HIPAA AlertOn February 28, Nixon Peabody reported that the recently released guidance by U.S. Department of Health and Human Services (HHS) regarding the release of mental health information. This guidance clarifies several complexities related to the applicability of state law in issues related to privacy of information about mental health patients. As an elaboration of the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the HIPAA federal announcement addressed the circumstances under which health care providers are permitted to communicate mental health information with patients’ family members, friends or others involved in a patient’s care.

The Nixon Peabody HIPAA article summarizes:

In total, 46 states and the District of Columbia have a mental health treatment records confidentiality statute. However, many states have laws that only govern the records in state mental hospitals and programs, while others have laws that govern the records of specific mental health practitioners, such as psychologists and social workers. Finally, there are some states that have laws that govern records of patients specifically committed to mental institutions. Each state law must be consulted by the health care provider to assure compliance before sharing mental health information with family members or other third parties.

The spectrum of applicable state laws range from very strict to none at all. An example of one of the more stringent health information disclosure laws is the Hawaii statute, Haw. Rev. Stat. § 334-5, where “all certificates, applications, records, and reports” of mental health treatment that “directly or indirectly identify a person,” must be “kept confidential and shall not be disclosed by any person.” This statute permits consent to disclose these records only by “the person identified or the person’s legal guardian,” the director or administrator of a psychiatric or special treatment facility, or by court order, in accordance with the federal Protection and Advocacy for Mentally Ill Individuals Act of 1986. This applies to all hospitals, nursing homes, community facilities for mentally ill individuals, boarding homes and care homes.
It is important for health care organizations and providers to be mindful of federal and state protections for all health information, particularly sensitive mental health information.

The HHS website also states:
Where a patient is not present or is incapacitated, a health care provider may share the patient’s information with family, friends, or others involved in the patient’s care or payment for care, as long as the health care provider determines, based on professional judgment, that doing so is in the best interests of the patient. Note that, when someone other than a friend or family member is involved, the health care provider must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care.

In all cases, disclosures to family members, friends, or other persons involved in the patient’s care or payment for care are to be limited to only the protected health information directly relevant to the person’s involvement in the patient’s care or payment for care. OCR’s website contains additional information about disclosures to family members and friends in fact sheets developed for consumers and providers.