Mental Health and Substance Abuse Privacy Rules Flashcards

Under HIPAA, are mental health records treated differently from other medical records regarding privacy protections?

Answer: Mental health records are protected by HIPAA but may receive additional state-law protections; psychotherapy notes have heightened protection under federal law

Mental health PHI receives HIPAA's standard protections, and psychotherapy notes specifically receive heightened protection; many states also provide stronger protections for mental health records.

What are 'psychotherapy notes' under HIPAA, and how do they differ from other mental health records?

Answer: Psychotherapy notes are notes from a therapist's private files capturing mental impressions during therapy, separate from formal treatment records, and requiring specific authorization for disclosure

Psychotherapy notes are mental impressions and analysis captured in a therapist's private files — distinct from treatment records — and require specific authorization for most disclosures.

Under HIPAA, for which of the following can psychotherapy notes be disclosed WITHOUT patient authorization?

Answer: For training mental health students at the covered entity

HIPAA permits disclosure of psychotherapy notes without authorization for training of mental health students at the covered entity — one of the very limited exceptions.

What federal law provides stricter confidentiality protections for substance use disorder treatment records than HIPAA?

Answer: 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records)

42 CFR Part 2 governs confidentiality of substance use disorder treatment records at federally-assisted programs and provides significantly stricter protections than HIPAA.

Under HIPAA, can a patient's mental health provider share PHI with the patient's employer without authorization?

Answer: No, mental health PHI may not be disclosed to employers without authorization except in very limited circumstances

Mental health PHI generally cannot be disclosed to employers without patient authorization — the treatment relationship is confidential and employment status is not a HIPAA exception.

What does the 'duty to warn' or 'Tarasoff doctrine' mean in the context of HIPAA and mental health?

Answer: Mental health providers may (and in some states must) disclose information to prevent serious and imminent threats to the safety of identifiable third parties

HIPAA's serious threat exception permits mental health providers to disclose PHI to prevent serious and imminent threats — this aligns with state 'duty to warn' laws derived from the Tarasoff case.

Under HIPAA, what standard applies when a family member calls a mental health provider seeking information about a patient who is an adult?

Answer: The adult patient must have previously authorized disclosure to the family member, or the provider must use professional judgment about the patient's known preferences

Adult patients control disclosure of their mental health information; family members can only receive information if the patient has authorized it or the provider uses judgment about the patient's known wishes.

How does HIPAA treat mental health records differently in the context of a parent's access to their minor child's mental health records?

Answer: State law governs whether parents can access minor mental health records, and in some states minors may consent to mental health treatment independently, limiting parental access

HIPAA defers to state law on minors' rights in mental health treatment — in many states, minors can consent to mental health treatment without parental consent, limiting parental access under HIPAA.

What is the significance of the Mental Health Parity and Addiction Equity Act (MHPAEA) in relation to HIPAA?

Answer: MHPAEA requires health plans to provide equal coverage for mental health and substance use disorder benefits, while HIPAA protects the privacy of related PHI

MHPAEA (insurance parity) and HIPAA (privacy protection) serve complementary but distinct roles — parity ensures equal coverage access while HIPAA protects the confidentiality of mental health and substance use PHI.

Under HIPAA, what is required before a healthcare provider can share a patient's substance use disorder diagnosis with their primary care physician for integrated care?

Answer: If the records are from a 42 CFR Part 2-covered program, specific written consent is required even for treatment disclosures to other providers

If the substance use disorder records are governed by 42 CFR Part 2, they cannot be shared with other treatment providers without specific patient consent — the standard HIPAA treatment exception does not apply to Part 2 records.

Under HIPAA, what steps must a mental health provider take if they receive a subpoena for a patient's therapy records?

Answer: Review the subpoena, provide written notice to the patient, and consider seeking a qualified protective order before disclosing

HIPAA requires covered entities receiving subpoenas (not court orders) to notify the patient and take steps to ensure a protective order is in place or that a sufficient time for the patient to object has passed.

What additional protection does HIPAA provide for a patient who is HIV-positive seeking mental health treatment?

Answer: Mental health records containing HIV status receive heightened protection under many state privacy laws, and HIPAA does not preempt stricter state protections for HIV information

While HIPAA doesn't specifically enhance protections for HIV status in mental health records, many states have specific HIV confidentiality laws that are stricter than HIPAA and are not preempted by it.

A patient in a mental health inpatient unit is at risk of suicide. Under HIPAA, may the treatment team share information with the patient's family members to ensure their safety upon discharge?

Answer: Yes, HIPAA permits disclosures for safety purposes using professional judgment, even without explicit patient authorization

HIPAA permits disclosures to prevent serious threats to health or safety, including involving family in safety planning for patients at risk of suicide, using professional judgment.

Under HIPAA, what rights does a patient have regarding their psychotherapy notes if they request access?

Answer: Covered entities may deny patients access to psychotherapy notes — this is one of the few exceptions to the general right of access

HIPAA specifically allows covered entities to deny patients access to psychotherapy notes — this is one of the few exceptions to the general right of access to PHI.

What is a 'personal representative' under HIPAA, and how does this concept affect mental health record access?

Answer: A person with legal authority to act on the patient's behalf (e.g., through power of attorney or guardianship), who generally has the same HIPAA rights as the patient

A HIPAA personal representative has legal authority (through power of attorney, guardianship, or other mechanism) to act on a patient's behalf and generally has the same rights as the patient to access PHI.

Under HIPAA and applicable mental health privacy laws, how should a mental health provider respond if a patient's employer contacts them requesting a fitness-for-duty evaluation of the patient?

Answer: Conduct the evaluation only if the patient consents, maintaining confidentiality of prior treatment records separate from the evaluation

Fitness-for-duty evaluations require patient consent, and treatment records generally cannot be shared with employers without authorization — the evaluation itself creates its own separate record.

How do HIPAA and 42 CFR Part 2 interact when a patient discloses substance use information during a mental health intake at a community mental health center?

Answer: If the mental health center is federally assisted and provides substance use disorder treatment, 42 CFR Part 2 applies to the substance use records, while HIPAA governs general mental health PHI

42 CFR Part 2 applies specifically to substance use disorder records in federally-assisted programs; general mental health records at the same facility may be governed by HIPAA, creating dual-framework obligations.

Under HIPAA, what protections apply to records of a patient who was involuntarily committed to a psychiatric facility?

Answer: Involuntary commitment records are still PHI subject to full HIPAA protections; the involuntary nature of treatment does not diminish privacy rights

HIPAA protections apply fully to PHI regardless of whether treatment was voluntary or involuntary — the nature of treatment admission does not affect privacy rights.

Under HIPAA, when may a mental health provider share patient information with law enforcement for a mental health crisis response without patient authorization?

Answer: Providers may share limited PHI to law enforcement in response to a report that the patient may be a danger to themselves or others if necessary to prevent or lessen a serious and imminent threat

HIPAA's serious threat exception permits sharing limited PHI with law enforcement when necessary to prevent serious and imminent threats to safety, including during mental health crises.

Under HIPAA, what privacy protection applies to a patient's medication list when it reveals psychiatric medications?

Answer: The medication list is standard PHI with HIPAA's regular protections; additional protection may apply under state mental health privacy laws

A medication list is standard PHI under HIPAA; the presence of psychiatric medications doesn't automatically trigger heightened federal protection, though state laws may provide additional protections.