Healthcare providers and their business associates frequently face difficult questions relating to when they are able to share protected health information with the family members and friends of the patients they serve. These questions often require consideration of a number of different laws and rules, such as HIPAA, Federal alcohol and drug abuse confidentiality regulations, state mental health laws, ethical obligations and so on. In what is sure to be welcomed guidance, the U.S. Department of Health and Human Services (HHS) has released new FAQs explaining how the HIPAA Privacy Rule operates to protect individuals’ privacy rights with respect to their mental health information and in what circumstances the Privacy Rule permits health care providers to communicate with patients’ family members and others.

The guidance reminds covered entities and business associates of, among other things, the heightened protections for psychotherapy notes, a parent’s right to access the protected health information of a minor child, the application of state laws that provide more stringent protections than HIPAA, and the intersection of HIPAA and FERPA in a school setting. However, many of the FAQs also address some specific issues and scenarios that will be helpful to providers and their business associates. For example, the FAQs address topics, such as:

• Communicating with a patient’s family members, friends, or others involved in the patient’s care;
• Communicating with the parent of a patient who is a minor;
• Assessing the patient’s capacity to agree or object to the sharing of their information; and
• Determining whether to tell family members, friends, or others that a patient has stopped taking prescribed medications or other therapies.

There are, for sure, clear limits on a provider’s ability to share mental health information in the circumstances described in this guidance, however, there is also considerable discretion extended to providers. For instance, when it is suspected that a patient does not have the capacity to agree or object to the sharing of personal health information, in addition to determining whether the patient in fact has lost capacity, providers have significant concerns about whether and under what circumstances they may share the patient’s mental health information in such a state. According to the FAQs, a patient has lost capacity when he or she is unconscious, and may include circumstances in which a patient is suffering from temporary psychosis or is under the influence of drugs or alcohol. In those cases and other where capacity is lost, the provider is allowed to discuss the patient’s condition or treatment with a family member if the provider believes it would be in the patient’s best interests. In making this determination about the patient’s best interests, the provider should take into account the patient’s prior expressed preferences regarding disclosures of his or her information, if any, as well as the circumstances of the current situation. Once the patient regains the capacity to make these choices for herself, the provider should offer the patient the opportunity to agree or object to any future sharing of her information.

Providers and business associates that provide mental health services or otherwise handle mental health records should review this guidance and the other applicable federal and state laws that affect their handling of this information, and make any appropriate changes in their policies and procedures. Discussing this guidance with workforce members is a good opportunity to provide another reminder about the need for privacy and security of protected health information.