The disclosure of mental health records and other disclosure-related issues tends to be less than clear for providers in their efforts to comply with the federal privacy rules. Such issues relate to appropriate disclosures to patients’ friends and family; disclosures of mental health treatment of minors and adults; and appropriate disclosures to law enforcement officials. Some helpful guidance in that regard was issued on February 20, 2014, by the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS).

HHS confirmed that providers are permitted to share information with a patient’s family, friends or others involved in the patient’s care, including mental health care. In doing so, HHS reminds health care providers that they have significant discretion to exercise professional judgment in determining the best interests of the patient. Health care providers may communicate with those involved with the patient’s care when:

• The patient has capacity to consent, is competent and has authorized the communication to family or friends.
• The patient is incapacitated or not present, or the health care provider determines the patient does not have the capacity to consent, e.g., patients under the influence of drugs or alcohol, in which case the provider may exercise professional judgment in determining that such communication (typically family or friends) is in the best interests of the patient. This includes a situation where a patient has stopped taking his/her medication and a provider determines that such action puts the patient’s health and safety at risk.
• The patient is a minor and the individual requesting the information is the child’s parent, unless: state law does not require parental consent for the health care service at issue; someone other than the parent is authorized as the patient’s representative; or the parent has agreed to a confidential relationship between the patient and health care provider. State laws govern in matters related to parental authority, including when such authority terminates, i.e., the age of majority. If state law is silent, a provider or covered entity has discretion is deciding whether to disclose information to a parent.
• The provider exercises his or her professional judgment and determines that disclosure of information including mental health information and psychotherapy notes (see below) is necessary to address the patient’s serious risk of harm to self or others, regardless of whether the patient provided consent or not, and/or to comply with applicable “duty to warn” laws. Under such circumstances, disclosures may be made to law enforcement officials.
• Law enforcement is trying to locate a fugitive. A provider may disclose admission/discharge date and certain demographic information about the fugitive but not any information related to DNA, dental records, typing, samples or analysis of body fluids or tissue. Providers also have discretion in responding to an administrative request, if safeguards are in place, and court orders, warrants and subpoenas, as such are permitted as under the “required by law” exception.
• In the event HIPAA applies to health information in the school setting as opposed to the Family Educational Rights and Privacy Act (FERPA), providers may disclose information to parents of minors or law enforcement in situations such as a perceived threat of serious or imminent harm to the patient or others.

In all of the situations described here, state law must be consulted. If a state imposes stricter protections of an individual’s information, such restrictions will trump the more lenient provisions in HIPAA.

While HIPAA does provide additional protection for mental health information, in that patients must authorize disclosure of such information for any reason, we are reminded how narrowly the protection is applied as it only relates to psychotherapy notes. Psychotherapy notes are notes recorded by a provider in the course of a private counseling session, whether it is an individual or group session, and which are separate from the remainder of the patient’s medical record. 45 C.F.R. 164.501. In addition, with respect to a minor patient’s psychotherapy notes, similar to other circumstances described above, providers may exercise discretion in disclosing such to parents, in their capacity as the patient’s personal representative. However, again, state law must be consulted for additional limitations on such disclosures.