HIPAA Privacy Rule and Provider to Provider Communication

Any pertinent clinical care information, including mental health treatment information, can be disclosed and discussed between a patient’s current treatment providers without written disclosure authorization except for the following two types of information:

A) the content of written psychotherapy notes (see below), and

B) substance abuse treatment records that are maintained by a licensed substance abuse program (42 USC § 290dd–2; 42 CFR 2.11).

Substance abuse information obtained in other treatment settings may be communicated among a patient’s treating providers without written consent.

The HIPAA definition of a “psychotherapy note” is quite restrictive. A psychotherapy note per HIPAA can only consist of a mental health professional’s written analysis of a conversation that occurred during a private counseling session that is maintained separately from the medical record.

These written analyses serve as working process notes about sessions to assist the therapist, and are not put into the medical record billing document. Anything which appears in the patient’s medical record cannot be categorized as a psychotherapy note under the HIPAA rule. Specific content that has been listed as not falling under the “psychotherapy note” protections include medication management information, counseling session start and stop times, the type and frequency of treatment delivered, the results of clinical tests, diagnosis summaries, functional status, treatment plan, symptoms, prognosis, and progress to date. 45 CFR 164.501

Yes. Treatment providers do not have to share the same employer or share the same electronic health record in order to disclose pertinent protected health information about a mutual patient without consent from the patient or parent. The key component for this HIPAA allowance is that both providers have a treatment or consultative role with that patient.  

Whenever PHI is transmitted electronically (eg, telephone voice response, text messaging, faxback or email, etc) it is covered by the Security Rule and must be made secure by measures such as encryption, secure platforms, or closed systems. Voicemail messages, telephone conversations, and paper-to-paper faxes are not subject to the Security Rule. All PHI (eg, in oral, electronic and written forms) fall under the Privacy Rule.

Yes, but there are additional regulations around the security standards needed for protecting electronic health records. Essentially, rules and procedures are required in the maintenance of an electronic health record to prevent their unauthorized access, alteration, deletion and transmission. These security regulations for electronic records are outlined in the HIPAA security rule of 2005, and the HITECH act of 2009.

Yes. Providers need to be aware that any state regulations that are more restrictive than the HIPAA rules will take precedence in those states, and so providers need to be aware of their own state’s information regulations. If you are unfamiliar with your state’s regulations, it will be important to specifically seek out your state department of health’s privacy rules. To obtain information on current state laws, you may also contact the AAP Division of State Government Affairs at stgov@aap.org

Also, clinical information obtained at a certified substance abuse treatment center is subject to additional federal privacy rules, which at this time do not allow provider to provider communication without formal consent.

Case examples where HIPAA allows for provider to provider communication without a signed release:

1. At his 13-year-old well-visit, an adolescent (and his parent) tells his pediatrician that he is seeing a psychiatrist because of depression and he is doing better. The pediatrician contacts the psychiatrist to discuss medication and the pediatrician’s role in supporting the young man and his family.
2. A 13-year-old boy is receiving depression treatment from a child psychiatrist, including both a fluoxetine prescription and counseling. The same boy is also having problems with recurrent pain for which he regularly sees his pediatrician, who has been prescribing a low dose of amitriptyline for that problem. Because of treatment plan overlaps, both treatment providers discuss and coordinate their care.
3. A 15-year-old girl has just completed a well child check at her pediatrician’s office. It was noted that she had a blood pressure of 145/95 and pulse of 130. The pediatrician learns that she has recently started taking methylphenidate as prescribed by a child psychiatrist. Because high blood pressure may be a side effect of methylphenidate, the pediatrician contacts the child psychiatrist to discuss and coordinate care.
4. A 5-year-old boy with significant behavior problems is being seen by a child psychiatrist. In the course of treatment, it becomes apparent that poorly skilled parenting practices at home are the main reason for his symptoms. The psychiatrist reaches out to the child’s pediatrician to share this assessment and the behavior management advice that is being offered to the family.