provider may share information with parents or guardians?

HIPAA establishes a floor for the privacy of health information. State laws that are more protective of privacy supersede HIPAA.  State laws vary and it is important to become familiar with the laws in your state.

In addition, there are some federal laws that may have additional restrictions on sharing treatment information with parents or guardians. For example, the federal confidentiality statute that applies to federally-funded drug and alcohol treatment programs has standards that are stricter than HIPAA.

Can healthcare providers share protected mental health information with law enforcement officials?

Yes, in certain circumstances, particularly if the person living with mental illness poses a danger to self or others, then healthcare providers may disclose necessary information.