Group Therapy and HIPAA RulesUnder the HIPAA Privacy Rule, a healthcare provider may use and disclose protected health information (PHI), without individual written authorization, if the use or disclosure is a treatment disclosure. This general rule applies to PHI related to mental health. Mental healthcare may be provided in either individual or group settings. In group therapy sessions, the therapist may disclose treatment information about a particular patient to certain individuals and entities involved in treatment of that particular patient.

HIPAA Privacy Rule: When Can PHI Obtained in the Course of Group Therapy be Disclosed?

In the group therapy setting, more than one individual receives therapy from a provider. Group therapy generally focuses on some kind of patient commonality. For example, group therapists

often conduct group therapy sessions for individuals who are depressed, or who recently lost a loved one.
Mental health practitioners may provide therapy to patients in a group setting where other patients and family members are present, without violating the HIPAA Privacy Rule.
The practitioner may disclose protected health information to a family member or other person involved in a particular patient’s care, without written authorization from the patient, if the disclosure is made to the family member or other person for treatment purposes.
This is because the HIPAA Privacy Rule generally permits a covered entity to disclose protected health information to a family member or other person involved in a patient’s care for treatment purposes. The PHI that may be shared must be directly relevant to the involvement of the family member in the patient’s care.
The HIPAA Privacy Rule does not require that a patient consent to sharing of PHI for this specific purpose. A provider may nonetheless choose to honor a patient’s objection to the sharing of group therapy-related PHI if the provider believes, in the exercise of his or her medical judgment, that it is prudent to do so.
Patient consent may be written or oral. Objection to disclosure may also take either written or oral form. If a patient has the opportunity to prohibit or restrict a use or disclosure, and fails to do so, a provider may infer consent that the patient does not object to the consent.
According to HIPAA guidance a patient’s agreement to participate in family discussions is a good basis for inferring that the patient has consented to disclosure of PHI to the family member for treatment purposes.