Healthcare Information Security

HIPAA and Compliance News

Considering HIPAA Privacy Rule with Mental Health Data

The recent Helping Families in Mental Health Crisis Reform Act of 2016 ensures that the HIPAA Privacy Rule is not overlooked in patient care.

Recent bill discusses HIPAA Privacy Rule for patient care

Source: Thinkstock

By Elizabeth Snell

- The permitted uses and disclosures of PHI in the HIPAA Privacy Rule were key considerations in a recently passed bill package, which included reforms for patients being treated for mental health conditions.

The Helping Families in Mental Health Crisis Act was signed into law as part of the 21st Century Cures Act in December 2016. Congressman Tim Murphy backed the bill, saying that the “stigma surrounding mental illness” must end, with a key focus on patient care.

“Through congressional hearings and an in-depth investigation, we discovered the fatal disconnect between 112 federal agencies assigned to treat the mentally ill,” Murphy said in a statement. “We exposed a $130 billion dollar investment wasted on feel-good fads that have done little to treat the ill as the rates of homelessness, incarceration, suicide and drug overdose deaths soar. We came together, across party lines, went to work, and while many doubted we would make it this far - here we are.”

Ensuring a more compassionate communication on HIPAA regulations was a key aspect of the bill. Specifically, more clarification is necessary in regard to the permitted uses and disclosures of patient PHI by healthcare professionals, the bill reads.

“Circumstances when a health care provider or covered entity may use or disclosure protected health information related to the treatment of an adult with a mental or substance use disorder” must be clarified, according to the legislation.

READ MORE: HIPAA Data Breaches: What Covered Entities Must Know

It is important to note that the HIPAA Privacy Rule does address how healthcare organizations are required to treat patient records when an individual is being treated for mental health conditions. Healthcare providers are allowed to communicate with a patient’s family, friends, or other persons involved in the patient’s care.

“The provider may ask the patient’s permission to share relevant information with family members or others, may tell the patient he or she plans to discuss the information and give them an opportunity to agree or object, or may infer from the circumstances, using professional judgment, that the patient does not object,” the HIPAA rule maintains.

Psychotherapy notes are also specified under HIPAA, and are different from other mental health information. This is because “they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment, or health care operations purposes, other than by the mental health professional who created the notes.”

The bill also explains that there must also be a better development and dissemination of model training programs.

The Secretary must “identify or recognize private or public entities to develop model training and educational programs to educate health care providers, regulatory compliance staff, and others regarding the permitted use and disclosure of health information under HIPAA.”  

READ MORE: Patient Privacy Addressed in Recent HHS Confidentiality Rule

Improving leadership and accountability are also important aspects of the legislation. An Assistant Secretary for Mental Health and Substance Use must be established, the bill said, along with a Chief Medical Officer within SAMHSA. The Assistant Secretary will also head the Substance Abuse and Mental Health Services Administration (SAMHSA).

Furthermore, the bill requires improved oversight of mental and substance use disorder programs through the Assistant Secretary for Planning and Evaluation (ASPE).

The ASPE must develop a strategy for conducting ongoing evaluations on key programs across the agency, with the evaluation focusing on the following areas:

  • Prevention, intervention, treatment, and recovery support services
  • The reduction of homelessness and incarceration among those with mental illness or SUD
  • A plan for assessing the use of performance metrics to evaluate related activities by those receiving relevant grants, contracts, or cooperative agreements

The bill also discusses how the federal government should promote access to mental health and substance use disorder care. It is also now required for state prevention activities and responses to mental health and substance use disorder need to be properly supported.

The legislation was first passed by the House of Representatives in July 2016, passing with a 422-2 vote.

READ MORE: HIPAA Privacy Rule Changes Proposed for Background Checks

The American Hospital Association (AHA) announced its support of the bill one month prior, and how it appreciated the House Committee members’ efforts to reform the nation’s behavioral health system.

“We thank you for taking a responsible approach to this issue and adopting language requiring the Health and Human Services (HHS) Secretary to clarify the circumstances in which covered entities may disclose protected health information of a patient with a mental illness,” the AHA wrote to members of Congress. “We also thank you for including a requirement that the HHS Secretary identify, develop and disseminate model programs and materials for training patients and their families regarding their rights to protect and obtain protected health information.”

The AHA had previously stated its concern on an earlier version of the bill, worried over certain language discussing HIPAA regulations and how patient fear of inappropriate PHI disclosure may have led to a refusal to seek treatment.


SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
Data Breaches

Our privacy policy

no, thanks