Issues Pertaining to Behavioral Health Information
We were recently asked by the Oklahoma State Department of Mental Health and Substance Abuse Services to write a document to help educate behavioral health care providers regarding the extent to which such providers can exchange behavioral health information through a health information exchange ("HIE"). Because many of our clients are in the process of (a) implementing electronic health records, (b) satisfying the requirements of meaningful use and (c) looking for ways to provide care more efficiently, these questions and answers we provided in the OSDMHSS document may also assist our clients struggling with these same issues and we wanted to make them available.
If you have any questions about the information contained in the following table, please do not hesitate to contact us.
What is a health information exchange ("HIE")?
Health information exchange provide the capability to electronically move clinical information between disparate health care information systems while maintaining the meaning of the information being exchanged. Health information exchange is the electronic movement of health-related information among organizations according to nationally recognized standards. The goal of health information exchange is to facilitate access to and retrieval of clinical data to provide safer, timelier, efficient, effective, equitable, patient-centered care. An HIE is a transport mechanism. The health information remains with the source of such information. Information is not released to an HIE, but through it.
Can mental health treatment information be disclosed by a behavioral health providers through an HIE?
Yes, HIEs are recognized as Business Associates of health care providers by the Office of Civil Rights ("OCR"). As long as the HIE and the pertinent health care providers execute Business Associate Agreements, the providers may exchange health information through the HIE.
What type of mental health information may be exchanged by a behavioral health provider through an HIE?
Health care providers may exchange any type of mental health treatment information through an HIE for purposes permitted by HIPAA, except for psychotherapy notes. HIPAA and the applicable Oklahoma statute, 43A O.S. § 1-109, do not distinguish between physical and mental health information, with one narrow exception for psychotherapy notes. Psychotherapy notes are notes recorded (in any medium) by a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record.
Under HIPAA and Oklahoma law, a health care provider with a direct treatment relationship with a patient may use or disclose the patient's health information for purposes of treatment, payment, and health care operations. Currently, HIEs in Oklahoma only are facilitating the exchange of patient information for purposes of treatment.
A patient's authorization is required to disclose psychotherapy notes.
Is a behavioral health provider required to obtain patient consent or authorization prior to disclosing or sending patient mental health treatment information through an HIE?
Neither HIPAA nor 43A O.S. § 1-109 require patient consent or authorization for providers to exchange mental health information through an HIE. Both laws permit any type of health care provider with a direct treatment relationship with a patient to use or disclose the patient's health information for purposes of treatment, payment, and health care operations without obtaining patient authorization.
However, certain trade organizations representing behavioral health providers, such as the American Psychiatric Association ("APA") continue to stress the importance of confidentiality and direct mental health providers to consider the welfare of their patients and fully apprise them of the manner in which their mental health treatment records will be used and disclosed. See, for example, Section 4 of the APA's The Principles of Medical Ethics.
Therefore, even though a mental health provider is not required by statute to obtain a patient's consent or authorization to disclose treatment information through an HIE, some are reluctant to do so unless they have clearly notified patients.
What are the options available to a mental health provider to inform patients of the transmission of their health information through an HIE?
Providers in Oklahoma have several options because Oklahoma law does not mandate any particular method. At a minimum, providers should include information in their Notice of Privacy Practices about the potential for exchange of health information through an HIE. Pursuant to the NPP, patients would be permitted to request a restriction on the use and disclosure of their health information through an HIE. Notification of patients by amending the NPP is the most efficient method and is administratively less burdensome than the other possible methods discussed in the next paragraph.
Two other models are referred to as "opt-in" and "opt-out". Opt-in requires affirmative authorization or consent from the patient by signing a written consent form to participate in the HIE. Opt-out requires that the patient be given notice – through mailings, brochures, posted notices or other means – and allows a patient's health information to be exchanged through the HIE unless and until the patient formally requests that it not be exchanged.
Can a behavioral health provider request medical information through an HIE?
Absolutely. If the behavioral health provider (either mental health or substance abuse provider) has a contract with an HIE, he/she can request medical information through the HIE to facilitate patient care, even if the behavioral health provider is not sending any information to the exchange. As indicated above, both HIPAA and state law permit providers to use and disclose health information for treatment, payment and healthcare operations without a patient's express consent or authorization.
Can a behavioral health provider send substance abuse information to an HIE without patient consent?
It depends on whether the behavioral health provider works for a "substance abuse program" as defined by 42 C.F.R. Part 2 ("Part 2"). Part 2 provides that substance abuse programs may not use or disclose any information about any patient unless the patient has consented in writing (on a form that meets the requirements established by the regulations) or unless another very limited exception specified in the regulations applies. Any disclosure must be limited to the information necessary to carry out the purpose of the disclosure. If information related to substance abuse is included in a patient's medical record, it is not restricted by law from disclosure unless it is part of a substance abuse program record. However, a provider or facility that is not part of a "program" may elect to restrict the exchange of substance abuse information through their own policies or by not permitting the data to be sent from their electronic health record.
What is a 'substance abuse program' as defined in Part 2?
To be a "program" governed by Part 2, an individual or entity must be federally assisted and hold itself out as providing, and provide, alcohol or drug abuse diagnosis, treatment or referral for treatment. A different definition of a "program" applies when services are provided by a specialized unit or staff within a general hospital or medical facility. A general medical facility has a Part 2 program if: (a) there is "an identified unit within a medical facility which holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment;" or (b) there are "medical personnel or other staff in a general medical facility whose primary function is the provision of alcohol or drug abuse diagnosis, treatment or referral for treatment and who are identified as such providers."
Primary care providers in private practice are only covered by Part 2 if their principal practice consists of providing alcohol or drug abuse diagnosis, treatment or referral for treatment, and they hold themselves out as providing the same.
Are there any other impediments to behavioral health providers sending substance abuse program information through an HIE?
Yes, the Part 2 requirements for patient consent place limitations on the ability to redisclose such information, which makes utilizing an HIE to exchange such information impractical. Substance abuse records disclosed pursuant to the patient's written consent must be accompanied by the following specific statement:
This information has been disclosed to you from records protected by Federal confidentiality rules (42 C.F.R. Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 C.F.R. Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.
If you have any questions contact Kevin D. Gordon, Cori H. Loomis or any other member of Crowe & Dunlevy's Healthcare practice.