Health Information Compliance Alert

Reader Questions:

Manage Medical Privacy for Psychiatric Care

Question: Our facility is going to offer psychiatric services to certain residents with mental health issues or psychiatric diagnoses. These services will be provided by outside psychiatrists and psychiatric nurse practitioners and will include individual counseling and group therapy. Do we need to have more HIPAA privacy safeguards in related specifically to the psychiatric services? If so, what might they be?

North Carolina subscriber

Answer: As a first step, decide in consultation with the psychiatric professionals involved what records the facility will maintain and what records the psychiatric professional will maintain, advises Heather O. Berchem, an attorney with Murtha Cullina LLP, in New Haven, Conn.The distinction is important because the facility is responsible under HIPAA only for those records maintained by the facility. And the psychiatric professionals will be responsible for complying with HIPAA regarding records they maintain, she points out.

Important: If the facility will maintain any records of this type of treatment, it should consult state laws, Berchem advises. "Many states do have laws that provide more protection than HIPAA regarding certain types of psychiatric records," she notes. If state law does cover records maintained by the facility, it may specify additional requirements for releasing the records and wording that must accompany any such record when it is released, or other requirements, Berchem notes.

Also keep in mind that HIPAA itself provides special protection for psychotherapy notes. "For example, the authorization for release of psychotherapy notes cannot be combined with a general authorization for release of other types of records," says Berchem. "The HIPAA definition of 'psychotherapy notes,' however, is extremely limited and applies only to notes by a mental health professional documenting or analyzing the contents of conversation during a counseling session that are maintainedseparately from the medical record."

Know the exclusions: "'Psychotherapy notes under HIPAA do not include summaries of diagnoses, functional status, treatment plans, symptoms, prognosis or progress to date," Berchem instructs. And "usually long-term care facilities do not maintain 'psychotherapy notes' as defined under HIPAA."

The facility may want to consider credentialing the psychiatric care providers, Berchem says. "If theseproviders serve in roles other than direct treatment -- for example, serving as a member of a quality assurance, medical staff, or other committee or in a consulting capacity -- then the facility should enter into a HIPAA business associate agreement with the psychiatric professionals or group."

Other Articles in this issue of

Health Information Compliance Alert

View All