Psychotherapy Notes Under HIPAA
HIPAA creates a special category for psychotherapy notes, defined as notes recorded by a mental health professional documenting the contents of a counseling session that are kept separate from the rest of the medical record. Unlike general treatment records, psychotherapy notes require specific patient authorization before they can be disclosed, even for treatment, payment, or healthcare operations in most circumstances, which is a distinction RHIA candidates must recognize.
What Is Excluded from Psychotherapy Notes
Medication management information, results of clinical tests, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress are explicitly excluded from the psychotherapy notes definition and are treated as ordinary protected health information, meaning they can be disclosed under the standard HIPAA rules without the heightened authorization requirement.
State Mental Health Laws
Many states impose their own confidentiality statutes for mental health records that exceed HIPAA's baseline protections, sometimes requiring written patient consent for any disclosure or imposing additional restrictions on redisclosure. HIM professionals must know both federal and applicable state requirements, applying whichever standard is more protective of patient privacy.
Minor Patients and Mental Health Records
Access to a minor's mental health records can be complicated by state laws that allow adolescents to consent to their own mental health treatment without parental involvement, which may restrict a parent's right to access those specific records even though the parent is generally considered the personal representative under HIPAA.
Duty to Warn and Disclosure Exceptions
- Some jurisdictions impose a duty to warn identifiable third parties of a credible threat of harm, permitting disclosure without patient authorization
- Disclosures to prevent or lessen a serious and imminent threat to health or safety are permitted under HIPAA's safety exception
- Court-ordered disclosures still require compliance with any applicable state confidentiality statute
Release of Information Best Practices
HIM departments should segregate psychotherapy notes within the record system, train release of information staff to recognize when heightened authorization is required, and maintain clear documentation of the authorization scope for every mental health record disclosure.
Exam Tip
Remember that psychotherapy notes are the only category of information under HIPAA that generally cannot be disclosed for treatment, payment, or operations without specific patient authorization.