HIPAA and Sharing Information Related to Mental Health

US Pharm. 2018;43(11):33-35.

Note: The information in this article is general in nature and is not intended to provide legal or other professional advice.

The Health Insurance Portability and Accountability Act (HIPAA) and the HIPAA Privacy Rule limit the use and disclosure of patients’ protected health information (PHI) by pharmacists. However, HIPAA and the Privacy Rule permit pharmacists to share patients’ PHI for treatment purposes and for the health and safety of patients and others. These considerations may arise not only in connection with medications dispensed to treat a mental-health condition, but also with medications that may have mental-health side effects. As recently as July 10, 2018, for example, the FDA required safety-labeling changes for fluoroquinolone antibiotics to strengthen the warnings about the risks of mental-health side effects.¹

When PHI pertains to a patient’s mental-health condition, the HIPAA Privacy Rule permits a pharmacist to share the patient’s PHI under certain circumstances. Those circumstances may include communications with a patient’s family or others involved in the patient’s care; communications with family members when the patient is an adult or a minor; the patient’s capacity to agree to or object to sharing of the patient’s PHI; communications with others when the patient is not adherent to the prescribed medication; and communications with family members, law enforcement, or others when the patient presents a serious and imminent threat of harm to self or others.²

Communications With Persons Involved in the Patient’s Care

The HIPAA Privacy Rule allows a pharmacist to communicate with a patient’s family or other persons involved in the patient’s care. When the patient is present and has the capacity to make healthcare decisions, the pharmacist may communicate with the patient’s family members, friends, or others whom the patient has involved in the patient’s healthcare or in payment for the pharmacy services, as long as the patient does not object. When the patient is not present or is incapacitated, the pharmacist may share the patient’s PHI with those persons as long as the pharmacist determines, based on professional judgment, that doing so is in the best interests of the patient.

In determining the patient’s best interests, the pharmacist should consider the patient’s prior expressed preferences regarding disclosures of the patient’s information, if any, and the circumstances of the current situation. When the patient regains the capacity to make these choices for herself, the pharmacist should offer the patient the opportunity to agree or object to any future sharing of her information. When someone other than a friend or family member is involved, the pharmacist must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care. In all circumstances, the pharmacist must limit the disclosures solely to PHI directly relevant to the person’s involvement in the patient’s care or payment for care.³

HIPAA Protections for Mental-Health Information

The HIPAA Privacy Rule applies uniformly to all PHI except information included in psychotherapy notes. The mental-health professional must obtain the patient’s authorization before disclosing psychotherapy notes—including disclosure for treatment purposes—to another healthcare provider.⁴

Psychotherapy notes are recorded by a mental-health professional in order to document or analyze the contents of a conversation during a counseling session and are separate from the rest of the patient’s medical record. For the pharmacist, psychotherapy notes do not include information about pharmacy services, medication provided, or diagnosis. Psychotherapy notes also do not include information maintained in a patient’s medical record.⁵

Serious Mental-Health Illness and the Failure to Take Medication

If a patient has capacity and objects to the pharmacist sharing PHI with the patient’s family member, the pharmacist may share the PHI only if doing so is consistent with applicable law and standards of ethical conduct, and the pharmacist has a good-faith belief that the patient poses a threat to the health or safety of the patient or others and the family member is reasonably able to prevent or lessen that threat. For example, if the pharmacist knows from experience that when a patient’s medication is not at a therapeutic level the patient is at high risk for committing suicide, the pharmacist may believe, in good faith, that disclosure is necessary to prevent or lessen the threat of harm to the health or safety of the patient who has stopped taking the prescribed medication, and may share information with the patient’s family or other caregivers who can avert the threat. Unless the pharmacist has a good-faith belief that the disclosure is necessary to prevent a serious and imminent threat to the health or safety of the patient or others, the pharmacist must respect the patient’s wishes with respect to the disclosure.⁶

Minor Children and Mental-Health Status

Regarding general treatment situations, a parent, guardian, or other person acting in loco parentis usually is the personal representative of the minor child, and a pharmacist may share PHI with a patient’s personal representative under the HIPAA Privacy Rule. However, a parent is not treated as a minor child’s personal representative when:

1. State or other law does not require the person’s consent before a minor can obtain a particular healthcare service, the minor consents to the healthcare service, and the minor has not requested that the person be treated as a personal representative.
2. Someone other than the parent is authorized by law to consent to the provision of a particular health service to a minor and provides such consent.
Or:
3. A parent agrees to a confidential relationship between the minor and a healthcare provider with respect to the healthcare service.⁷

If state law grants an adolescent the right to obtain mental-health treatment without parental consent, and the adolescent consents to such treatment, the parent would not be the personal representative of the adolescent with respect to that mental-health treatment information.⁷

Regardless, state or other applicable law that expressly addresses the parent’s ability to obtain the minor child’s health information takes precedence over the HIPAA Privacy Rule. As a result, a pharmacist may disclose to a parent—or give the parent access to—a minor child’s PHI when and to the extent that it is permitted or required by law (including relevant case law). A pharmacy may not disclose a minor’s PHI to a parent to the extent prohibited under state or other laws.⁸

When state or other applicable law is silent concerning disclosing a minor’s PHI to a parent, and the parent is not the personal representative of the minor child based on one of the circumstances described above, a pharmacist has discretion to give or deny a parent access to the minor’s health information if doing so is consistent with applicable law and the decision is made by the pharmacist in the exercise of professional judgment.⁹

When a minor is being treated for a mental-health disorder and a substance-abuse disorder, additional laws may be applicable. The federal statute and regulations that apply to federally funded drug- and alcohol-abuse treatment programs include confidentiality provisions that are more stringent than HIPAA.¹⁰

Patients Who Are a Threat to Themselves or Others

A pharmacist may disclose necessary information about a patient to law enforcement or other persons when the provider believes that the patient presents a serious and imminent threat to self or others. When a pharmacist believes in good faith that a warning is necessary to prevent or lessen a serious and imminent threat to the health or safety of the patient or others, the pharmacist, consistent with applicable law and standards of ethical conduct, may alert those persons whom the provider believes are reasonably able to prevent or lessen the threat.¹¹

Disclosure of PHI Related to Mental Illness to Other Treating Providers

A pharmacist may disclose to other health providers PHI—including mental-health information—related to a patient for treatment, case management, and coordination of care, with few exceptions. Such information may include information related to medication dispensed to a patient. As stated above, however, disclosure of psychotherapy notes requires the patient’s authorization.¹²

Conclusion

HIPAA balances the right of a patient to maintain the privacy of information about the patient’s mental-health condition against disclosure of such information when sharing that information is in the best interest of the patient or to protect the patient or others from imminent harm. The pharmacist should carefully consider these countervailing principles when dispensing medication to treat a mental-health condition and should be aware that these principles may be at issue when the pharmacist is dispensing medication that affects the patient’s mental health.

REFERENCES

1. See generally 45 CFR Part 160 and Part 164, Subparts A and E. U.S. Department of Health and Human Services, Office for Civil Rights (HHS), HIPAA Privacy Rule and sharing information related to mental health (hereafter “HHS, Sharing Information Related to Mental Health”). www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html. Accessed October 10, 2018. See also HHS, HIPAA Helps Caregiving Connections: HIPAA helps mental health professionals to prevent harm. www.hhs.gov/sites/default/files/hipaa-helps-prevent-harm.pdf. Accessed October 13, 2018. Also FDA News Release: FDA updates warnings for fluoroquinolone antibiotics on risks of mental health and low blood sugar adverse reactions. www.fda.gov/newsevents/newsroom/pressannouncements/ucm612995.htm. Accessed October 10, 2018.
2. See generally 45 CFR §§164.502(g) and 164.510.
3. See 45 CFR §164.510(b). HHS, Sharing Information Related to Mental Health. Pharmacy practice acts and other applicable law may impose greater restrictions on a pharmacist’s disclosure of PHI related to the patient’s mental health. See also HHS, HIPAA helps family and friends stay connected with loved ones who have a substance use disorder, including opioid abuse, or a mental or behavioral health condition. www.hhs.gov/sites/default/files/hipaa-helps-stay-connected.pdf. Accessed October 13, 2018.
4. See 45 CFR §164.508(a)(2), cited in HHS, Sharing Information Related to Mental Health. A patient’s authorization for disclosure of psychotherapy notes is not necessary for disclosures required by law, including mandatory reporting of abuse and mandatory or permissible “duty to warn” circumstances involving threats of serious and imminent harm made by the patient.
5. See 45 CFR §164.501; HHS, Sharing Information Related to Mental Health.
6. See 45 CFR §164.512(j); HHS, Sharing Information Related to Mental Health.
7. See 45 CFR §164.502(g); HHS, Sharing Information Related to Mental Health. A parent also may not be a personal representative if there are safety concerns. A pharmacist may decide not to treat the parent as the minor’s personal representative if the pharmacist believes that the minor has been or may be subject to violence, abuse, or neglect by the parent or the minor may be endangered by treating the parent as the personal representative; and the pharmacist determines, in the exercise of professional judgment, that it is not in the patient’s best interests to treat the parent as the personal representative. See 45 CFR §164.502(g)(5) and HHS, Sharing Information Related to Mental Health.
8. See 45 CFR §164.502(g)(3)(ii) and HHS, Sharing Information Related to Mental Health.
9. HHS, Sharing Information Related to Mental Health.
10. See 42 USC § 290dd-2; 42 CFR §§2.11, et seq.; and HHS, Sharing Information Related to Mental Health.
11. Message to our nation’s health care providers, letter dated January 15, 2013, HHS. www.hhs.gov/sites/default/files/ocr/office/lettertonationhcp.pdf. Accessed October 10, 2018. See also 45 CFR §164.512(j). Pharmacists should review state law for additional guidance and 42 USC §290dd-2 and 42 CFR Part 2 related to the disclosure of alcohol- and drug-abuse treatment records.

12. HHS, Sharing Information Related to Mental Health.

To comment on this article, contact rdavidson@uspharmacist.com.