Section 264 of HIPAA required the Secretary of Health and Human Services to implement national standards to protect the privacy of individually identifiable health information that was transmitted electronically. The final HIPAA regulation was published in the last minutes of the Clinton Administration on December 28, 2000. That rule was extensively amended in August of 2002 (with further amendments in 2003), and appears at final form at 45 C.F.R. Parts 160 and 164.
Under the final HIPAA rules at 45 C.F.R. § 164.502, covered entities, including health care providers, can disclose protected health information for treatment purposes without patient consent; 45 C.F.R. § 164.506(c) (1) and (2) permit both the use and disclosure of information for treatment purposes. The rules at 45 C.F.R. § 164.501 define treatment to mean:
… the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.
One exception to this general rule of permitting the sharing of treatment information without consent is that “psychotherapy notes” may only be disclosed with authorization (45 C.F.R. § 164.508(a)(2)) except insofar as they are used by the originator of the notes or for a covered entity’s supervised mental health education and training purposes. Psychotherapy notes are a special form of treatment information:
Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date (45 C.F.R. § 164.501).
Authorization is a special and rigorous form of consent, which must include a description of the information to be disclosed, the identity of the person or class of persons who may disclose the information and to whom it may be disclosed, a description of the purpose of the disclosure, an expiration date for the authorization, and the signature of the person au-