HIPAA, Minnesota's Health Records Act, and Psychotherapy Notes

HIPAA, Minnesota’s Health Records Act,

and Psychotherapy Notes

OCTOBER 2014

Minnesota Department of Health, Office of Health Information Technology | www.health.state.mn.us/facilities/ehealth | [email protected]

Table of Contents

Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

HIPAA, Minnesota’s Health Records Act, and Psychotherapy Notes: Overview for Providers . . . . . . . . . . . . .3

Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

What’s in a Medical Record? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

HIPPA Standard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

Minnesota Standard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

HIPAA, Minnesota’s Health Records Act, and Psychotherapy Notes: Legal Overview . . . . . . . . . . . . . . . . . . . .4

Legal Obligations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Psychotherapy Notes Defined . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

HIPAA Standard: Right of Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Minnesota Standard: Patient Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Preemption Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5

Acknowledgements

The Minnesota Department of Health thanks the many members of the Minnesota e-Health Initiative

and the Minnesota e-Health Privacy and Security workgroup for their time, leadership and expertise

in developing and endorsing this piece.

Minnesota e-Health Privacy and Security Workgroup Co-Chairs

Laurie Beyer-Kropuenske, JD

Director, Information Policy Analysis Division

Minnesota Department of Administration

LaVonne Wieland, RHIA, CHP

System Director Compliance & Privacy Compliance

HealthEast Care System

Special Advisors

Stacie Christensen, Information Policy Analysis Division, Minnesota Department of Administration

Trisha Stark, Minnesota Psychological Association

Other Advisors and Project Support

David Honan, Information Compliance & System Modernization, Minnesota Department of Human Services

Bob Johnson, Ofﬁce of Health Information Technology, Minnesota Department of Health

Lisa Moon, Ofﬁce of Health Information Technology, Minnesota Department of Health

Introduction

In 2014, the Minnesota Department of Health (MDH),

in consultation with the e-Health Advisory Committee

convened the Minnesota e-health Privacy and Security

workgroup to provide materials and resources to health

and health care providers to aid in implementing more

robust privacy and security programs throughout the

state . Over the course of several meetings with key

stakeholders, the Workgroup identified the need to

clarify the differences in Minnesota law with respect

to the patient’s right of access to mental health

records under the Health Insurance Portability and

Accountability Act (HIPAA) Privacy Rule . This

overview document is intended for mental health

and behavioral health providers and is the Minnesota

Department of Health’s summary legal analysis of the

difference between HIPAA and the Minnesota Health

Records Act when it comes to the disclosure

of psychotherapy notes .

Additional resources and guidance for providers

and privacy officers are available online at

www.health.state.mn.us/facilities/privacy/index.html.

HIPAA, Minnesota’s Health Records Act, and Psychotherapy Notes

Overview for Providers

Background

Patient access to psychotherapy notes

in Minnesota may cause confusion among

providers because of the unique interaction of federal and state law where state

law wins .

• Federal law (HIPAA Privacy Rule) allows a mental health professional to

share psychotherapy notes, at the provider’s discretion, with patient consent .

In recognition of the sensitivity of this information, HIPAA requires that

this consent be captured on a form only documenting the consent to release

psychotherapy notes .

• Minnesota law is more stringent than HIPAA with respect to the rights of

individuals .

In Minnesota, patients have the right to view or release all parts

of their medical record and psychotherapy notes are part of that medical record

that can be viewed or released . The added protection of the notes inclusion in

the medical record is to assure greater access for patients to all of their protected

health information .

What’s in a medical record?

Much of the confusion stems from the differences in definition of what constitutes

a medical record . Even if psychotherapy notes are kept in a separate ﬁle, in

Minnesota, they are considered to be part of the medical record. This is to ensure

that patients have full access to complete information about their health.

Though this difference in definition of what is included in medical record may cause

some alarm, in practice, these notes are rarely accessed . Minnesota does allow for the

use of clinical judgment in the release of all medical records, such that if the release

could cause harm to the patient or others, they can be withheld from the patient’s

view .

HIPAA standard.

Psychotherapy notes are specifically excluded from a patient’s general right to access

or inspect their own medical records under HIPAA’s Privacy Rule . If mental health

professionals wish to disclose the psychotherapy notes, they are generally permitted

to do so, but must receive the patient’s authorization .

Minnesota standard.

Minnesota’s Health Records Act gives patients access to “complete and current

information possessed by that provider concerning any diagnosis, treatment, and

prognosis” and does not distinguish psychotherapy notes from other medical records .

Under HIPAA, psychotherapy

notes are recorded by a health care

provider who is a mental health

professional that: 1) document or

analyze the contents of conversations

during a counseling session; and 2)

are separated from the rest of the

patient’s medical records (45 C .F .R . §

164 .501) .

If HIPAA and a state law differ as

to patient access to medical records,

HIPAA says that the law that gives the

patients more access is the law that the

covered entities within the state should

follow (45 C .F .R . § 160 .203(b)) .

Minnesota allows a patient to access

all of their medical records without

any restrictions as to psychotherapy

notes (Minn . Stat . § 144 .292, subd . 2) .

Minn . Stat . § 144 .292, subd . 7

(provider can withhold records if

detrimental to the physical or mental

health of the patient, or is likely to

cause the patient to inflict self-harm,

or to harm another) .

45 C .F .R . § 164 .524(a) and 45 C .F .R .

§ 164 .508(a)(2) (HIPAA is silent, but

may require that the provider allow

a patient to view the psychotherapy

notes before any authorization for

disclosure) .

Minn . Stat . § 144 .292, subd . 2 .

HIPAA, MINNESOTA’S HEALTH RECORDS ACT, AND PSYCHOTHERAPY NOTES

Minnesota Department of Health, Office of Health Information Technology

www.health.state.mn.us/facilities/ehealth

[email protected]

HIPAA, Minnesota’s Health Records Act, and Psychotherapy Notes

Legal Overview

While the two laws

are generally in

alignment, there is a

difference between

HIPAA and the

Health Records Act

when it comes to

psychotherapy notes.

Legal Obligations

Mental health professionals in Minnesota need to be aware of —and comply with—

both the compliance obligations imposed by the Health Insurance Portability and

Accountability Act (HIPAA) and its regulations, as well as those imposed by the

Minnesota Health Records Act . While the two laws are generally in alignment,

there is a difference between HIPAA and the Health Records Act when it comes to

psychotherapy notes .

Psychotherapy Notes Deﬁned.

Notes recorded by a health care provider who is a mental health professional that:

1) Document or analyze the contents of conversations during a counseling session; and

2) Are separated from the rest of the patient’s medical records .

(45 C.F.R. § 164.501) .

HIPAA Standard: Right of Access.

Under HIPAA’s Privacy Rule, a mental health professional is not required to

disclose psychotherapy notes to a patient . In fact, psychotherapy notes are

specifically excluded from a patient’s general right to access or inspect their

own medical records . If a mental health professional ever wishes to disclose the

psychotherapy notes, however, they are permitted to do so, but must first receive the

patient’s authorization

(45 C.F.R. § 164.524(a).*

There are only three instances in which a mental health professional does not need

patient authorization to use or disclose psychotherapy notes under HIPAA:

• Use by the provider for treatment;

• Use or disclosure for certain training purposes; or

• Use or disclosure to defense in a legal action .

(45 C.F.R. § 164.508(a)(2)) .

Minnesota Standard: Patient Access.

Minnesota’s Health Records Act gives patients broader rights when it comes to

accessing mental health records because it does not distinguish psychotherapy

notes from other medical records . Minnesota law requires that a provider give a

patient “complete and current” information concerning any diagnosis, treatment

or prognosis that relates to the patient upon request .

(Minn. Stat. § 144.292, subd. 2) .

A client also has the right to access and consent to release records related to

psychological services under administrative rules governing psychologists

(Minn. R. 7200.4710) .

Minnesota has created an exception, however, that gives providers the discretion to

withhold health records (including psychotherapy notes) if the provider believes that

HIPAA, MINNESOTA’S HEALTH RECORDS ACT, AND PSYCHOTHERAPY NOTES

Minnesota Department of Health, Office of Health Information Technology

www.health.state.mn.us/facilities/ehealth

[email protected]

“the information is detrimental to the physical or mental health of the patient, or is

likely to cause the patient to inflict self harm, or to harm another .”

(Minn. Stat. § 144.292, subd. 7) .

Minnesota also has a “Duty to Warn” statute that places a provider under a duty to

disclose protected information to “predict, warn of, or take reasonable precautions

to provide protections from, violent behaviors .” This duty arises when a patient

has communicated a specific, serious threat of physical violence against a specific,

clearly identified or identifiable potential victim . If this occurs, a provider must

make reasonable efforts to communicate the threat to the potential victim or to law

enforcement .

(Minn. Stat. § 148.975, subd. 2) .

Preemption Analysis.

If HIPAA and a state law differ as to patient access to medical records, HIPAA says

that the law that gives the patients more access is the law that the covered entities

within the state should follow

(45 C.F.R. § 160.203(b)) . Because Minnesota provides

the right for a patient to access all of their medical records (without any restrictions

as to psychotherapy notes), Minnesota mental health professionals should be aware

that their patients will be able to access any psychotherapy notes that relate to that

patient .

Because Minnesota

provides the right for

a patient to access

all of their medical

records (without any

restrictions as to

psychotherapy notes),

Minnesota mental

health professionals

should be aware that

their patients will be

able to access any

psychotherapy notes

that relate to that

patient.

HIPAA, MINNESOTA’S HEALTH RECORDS ACT, AND PSYCHOTHERAPY NOTES

Minnesota Department of Health, Office of Health Information Technology

www.health.state.mn.us/facilities/ehealth

[email protected]