The Office of Civil Rights (OCR) continues to provide guidance regarding special topics under the HIPAA Privacy Rule. Most recently, on February 20, 2014, OCR published guidance and Frequently Asked Questions (FAQs) regarding the Privacy Rule and common questions regarding mental health use and disclosures:
The Guidance addresses:
- When a provider may communicate with friends and family members of a mental health patient
- When certain types of information,like psychotherapy notes and matters preempted by state law, may not be disclosed and under what circumstances
- When a provider may communicate with friends and family members of a capable adult or a incapacitated adult.
- When, generally speaking, a provider may notify family members of a patient if they are non-compliant with treatment requirements.
- When a provider may interact with a minor child's personal representative as to mental health matters or, more specifically, disclose federally-protected substance abuse information.
- When a child may be considered emancipated under state law.
- What protected health information regarding a patient's mental health status may be shared with a provider despite the patient's refusal to consent to the disclosure of the information to family members.
- When a provider may contact law enforcement or the patient's family when necessary to avert harm.
- When a provider may release patient mental health information to law enforcement.
- Whether HIPAA incorporates a “duty to warn” of an imminent threat by a patient to a third party
- When student health records are not covered by the Privacy Rule and are subject to other privacy rules like the Family Educational Rights and Privacy Act
The Guidance appears, as a whole, to be a further response to the confusion on this topic after several tragic events, including the Newtown, CT killings and the Aurora, CO massacre. In fact, the Guidance specifically incorporates OCR's general letter written immediately after the Newtown, CT murders affirming the underlying premise that it is typically within the professional judgment of a provider to determine when, how, and to whom mental health information should be disclosed especially when it may avoid an imminent threat to the safety of others.
http://www.hhs.gov/ocr/office/lettertonationhcp.pdf (January 15, 2013).