HIPAA permits health care providers to disclose to other health providers any protected health information (PHI) contained in the medical record about an individual for treatment, case management, and coordination of care and, with few exceptions, treats mental health information the same as other health information. Some examples of the types of mental health information that may be found in the medical record and are subject to the same HIPAA standards as other protected health information include:
- medication prescription and monitoring
- counseling session start and stop times
- the modalities and frequencies of treatment furnished
- results of clinical tests
- summaries of: diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.
HIPAA generally does not limit disclosures of PHI between health care providers for treatment, case management, and care coordination, except that covered entities must obtain individuals’ authorization to disclose separately maintained psychotherapy session notes for such purposes. Covered entities should determine whether other rules, such as state law or professional practice standards place additional limitations on disclosures of PHI related to mental health.