The Office for Civil Rights (OCR) appears to be on an educational path, providing information to assure that Covered Entities (CEs) understand their responsibilities under HIPAA. One of their recent posts relates to the rights of individuals to access their health data.
We in the mental health world have been notoriously protective of patient/client records. There has sometimes been the belief that an individual directly accessing the record of their therapy or other treatment might be harmful.
I never really subscribed to that notion. Many years ago, I remember having an adolescent sit down at my computer to enter their own statement about what had happened in our treatment session that day.
General Right
The Privacy Rule generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice. Individuals have a right to access this PHI for as long as the information is maintained by a covered entity, or by a business associate on behalf of a covered entity, regardless of the date the information was created; whether the information is maintained in paper or electronic systems onsite, remotely, or is archived; or where the PHI originated (e.g., whether the covered entity, another provider, the patient, etc.).
There are two categories of data that are excluded from this general right.
- Psychotherapy notes, which are the personal notes of a mental health care provider documenting or analyzing the contents of a counseling session, that are maintained separate from the rest of the patient’s medical record. See 45 CFR 164.524(a)(1)(i) and 164.501.
- Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. See 45 CFR 164.524(a)(1)(ii).
However, the underlying PHI from the individual’s medical or payment records or other records used to generate the above types of excluded records or information remains part of the designated record set and subject to access by the individual.
If you would like that your detailed psychotherapy notes . . . your personal notes about a session . . . are not releasable to the client, then you must maintain them separately from the rest of the patient’s record.
Some organizations prohibit maintaining separate notes considering them litigation waiting to happen. What is your organization’s stance on psychotherapy notes, whether and how to keep them?
Please enter your comments below.
