Healthcare providers are obligated to safeguard patients’ medical records. Mental health records should particularly be handled delicately because they hold confidential information about a person’s mental treatment journey.
So, what happens when a healthcare provider receives requests for patients’ mental health records? Such requests can come from other healthcare providers or health insurance providers. Familiarizing oneself with the appropriate procedure to respond to these requests can help ensure legal and ethical compliance, the continuity of care and patients’ privacy.
HIPAA doesn’t apply
Generally, the Health Insurance Portability and Accountability Act (HIPAA) protects patients’ privacy and security. But does it also govern the sharing of mental health records? Many healthcare providers in the Prairie State are not aware that HIPAA does not regulate the release of mental health records.
Instead, the Illinois Mental Health and Developmental Disabilities Confidentiality Act (the Act) regulates mental health record releases. State laws concerning patients’ welfare are stricter than HIPAA regulations. For this reason, the Act overrides HIPAA.
The Act
According to this legislation’s standards for protecting health information, healthcare providers should obtain a subpoena from a state court or written authorization from the patient before disclosing their mental health records. Healthcare providers can receive demands or requests for patients’ mental health records under one of two circumstances.
The provider can respond to a subpoena that demands they release the mental health records related to a court proceeding such as a child custody case. In this case, the provider should try and make sure that the subpoena was issued by the court clerk. Releasing a patient’s mental health records in response to an improper subpoena constitutes a violation of the Act.
A healthcare provider can also receive a request from a patient who wants their mental health records disclosed to a person of their choice for a personal reason. In this case, the patient should provide consent and authorization to release this sensitive information. A healthcare provider would be found in violation of the Act if they release the patient’s records in response to a deficient authorization.
Seek legal support
Healthcare providers who inadvertently violate the Act can feel overwhelmed by the potential ramifications of their unintentional error. In such a situation, seeking appropriate legal guidance can clarify their situation and provide the legal support they need.