thorizing the disclosure (45 C.F.R. § 164.508(c)). In general, the individual signing the authorization may revoke it at any time, a provider cannot condition treatment on the willingness of an individual to sign an authorization for the release of psychotherapy notes, and an authorization for the release of psychotherapy notes must be a separate and independent document (45 C.F.R. § 164.508(b) and (c)).
The HIPAA statute also provides that:
A regulation promulgated under paragraph (1) shall not supersede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation (42 U.S.C. § 1320d-2(c)(2)).
Accordingly, the HIPAA regulations provide that they preempt state laws that are less stringent than HIPAA, but they are in turn preempted by stricter state laws, which, in the context of information disclosure, are more protective of privacy (45 C.F.R. § 160.203(b)).
Some types of mental health records are also independently governed by the federal substance abuse treatment confidentiality law, 42 U.S.C. § 290dd-2. This statute provides:
Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, * * * be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b) of this section (42 U.S.C. § 290dd-2(a)).
The only statutory exception identified in subsection (b) relevant to treatment information is (b)(2)(A), which authorizes disclosure of information to medical personnel in a “bona fide medical emergency.” The regulations recognize further exceptions, however, insofar as they provide:
(3) … The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of