HIPAA Alert: Release of Mental Health Information May Be Preempted by State Laws


March 6, 2014 | Reading Time: 2 Minutes

Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker. How

On February 28, Nixon Peabody reported that the recently released guidance by U.S. Department of Health and Human Services (HHS) regarding the release of mental health information. This guidance clarifies several complexities related to the applicability of state law in issues related to privacy of information about mental health patients. As an elaboration of the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the HIPAA federal announcement addressed the circumstances under which health care providers are permitted to communicate mental health information with patients’ family members, friends or others involved in a patient’s care.

The Nixon Peabody HIPAA article summarizes:

In total, 46 states and the District of Columbia have a mental health treatment records confidentiality statute. However, many states have laws that only govern the records in state mental hospitals and programs, while others have laws that govern the records of specific mental health practitioners, such as psychologists and social workers. Finally, there are some states that have laws that govern records of patients specifically committed to mental institutions. Each state law must be consulted by the health care provider to assure compliance before sharing mental health information with family members or other third parties.

The spectrum of applicable state laws range from very strict to none at all. An example of one of the more stringent health information disclosure laws is the Hawaii statute, Haw. Rev. Stat. § 334-5, where “all certificates, applications, records, and reports” of mental health treatment that “directly or indirectly identify a person,” must be “kept confidential and shall not be disclosed by any person.” This statute permits consent to disclose these records only by “the person identified or the person’s legal guardian,” the director or administrator of a psychiatric or special treatment facility, or by court order, in accordance with the federal Protection and Advocacy for Mentally Ill Individuals Act of 1986. This applies to all hospitals, nursing homes, community facilities for mentally ill individuals, boarding homes and care homes.
It is important for health care organizations and providers to be mindful of federal and state protections for all health information, particularly sensitive mental health information.

The HHS website also states:

Where a patient is not present or is incapacitated, a health care provider may share the patient’s information with family, friends, or others involved in the patient’s care or payment for care, as long as the health care provider determines, based on professional judgment, that doing so is in the best interests of the patient. Note that, when someone other than a friend or family member is involved, the health care provider must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care.

In all cases, disclosures to family members, friends, or other persons involved in the patient’s care or payment for care are to be limited to only the protected health information directly relevant to the person’s involvement in the patient’s care or payment for care. OCR’s website contains additional information about disclosures to family members and friends in fact sheets developed for consumers and providers.

Introduction to Telehealth Theory & Practice

Enjoy a fast-moving overview of telebehavioral and telemental health. Understand the key points related to telehealth clinical, legal, ethical, technology, reimbursement, social media and other pivotal issues.

Disclaimer: Telehealth.org offers information as educational material designed to inform you of issues, products, or services potentially of interest. We cannot and do not accept liability for your decisions regarding any information offered. Please conduct your due diligence before taking action. Also, the views and opinions expressed are not intended to malign any organization, company, or individual. Product names, logos, brands, and other trademarks or images are the property of their respective trademark holders. There is no affiliation, sponsorship, or partnership suggested by using these brands unless contained in an ad. Some of Telehealth.org’s blog content is generated with the assistance of ChatGPT. We do not and cannot offer legal, ethical, billing technical, medical, or therapeutic advice. Use of this site constitutes your agreement to Telehealth.org Privacy Policy and Terms and Conditions.

Please share your thoughts in the comment box below.

Notify of
Inline Feedbacks
View all comments

Register for Free

Receive Any of Our 57 FREE Newsletters!


Most Popular Blog Topics

You May Also Like…

ChatGPT HIPAA Considerations
ChatGPT HIPAA Considerations

ChatGPT HIPAA compliance is one of the hottest topics at 2023 conferences and with good reason. AI...