Constraints on Sharing Mental Health and Substance-Use Treatment Information Imposed by Federal and State Medical Records Privacy Laws
Timothy Stoltzfus Jost
The privacy regulations issued by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (Pub. L. No. 104-191) have had a tremendous impact on health care providers. One of the less studied aspects of this statute, however, is the constraints that exist on the sharing of treatment information among mental health treatment providers when it is applied in tandem with other state and federal medical records confidentiality laws. This paper examines the interaction between these bodies of law, reviewing the federal HIPAA regulations, state statutes that govern mental health medical records privacy, and the federal statute governing confidentiality of substance abuse records.
The study is based primarily on information regarding state privacy statutes obtained from the state law database of the Health Privacy Project, www.healthprivacy.org. In most instances, the information regarding state laws found in this database was confirmed and updated through state-specific Westlaw searches. Like the Health Privacy Project database, this study is limited to state statutes and does not include information on state administrative regulations, attorney general opinions, licensure board opinions, or court decisions, all of which might contain further information on medical records privacy. This report should not be seen, therefore, as a comprehensive legal analysis of all the issues raised by the law of each state. Rather it is intended to identify the major issues raised by the interaction between the laws of the various states and federal law.
THE HIPAA PRIVACY REGULATIONS
Section 264 of HIPAA required the Secretary of Health and Human Services to implement national standards to protect the privacy of individually identifiable health information that was transmitted electronically. The final HIPAA regulation was published in the last minutes of the Clinton Administration on December 28, 2000. That rule was extensively amended in August of 2002 (with further amendments in 2003), and appears at final form at 45 C.F.R. Parts 160 and 164.
Under the final HIPAA rules at 45 C.F.R. § 164.502, covered entities, including health care providers, can disclose protected health information for treatment purposes without patient consent; 45 C.F.R. § 164.506(c) (1) and (2) permit both the use and disclosure of information for treatment purposes. The rules at 45 C.F.R. § 164.501 define treatment to mean:
… the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.
One exception to this general rule of permitting the sharing of treatment information without consent is that “psychotherapy notes” may only be disclosed with authorization (45 C.F.R. § 164.508(a)(2)) except insofar as they are used by the originator of the notes or for a covered entity’s supervised mental health education and training purposes. Psychotherapy notes are a special form of treatment information:
Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date (45 C.F.R. § 164.501).
Authorization is a special and rigorous form of consent, which must include a description of the information to be disclosed, the identity of the person or class of persons who may disclose the information and to whom it may be disclosed, a description of the purpose of the disclosure, an expiration date for the authorization, and the signature of the person au-
thorizing the disclosure (45 C.F.R. § 164.508(c)). In general, the individual signing the authorization may revoke it at any time, a provider cannot condition treatment on the willingness of an individual to sign an authorization for the release of psychotherapy notes, and an authorization for the release of psychotherapy notes must be a separate and independent document (45 C.F.R. § 164.508(b) and (c)).
THE RELATIONSHIP BETWEEN FEDERAL AND STATE PRIVACY LAWS
The HIPAA statute also provides that:
A regulation promulgated under paragraph (1) shall not supersede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation (42 U.S.C. § 1320d-2(c)(2)).
Accordingly, the HIPAA regulations provide that they preempt state laws that are less stringent than HIPAA, but they are in turn preempted by stricter state laws, which, in the context of information disclosure, are more protective of privacy (45 C.F.R. § 160.203(b)).
Some types of mental health records are also independently governed by the federal substance abuse treatment confidentiality law, 42 U.S.C. § 290dd-2. This statute provides:
Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, * * * be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b) of this section (42 U.S.C. § 290dd-2(a)).
The only statutory exception identified in subsection (b) relevant to treatment information is (b)(2)(A), which authorizes disclosure of information to medical personnel in a “bona fide medical emergency.” The regulations recognize further exceptions, however, insofar as they provide:
(3) … The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of
the provision of diagnosis, treatment, or referral for treatment of alcohol or drug abuse if the communications are
(I) Within a program or
(ii) Between a program and an entity that has direct administrative control over the program (42 C.F.R. § 2.12(c)(3)).
The regulations also provide:
(4) … The restrictions on disclosure in these regulations do not apply to communications between a program and a qualified service organization of information needed by the organization to provide services to the program (42 C.F.R. § 2.12(c)(4)).
“Qualified service organizations” are defined to include organizations that provide support services such as billing and data processing, but the definition seems broad enough to include some consultations. Information can also be disclosed with patient consent (42 C.F.R. § 2.33).
With respect to preemption of state law, the substance abuse regulations state at § 2.20:
The statutes authorizing these regulations do not preempt the field of law which they cover to the exclusion of all State laws in that field. If a disclosure permitted under these regulations is prohibited under State law, neither these regulations nor the authorizing statutes may be construed to authorize any violation of that State law. However, no State law may either authorize or compel any disclosure prohibited by these regulations.
Though the HIPPA privacy regulations do not expressly address their relationship to the substance abuse confidentiality laws, the preamble to the privacy regulations recognizes the constraints of the substance abuse confidentiality law. It states that (1) in general the privacy law and substance abuse law do not conflict, and (2) wherever one is more protective of privacy than the other, the more restrictive should govern (65 Fed. Reg. 82462, 82482–82483).
The HIPPA regulations permit broad sharing of treatment information without consent.
However, the HIPPA regulations only permit sharing of psychotherapy notes with authorization.
Moreover, the substance abuse confidentiality law does not permit sharing of records relating to substance abuse treatment or rehabilitation organizations conducted, regulated, or funded by the federal government,
without consent, except within a program or with an entity with administrative control over a program.
Whenever a state law is more protective of privacy than either the federal HIPAA regulations or the federal substance abuse confidentiality statute and regulations, the state law governs.
STATE MEDICAL RECORDS CONFIDENTIALITY LAWS
To understand the actual effect of the HIPAA regulations or federal substance abuse statute or regulations, therefore, one must understand state law. Each of the 50 states (and the District of Columbia) has a number of statutes governing medical record confidentiality. In particular, each has statutes specifically governing some aspect of mental health records, and most have laws governing substance abuse records. The coverage and requirements of these laws vary widely, however.
A number of states have comprehensive medical record statutes that attempt to govern all issues pertaining to medical record confidentiality, much like HIPAA. California is one such state (see Cal. Civil Code D. 1, Part 2.6), although California also has a special statute governing the records of patients in mental facilities (Calif. Welf. and Inst. Code § 5328) and also specifically prohibits the release of information by psychotherapists specifically relating to “the patient’s participation in outpatient treatment.” Montana has a general health care records statute, which permits disclosure of health information “to a person who is providing health care to the patient” (Mont. Code Ann. § 50-16-529). New York’s general medical records statute (N.Y. Pub. Health L. § 18(6)) permits disclosure of general medical records to “practitioners or other personnel employed by or under contract with the facility.” Virginia has a general law governing the records of all providers and practitioners. Va. Code Ann. § 32.1-127:03(D) permits disclosure of information when necessary for the care of a patient. Finally, Washington has a comprehensive statute, which permits disclosure “(a) to a person who the provider reasonably believes is providing health care to the patient” (Wash. Rev. Code Ann. § 70.02.050(1)(a)).
STATE LAWS GOVERNING MENTAL HEALTH RECORDS
It is more common for a state to have several specific statutes governing different types of medical records and information. Every state has some form of legislation governing mental health records. These generally take four forms. First, many states have laws governing the records of patients in state mental hospitals or mental health programs. These are in some instances part of general statutes governing state health records (See Idaho
Code § 9-340C(8) and (13)) and are sometimes specific to mental hospitals (see N.Y. Mental Hygiene Law 33.13; N.C. Gen. Stat. § 122C-55).
Second, a number of states have laws governing the records of specific mental health practitioners, most commonly psychologists, social workers, and counselors. Colo. Rev. Stat. Ann. § 12-43-218, for example, requires patient consent for any disclosure by a psychologist or psychotherapist, with no treatment exception. Massachusetts law (Mass. Gen. Laws. ch. 112 § 129A) provides that the records of psychologists are confidential, and makes no exception for sharing of information for treatment. Missouri law (Mo. Rev. Stat. § 337.636) contains similar provisions governing psychologists, social workers, and professional counselors, as does Wyoming (Wyo. Stat. Ann. § 33-38-109). Nebraska law imposes an absolute obligation of confidentiality on “mental health practitioners,” but allows the Board of Mental Health Practice to define regulatory exceptions (Neb. Rev. Stat. § 71-1,335(1)). New Mexico law also seems to impose an absolute obligation of confidentiality on any “counselor and therapist practitioner” (N.M. Stat. Ann. § 61-9A27). Utah law permits disclosures “made under a generally recognized professional or ethical standard that authorizes or requires the disclosure” (Utah Code. Ann. 58-61-602(2)(c)). The obligations imposed by these laws may pose the most substantial threat to the broad sharing of treatment information contemplated by HIPAA.
Third, a number of states have specific statutes governing the records of patients who are involuntarily committed to mental institutions (see Idaho Code § 66-348; Neb. Rev. Stat. § 71-961; Wash. Rev. Code Ann. § 71.05.390). These statutes recognize, presumably, that patients who are involuntarily committed to institutions might have a special claim to privacy, though these laws also usually make provision for the use of records in the commitment process. The Tennessee Code, for example, has a special provision for sharing of information for mandatory outpatient treatment in section 33-6-601:
If (1) a person with mental illness or serious emotional disturbance was committed involuntarily under chapter 6, part 5 of this title, AND (2) the hospital staff determines preliminarily that: (A) the person will need to participate in outpatient treatment on discharge, and (B) there is a likelihood that the discharge will be subject to the outpatient treatment obligation of this part, AND (3) the person refuses to give consent to disclose information which is legally confidential under this title to the proposed outpatient qualified mental health professional, THEN (4) the hospital and qualified mental health professional may exchange information as necessary to carry out this part.
Fourth and finally, most states have statutes that generally govern the records of all mental patients. The Alabama Code, §§ 22-56-4(b)(6) and
22-56-10, provides that mental patients have rights to privacy, but not beyond the rights of other patients. Louisiana law provides that mental patients may not be deprived of their right to privacy, whatever that means (La. Rev. Stat. Ann. § 28.171(A)). The treatment exceptions discussed below are all found in such general mental health confidentiality statutes.
STATE LAWS GOVERNING THE CONFIDENTIALITY OF SUBSTANCE ABUSE RECORDS
Most states also have statutes governing substance abuse records. These in general roughly approximate the federal statute in their terms (see Cal. Health & Safety Code, § 11845.5; Fla. Stat. Ann. § 397.501(7)) and sometimes specifically refer to federal law (e.g., Mass. Gen. Laws. ch. 111E § 18). They may govern facilities not governed by the federal law (because the facilities receive no federal funding) but may also lack the flexibility found in the federal regulations. Some states have specific laws governing substance abuse counselors as a licensed profession and forbid disclosure of records without consent, with no treatment exception (e.g., La. Rev. Stat. Ann. § 37:3390.4).
Several states, on the other hand, permit broader disclosure of substance abuse information than does the federal law. Kansas law provides that disclosure of substance abuse records can be made “upon the sole consent of the head of the treatment facility who has the records if the head of the treatment facility makes a written determination that such disclosure is necessary for the treatment of the patient or former patient” (Kan. Stat. Ann. § 59-2979). Mississippi law (Miss. Code. Ann. § 41-30-33) provides for disclosure without consent “to treatment personnel for use in connection with his treatment.” New Hampshire law (N.H. Rev. Stat. Ann. § 172:8-a) provides confidentiality for substance abuse records, but also says they may be used for a rehabilitation or medical purpose without consent. These provisions would presumably be preempted as to facilities governed by the federal statute.
Some state substance abuse statutes, on the other hand, seem to be more narrow. Pennsylvania law, for example, only authorizes disclosure of substance abuse information to medical personnel with consent (see Pa. Cons. Stat. Ann. tit. 71 § 1690.108). Michigan law (Mich. Comp. Laws § 333.6112) only provides disclosure of substance abuse records for treatment with the consent of the patient. New Jersey, on the other hand (N.J. Stat. Ann. § 26:2B-20), only permits disclosure with a court order. Missouri has a special law (Mo. Rev. Stat. § 191.731) governing substance abuse treatment for pregnant women that promises absolute confidentiality.
INFORMATION SHARING FOR TREATMENT PURPOSES UNDER STATE LAW AND HIPAA
A few state records statutes have no exception to a general confidentiality obligation for sharing records for treatment and only allow it with consent (see Fla. Stat. Ann. § 394.4615 and Wash Rev. Code Ann. § 71.05.630). Michigan law (Mich. Comp. Laws. § 330.1748) provides for disclosure only with consent outside of a treating facility.
Most state laws governing medical records or mental health records, however, make some provision for sharing of information for treatment purposes. The wording of these statutes varies from state to state. Some are quite limited, only permitting sharing within a single facility or among state treatment programs. See 740 Ill. Comp. Stat. § 110/8–110/12.2. The Delaware mental health statute allows disclosure of treatment information to “Departmental contractors to the extent necessary for professional consultation or services” (Del. Code. Ann. tit. 16, § 5161(13)(f)). The District of Columbia mental health law is even more restrictive, only allowing disclosure to other employees within a facility or to participating providers in the organized mental health system, and then only “when and to the extent necessary to facilitate the delivery of professional services to the client” (D.C. Code § 7-1203.01). Some states permit disclosure of mental health information for treatment without consent only in an emergency. Iowa law provides that “mental health information may be transferred at any time to another facility, physician, or mental health professional in cases of a medical emergency or if the individual or the individual’s legal representative requests the transfer in writing for the purposes of receipt of medical or mental health professional services” (see Iowa Code § 228.2(3)). The Kansas statute allows for disclosure of mental health records in an emergency, as well as for “communication and information between or among treatment facilities regarding a proposed patient, patient or former patient for purposes of promoting continuity of care between the state psychiatric hospitals and the community mental health centers” (Kan. Stat. Ann. § 65-5603(5) and (13)). Nebraska law provides for disclosure of mental health records to “the department, * * * and any public or private agency under contract to provide facilities, programs, and patient services” (Neb. Rev. Stat. § 83-109(1)).
Ohio permits disclosure for treatment only of limited mental health information and then only to a limited group of providers:
Hospitals and other institutions and facilities within the department of mental health may exchange psychiatric records and other pertinent information with other hospitals, institutions, and facilities of the department, and with community mental health agencies and boards of alcohol, drug addiction, and mental health services with which the department has a
current agreement for patient care or services. Records and information that may be released pursuant to this division shall be limited to medication history, physical health status and history, financial status, summary of course of treatment in the hospital, summary of treatment needs, and a discharge summary, if any (Ohio Rev. Code Ann. § 5122.31(c)).
The South Carolina statute permits exchange of mental health information among facility staff, but only “on a need to know basis” (S.C. Code Ann. § 44-22-90(A)(1)). South Carolina also permits mental health providers to disclose “in the course of diagnosis, counseling, or treatment, confidences necessary to promote care within the generally recognized and accepted standards, practices, and procedures of the provider’s profession” (S.C. Code Ann. § 19-11-95(c)(5)). Texas law only permits the disclosure of information by mental health professionals “to other professionals and personnel under the professionals” direction who participate in the diagnosis, evaluation, or treatment of the patient” (Tex. Health and Safety Code § 611.004(a)(7)). The Illinois statute permits disclosure of therapists records to “the therapist’s supervisor, a consulting therapist, members of a staff team participating in the provision of services, a record custodian, or a person acting under the supervision and control of the therapist” (740 Ill. Comp. Stat. § 110/9(1)). The California mental health law requires that “the consent of the patient, or his or her guardian or conservator shall be obtained before information or records may be disclosed by a professional person employed by a facility to a professional person not employed by the facility who does not have the medical or psychological responsibility for the patient’s care” (Cal. Welf. and Inst. Code § 5328(a)). Finally, the Oklahoma statute provides that mental health information “shall only be available to persons actively engaged in the treatment of the patient or in related administrative work. The information available to persons actively engaged in the treatment of the consumer or in related administrative work shall be limited to the minimum amount of information necessary for the person or agency to carry out its function” (Okla. Stat. tit. 43A § 109(A)(2)).
Other statutes are more broadly worded. The Alaska Code, for example, allows sharing of the records of mental patients with “a physician or a provider of health, mental health, or social and welfare services involved in caring for, treating, or rehabilitating the patient” (Alaska Stat. § 47.30.845(1)). The Arizona statute similarly permits disclosure of mental health records to “physicians and providers of health, mental health or social and welfare services involved in caring for, treating or rehabilitating the patient” (Ariz. Rev. Stat. § 36-509). The Colorado mental health statue allows disclosure “in communications between qualified professional personnel in the provision of services or appropriate referrals” (Colo. Rev. Stat. Ann. § 27-10-120(1)(a)). Indiana law permits disclosure of mental health records to indi-
viduals who “(A) are employed by: (i) the provider at the same facility or agency; (ii) a managed care provider * * *; or (iii) a health care provider or mental health care provider, if the mental health records are needed to provide health care or mental health services to the patient.” and “(B) are involved in the planning, provision, and monitoring of services” (Indiana Code § 16-39-2-6). The Minnesota statute, which governs health records generally, provides for disclosure “to other providers within related health care entities when necessary for the current treatment of the patient” (Minn. Stat. Ann. § 144.335 (3a)(b)(2)).
Mississippi provides for disclosure “when necessary for the continued treatment of a patient” (Miss. Code Ann. § 41-21-97). Missouri law provides for disclosure without consent “to persons or agencies responsible for providing health care services to such patients, residents or clients” (Mo. Rev. Stat. § 630.140(3)(2)). Montana law provides for disclosure of records pertaining to “the seriously mentally ill” “in communications between qualified professionals in the provision of services or appropriate referrals” (Mont. Code Ann. 53-21-166(1)). New Jersey law (N.J. Stat. Ann. § 30:4-24.3) provides that the confidentiality requirements that apply in state mental health facilities do not prohibit “the professional staff of a community agency under contract with the Division of Mental Health Services in the Department of Human Services, or of a screening service, short-term care or psychiatric facility * * * from disclosing information that is relevant to a patient’s current treatment to the staff of another such agency.” The New York Mental Hygiene Code, § 33.16(a)(1) permits disclosure to “practitioners as part of a consultation or referral during the treatment of the patient or client.”
The Pennsylvania mental health statute (50 Pa. Cons. Stat. Ann. § 7111) permits disclosure to “those providing treatment to the person.” The Rhode Island statute (R.I. Gen. Laws. § 40.1-5-26(b)(2)), on the other hand, permits disclosure “in communications among qualified medical or mental health professionals in the provision of services or appropriate referrals”(though Rhode Island only permits disclosure of mental health treatment in community residences within the same residence (R.I. Gen. Laws § 40.1-24.5-11). Vermont goes even further, allowing for disclosure of information, “upon proper inquiry to the patient’s family, clergy, physician or health care agent” (Vt. Stat. Ann. tit 18 § 7103). Finally, Washington permits disclosure of mental health records:
(e) To qualified staff members of the department, to the director of regional support networks, to resource management services responsible for serving a patient, or to service providers designated by resource management services as necessary to determine the progress and adequacy of treatment and to determine whether the person should be transferred to a
less restrictive or more appropriate treatment modality or facility. The information shall remain confidential.
(f) Within the treatment facility where the patient is receiving treatment, confidential information may be disclosed to individuals employed, serving in bona fide training programs, or participating in supervised volunteer programs, at the facility when it is necessary to perform their duties.
(g) Within the department as necessary to coordinate treatment for mental illness, developmental disabilities, alcoholism, or drug abuse of individuals who are under the supervision of the department.
(h) To a licensed physician who has determined that the life or health of the individual is in danger and that treatment without the information contained in the treatment records could be injurious to the patient’s health. Disclosure shall be limited to the portions of the records necessary to meet the medical emergency.
(i) To a facility that is to receive an individual who is involuntarily committed * * * or upon transfer of the individual from one treatment facility to another. The release of records under this subsection shall be limited to the treatment records required by law, a record or summary of all somatic treatments, and a discharge summary. The discharge summary may include a statement of the patient’s problem, the treatment goals, the type of treatment which has been provided, and recommendation for future treatment, but may not include the patient’s complete treatment record (Wash. Rev. Code Ann. § 71.05.630).
The North Carolina mental health statute is one of the most comprehensive statutes, providing over a dozen different contexts in which information regarding mental patients may be disclosed (N.C. Gen. Stat. Ann. § 122C-55). It is too complex to summarize here and is attached as an appendix. The Wisconsin statute (Wis. Stat. Ann. § 51.30), not reproduced here, is nearly as complex.
A number of states require some sort of special determination before records can be released to other treatment providers. The Georgia mental health code, for example, states: “When the chief medical officer of the facility where the record is kept deems it essential for continued treatment, a copy of the record or parts thereof may be released to physicians or psychologists when and as necessary for the treatment of the patient” (Ga. Code Ann. § 37-3-166(a)(1)). The Hawaii statute similarly provides for disclosure as it “may be deemed necessary by the director of health or by the administrator of a private psychiatric or special treatment facility to carry out this chapter” (Haw. Rev. Stat. § 334-5. See, similarly, N.D. Cent. Code § 25-03.1-43). The Maryland law provides for disclosure without consent:
(I) To the medical or mental health director of a juvenile or adult detention or correctional facility if: 1. The recipient has been involuntarily
committed under State law or a court order to the detention or correctional facility requesting the medical record; and 2. After a review of the medical record, the health care provider who is the custodian of the record is satisfied that disclosure is necessary for the proper care and treatment of the recipient (Md. Code Ann. § 40-307(j)).
Nevada law permits disclosure “to a qualified member of the staff of a division facility, an employee of the Division * * *, when the Administrator deems it necessary for the proper care of the client” (Nev. Rev. Stat. § 433A.360). Nevada law (Nev. Rev. Stat. § 433.482(8)) also provides that a patient may refuse access to his records to persons without a court order or authorization who are not members of facility staff, and permits the sealing of clinical records of patients who are released from a mental health facility as recovered (Nev. Rev. Stat. §§ 433A.703, 433A.711). The Nevada statute further provides, however, “if, after the sealing of the records, the petitioner is being treated by a physician or licensed psychologist, the physician or psychologist may obtain a copy of the petitioner’s records from the hospital or facility. Any records so obtained must be used solely for the treatment of the petitioner” (Nev. Rev. Stat. § 433A.711).
At least one state has a provision for obtaining, as opposed to disclosing, the medical records of mental patients. N.H. Rev. Stat. Ann. § 135-C:19-a(II) provides:
when the medical director or designee determines that obtaining information is essential to the care or treatment of a person admitted pursuant to [the mental health commitment statute] a designated receiving facility may request, and any health care provider which previously provided services to any person involuntarily admitted to the facility may provide, information about such person limited to medications prescribed, known medication allergies or other information essential to the medical or psychiatric care of the person admitted. Prior to requesting such information the facility shall in writing request the person’s consent for such request for information. If the consent cannot be obtained, the facility shall inform the person in writing of the care providers who have been requested to provide information to the facility pursuant to this section. The facility may disclose such information as is necessary to identify the person and the facility which is requesting the information.
Several states provide for the transfer of mental health records with a patient. Nevada law provides that when a patient is transferred from a public medical facility, the patient’s records must be forwarded to the new facility (Nev. Rev. Stat. §§ 449.705, 433.332). Oregon and Pennsylvania have similar laws (see Or. Rev. Stat. § 179.505(6); Pa. Cons. Stat. Ann. tit. 50, § 4602). Tenn. Code Ann. § 33-3-105 provides for disclosure if “a
service recipient moves from one service provider to another and exchange of information is necessary for continuity of service.”
New Mexico provides that mental health records can be disclosed without authorization: (1) when the request is from a mental health or developmental disability professional or from an employee or trainee working with mentally disordered or developmentally disabled persons, to the extent their practice, employment or training on behalf of the client requires that they have access to such information; … and (3) when the disclosure of such information is to the primary caregiver of the client and the disclosure is only of information necessary for the continuity of the client’s treatment in the judgment of the treating physician or certified psychologist who discloses the information (N. M. Stat. Ann. § 43-1-19). See also N.M. Stat. Ann. § 32A-6-15 (making similar provision for child patients).
At least one state permits disclosure for treatment but requires that the patient be notified of the disclosure (Conn. Gen. Stat. § 52-146f). Several others require that an accounting be kept of disclosures (see, e.g., Wash. Rev. Code Ann. § 71.05.420).
Finally, some state statutes contain exceptions that do not clearly cover treatment, but may be construed to do so in some situations. Ky. Rev. Stat. Ann. § 210.235(2), for example, allows disclosure as “necessary to carry out the provisions for the Kentucky Revised Statutes, and the rules and regulations of cabinets and agencies of the Commonwealth of Kentucky.” Maine law provides for disclosure of information by the Department of Mental Health “to carry out any of the statutory functions of the Department” (Me. Rev. Stat. Ann. tit. 34B § 1207(1)(B)).
In sum, state laws vary widely in terms of authorizing the disclosure of mental health records without consent for treatment purposes. Many of them are, or could be interpreted as being, more restrictive than the HIPAA regulations. A few may even be more restrictive than the substance abuse confidentiality statute. These laws could in many cases stand in the way of coordinated treatment of persons with mental illness. This is an issue that the Department of Health and Human Services should consider in any revision of the HIPAA privacy regulations. State legislatures should also review their state statutes to assure that a proper balance is reached between the need for keeping mental health records confidential, on the one hand, and the need to share information among treatment providers to assure proper treatment on the other.
Appendix: NORTH CAROLINA GENERAL STAT. ANN. § 122C-55
(a) Any area or State facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill may share confidential information regarding any client of that facility with any other area or State facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill when necessary to coordinate appropriate and effective care, treatment or habilitation of the client. For the purposes of this subsection, coordinate means the provision, coordination, or management of mental health, developmental disabilities, and substance abuse services and related services by one or more facilities and includes the referral of a client from one facility to another.
(a1) Any State or area facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill may share confidential information regarding any client of that facility with the Secretary, and the Secretary may share confidential information regarding any client with an area or State facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill when the responsible professional or the Secretary determines that disclosure is necessary to coordinate appropriate and effective care, treatment or habilitation of the client.
(a2) Any area or State facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill may share confidential information regarding any client of that facility with any other area facility or State facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill when necessary to conduct payment activities relating to an individual served by the facility. Payment activities are activities undertaken by a facility to obtain or provide reimbursement for the provision of services and may include, but are not limited to, determinations of eligibility or coverage, coordination of benefits, determinations of cost-sharing amounts, claims management, claims processing, claims adjudication, claims appeals, billing and collection activities, medical necessity reviews, utilization management and review, precertification and preauthorization of services, concurrent and retrospective review of services, and appeals related to utilization management and review.
(a3) Whenever there is reason to believe that a client is eligible for benefits through a Department program, any State or area facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill may share confidential information regarding any client of that facility with the Secretary, and the Secretary may share confidential information regarding any client with an area facility or State facility or the psychiatric services of the University of North Carolina Hospitals at Chapel Hill. Disclosure is limited to that information necessary to establish initial eligibility for benefits, determine continued eligibility over time, and obtain reimbursement for the costs of services provided to the client.
(a4) An area authority or county program may share confidential information regarding any client with any area facility, and any area facility may share confidential information regarding any client of that facility with the area authority or county program, when the area authority or county program determines the disclosure is necessary to develop, manage, monitor, or evaluate the area authority’s or county program’s network of qualified providers as provided in G.S. 122C-115.2(b)(1)b., G.S. 122C-141(a), the State Plan, and rules of the Secretary. For the purposes of this subsection, the purposes or activities for which confidential information may be disclosed include, but are not limited to, quality assessment and improvement activities, provider accreditation and staff credentialing, developing contracts and negotiating rates, investigating and responding to client grievances and complaints, evaluating practitioner and provider performance, auditing functions, on-site monitoring, conducting consumer satisfaction studies, and collecting and analyzing performance data.
(a5) Any area facility may share confidential information with any other area facility regarding an applicant when necessary to determine whether the applicant is eligible for area facility services. For the purpose of this subsection, the “term applicant” means an individual who contacts an area facility for services.
(b) A facility, physician, or other individual responsible for evaluation, management, supervision, or treatment of respondents examined or committed for outpatient treatment under the provisions of Article 5 of this Chapter may request, receive, and disclose confidential information to the extent necessary to enable them to fulfill their responsibilities.
(c) A facility may furnish confidential information in its possession to the Department of Correction when requested by that department regarding any client of that facility when the inmate has been determined by the Department of Correction to be in need of treatment for mental illness, developmental disabilities, or substance abuse. The Department of Correction may furnish to a facility confidential information in its possession about treatment for mental illness, developmental disabilities, or substance abuse that the Department of Correction has provided to any present or former inmate if the inmate is presently seeking treatment from the requesting facility or if the inmate has been involuntarily committed to the requesting facility for inpatient or outpatient treatment. Under the circumstances described in this subsection, the consent of the client or inmate shall not be required in order for this information to be furnished and the information shall be furnished despite objection by the client or inmate. Confidential information disclosed pursuant to this subsection is restricted from further disclosure.
(d) A responsible professional may disclose confidential information when in his opinion there is an imminent danger to the health or safety of the client or another individual or there is a likelihood of the commission of a felony or violent misdemeanor.
(e) A responsible professional may exchange confidential information with a physician or other health care provider who is providing emergency medical services to a client. Disclosure of the information is limited to that necessary to meet the emergency as determined by the responsible professional.
(e1) A State facility may furnish client identifying information to the Department for the purpose of maintaining an index of clients served in State facilities which may be used by State facilities only if that information is necessary for the appropriate and effective evaluation, care and treatment of the client.
(e2) A responsible professional may disclose an advance instruction for mental health treatment or confidential information from an advance instruction to a physician, psychologist, or other qualified professional when the responsible professional determines that disclosure is necessary to give effect to or provide treatment in accordance with the advance instruction.
(f) A facility may disclose confidential information to a provider of support services whenever the facility has entered into a written agreement with a person to provide support services and the agreement includes a provision in which the provider of support services acknowledges that in receiving, storing, processing, or otherwise dealing with any confidential information, he will safeguard and not further disclose the information.
(g) Whenever there is reason to believe that the client is eligible for financial benefits through a governmental agency, a facility may disclose confidential information to State, local, or federal government agencies. Except as provided in G.S. 122C-55(a3), disclosure is limited to that confidential information necessary to establish financial benefits for a client. After establishment of these benefits, the consent of the client or his legally responsible person is required for further release of confidential information under this subsection.
(h) Within a facility, employees, students, consultants or volunteers involved in the care, treatment, or habilitation of a client may exchange confidential information as needed for the purpose of carrying out their responsibility in serving the client.
(i) Upon specific request, a responsible professional may release confidential information to a physician or psychologist who referred the client to the facility.
(j) Upon request of the next of kin or other family member who has a legitimate role in the therapeutic services offered, or other person designated by the client or his legally responsible person, the responsible professional shall provide the next of kin or other family member or the designee with notification of the client’s diagnosis, the prognosis, the medications prescribed, the dosage of the medications prescribed, the side effects of the medications prescribed, if any, and the progress of the client, provided that the client or his legally responsible person has consented in writing, or the client has consented orally in the presence of a witness selected by the client, prior to the release of this information. Both the client’s or the legally responsible person’s consent and the release of this information shall be documented in the client’s medical record. This consent shall be valid for a specified length of time only and is subject to revocation by the consenting individual.
(k) Notwithstanding the provisions of G.S. 122C-53(b) or G.S. 122C-206, upon request of the next of kin or other family member who has a legitimate role in the therapeutic services offered, or other person designated by the client or his legally responsible person, the responsible professional shall provide the next of kin, or family member, or the designee, notification of the client’s admission to the facility, transfer to another facility, decision to leave the facility against medical advice, discharge from the facility, and referrals and appointment information for treatment after discharge, after notification to the client that this information has been requested.
(l) In response to a written request of the next of kin or other family member who has a legitimate role in the therapeutic services offered, or other person designated by the client, for additional information not provided for in subsections (j) and (k) of this section, and when such written request identifies the intended use for this information, the responsible professional shall, in a timely manner:
(1) Provide the information requested based upon the responsible professional’s determination that providing this information will be to the client’s therapeutic benefit, and provided that the client or his legally responsible person has consented in writing to the release of the information requested; or
(2) Refuse to provide the information requested based upon the responsible professional’s determination that providing this information will be detrimental to the therapeutic relationship between client and professional; or
(3) Refuse to provide the information requested based upon the responsible professional’s determination that the next of kin or family member or designee does not have a legitimate need for the information requested.
(m) The Commission for Mental Health, Developmental Disabilities, and Substance Abuse Services shall adopt rules specifically to define the legitimate role referred to in subsections (j), (k), and (l) of this section.