HIPAA, privacy, and noodle salad

As Jack Nicholson’s character stated in the movie, As Good As It Gets, “[s]ome of us have great stories, pretty stories that take place at lakes with boats and friends and noodle salad. Just no one in this car. But a lot of people, that's their story. Good times, noodle salad.”

From the inception of the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191 (HIPAA) and the subsequent promulgation of the various related rules and regulations, Congress and the U.S. Department of Health and Human Services (HHS) appreciated that every patient’s life does not consist of “good time, noodle salad.” This notion was reinforced recently when on April 12, 2023, the White House announced additional “[e]fforts to protect sensitive health information, including related to reproductive health care, have taken on renewed importance, as states seek to penalize and criminalize health care providers and interfere in deeply personal medical decisions.” On the same day, HHS issued a Notice of Proposed Rule Making aimed at bolstering privacy protections in relation to women’s reproductive healthcare. Echoing the White House’s sentiments, HHS focus is “protections by prohibiting the use or disclosure of protected health information (PHI) to investigate, or prosecute patients, providers, and others involved in the provision of legal reproductive health care, including abortion care. HHS has heard from patients, providers, and organizations representing thousands of individuals that this change is needed to protect patient-provider confidentiality and prevent private medical records from being used against people for merely seeking, obtaining, providing, or facilitating lawful reproductive health care.” Subsequently, the NPRM was published and can be found at 88 Fed. Reg. 23506 (Apr. 16, 2023). Comments should be submitted before June 16, 2023.

Heightened concern for privacy in certain areas is not new. For example, SAMHSA and 42 CFR Part 2 were created in the 1970s to enable individuals to seek treatment for substance abuse without the fear of easy access to the records, including by litigants and law enforcement. Because of the sensitivity and the public policy promoting treatment, greater caution is taken whe’n releasing these records and there are safeguards in place to focus on the minimum necessary. Relatedly, both HIPAA and the 21st Century Cures Act’s Information Blocking provisions have robust exceptions for psychotherapy notes.

Psychotherapy notes are defined at 45 CFR 164.501 as “means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.” (emphasis added).Simply stated, these are not easy to get and are not easily acquired by law enforcement. The following highlight this notion:

• 45 CFR § 164.508(a)(2) Authorization Required: Psychotherapy Notes. Covered entities must obtain authorization for any use or disclosure of psychotherapy notes, except:
  • (i) To carry out treatment, payment or healthcare operations ,when
    • (A) Use is by the originator of the psychotherapy notes for treatment;
    • (B) Use or disclosure by the covered entity is for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or
    • (C) Use or disclosure by the covered entity is to defend itself in a legal action or other proceeding brought by the individual; or
  • (ii) If a use or disclosure is: required by the Secretary to investigate or determine the covered entity’s compliance with the Privacy Rule (§ 164.502(a)(2)(ii)); required by law (§ 164.512(a)); for health care oversight activities authorized by law with respect to the originator of the psychotherapy notes (§ 164.512(d)); to provide information to coroners and medical examiners for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law (§ 164.512(g)(1)); or to prevent or lessen a serious and imminent threat to the health or safety of a person or the public if the disclosure is consistent with applicable law and to a person or persons reasonably able to prevent or lessen the threat, including to the target of the threat (§ 164.512(j)(1)(i)).

As ONC states in relation to information blocking and a question about sessions conducted by medical professionals other than psychiatrists, It depends. To the extent the content of any particular note meets the definition of “psychotherapy notes” in the HIPAA Rules (see 45 CFR 164.501), that note would be considered a psychotherapy note for purposes of information blocking. The information blocking regulations do not specify types of health care providers to be mental health professionals for purposes of applying the “psychotherapy notes” definition under the information blocking regulations. Thus, all notes that are “psychotherapy notes” for purposes of the HIPAA Rules are also “psychotherapy notes” for purposes of the information blocking regulations in 45 CFR part 171, and are therefore excluded from the definition of EHI for purposes of the information blocking regulations.

Although your life may consist of “noodle salad and picnics” it is important to appreciate that most people experience events that are personal and often time traumatic. Preferential treatment of highly sensitive items contained in medical records is warranted in order to protect the physician-patient relationship and trust in the medical system, as well as maintaining checks and balances in our legal system. Providers should parse out these notes in an EHR and significantly limit access. In litigation, if psychotherapy notes are at issue, a motion to submit them to the judge for review in camera should be the first step. As this landscape continues to evolve in the areas of mental health, substance use disorder, and reproductive health, providers should immediately look at the HIPAA Authorization Form signed by the patient and consult counsel before simply responding to a subpoena or other discovery request.

Rachel V. Rose, JD, MBA, advises clients on compliance, transactions, government administrative actions, and litigation involving healthcare, cybersecurity, corporate and securities law, as well as False Claims Act and Dodd-Frank whistleblower cases.