0

HIPAA defines psychotherapy notes as follows (emphasis added):

Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

If a health care provider asks a patient to provide personal documents relevant for therapy (for example, "bring your diary to the next session" or something like that), is the content of these documents considered as protected under HIPAA as well? After all, one might argue that such documents are:

  1. Not medical by nature at the time they are generated
  2. Not recorded by the provider, but by the patient
  3. Not generated during a counseling session
1

Under 45 CFR 164.502,

A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter

PHI is defined in 45 CFR 160.103:

Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years.

A diary is not necessarily personally identifiable, but let us say the patient writes his name in the diary, so that it is. "Health information" is also defined:

Health information means any information, including genetic information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

A patient diary is not necessarily a professional diagnosis, but it does relate to mental health. Therefore, the diary is PHI, and is subject to the privacy rule. PHI isn't defined in terms of the reason for writing something down, or the time that it is written, or who wrote it: it is about having a relationship to a persons health.

The definition of psychotherapy notes is mostly tangential. Although a patient has a right to access his PHI per 45 CFR 164.524, there is an exception for psychotherapy notes, that a patient does not have a right to notes recorded by a mental health professional. Also note that

Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

That is, the other stuff that the mental health professional record other than specifically their professional notes is excluded from the psychotherapy notes category, which was created to exclude patient access. But it is still PHI (there is no paragraph that excludes psychotherapy notes from the scope of PHI).

| improve this answer | |
-1

Yes

If the health care provider has them then they have a record of them so they were recorded by the HCP.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.