Governor Scott Walker recently signed into law the HIPAA Harmonization – Mental Health Care Coordination Act (2013 WI Act 238, the “Act”). The Act is intended to alleviate barriers to coordination of care for patients receiving mental health treatment by aligning aspects of Wisconsin’s mental health privacy laws with the Federal Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). The Act has no effect on application of the Federal Confidentiality of Alcohol and Drug Abuse Patient Records provisions found at 42 C.F.R. Part 2 (“Confidentiality Regulations”).
The Act creates a new statute at Wis. Stat. § 146.816. The placement of this statute is interesting because the new statute directly impacts the privacy of mental health treatment records, yet there is no mention of it in Wis. Stat. Chapter 51, where the rest of the provisions regarding the privacy of mental health treatment records are located. Instead, the new statute was created in Wis. Stat. Chapter 146 where the provisions regarding privacy of more general health care records are found.
A copy of the Act, which is now effective, is available here.
The New World of Mental Health Treatment Confidentiality
The Act permits covered entities and their business associates to use, disclose or request disclosure of mental health treatment records without a patient authorization for the limited purposes of treatment, payment or health care operations, so long as such uses, disclosures or requests for disclosure are otherwise compliant with HIPAA. For these purposes, the Act adopts the HIPAA definitions of business associate, covered entity, use, disclosure, treatment, payment, health care operations and protected health information. The Act has no impact on uses or disclosures for purposes other than treatment, payment or health care operations. All other types of uses and disclosures, such as disclosures to family members or law enforcement, continue to be subject to Wisconsin’s more stringent mental health privacy laws. Finally, we note that the Act does not require covered entities to disclose mental health treatment records for treatment, payment or health care operations purposes without patient authorization; rather it permits it.
The Act effectuates the above changes by preempting specific provisions of the Wisconsin Statutes that previously restricted certain uses and disclosures of mental health treatment records. Specifically, the following Wisconsin Statutes and Wisconsin Administrative Code provisions are preempted by the new statute created under the Act: Wis. Stat. §§ 51.30(4) (a) and (e) and 146.8 and rules promulgated under Wis. Stat. § 51.30(12) (which includes Wis. Admin. Code DHS § 92.03(h) & (i)). These preempted provisions deal with certain confidentiality protections and disclosure and re-disclosure requirements generally governing mental health treatment records and patient heath care records. Again, preemption under the Act only applies to HIPAA-compliant uses and disclosures made for the limited purposes of treatment, payment and health care operations.
Special Considerations
Psychotherapy Notes. Psychotherapy notes are subject to special restrictions under HIPAA, and those restrictions still apply without change under the Act. HIPAA defines psychotherapy notes at 45 C.F.R. § 164.501 as “notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family counseling session and that are separated from the rest of the individual’s medical record.” Psychotherapy notes do not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of diagnosis, functional status, treatment plan, symptoms prognosis and progress to date. Whenever psychotherapy notes are to be used or disclosed, including for treatment, payment and health care operations purposes, HIPAA requires a patient authorization. The Act requires uses, requests and disclosures for treatment, payment or health care operations purposes to comply with HIPAA, and therefore also requires patient authorization in such instances with regard to psychotherapy notes. Further, psychotherapy notes still need to be maintained separately from other mental health treatment records.
Notice of Privacy Practices. The Act makes it clear that Wisconsin entities meeting the definition of a treatment facility in Wis. Stat. § 51.01(19) are required to comply with the notice of privacy practices requirements under HIPAA found at 45 CFR § 164.520. While this notice of privacy practices requirements for treatment facilities is duplicative of what is already required under HIPAA, it emphasizes the responsibility that all covered entities have to provide patients with a plain language statement of their privacy rights.
Requested Restrictions. Although the Act expands the scope of permissible uses and disclosures of mental health treatment records, under the HIPAA rules at 45 C.F.R. § 164.522, a patient still has the right to request that a covered entity not share protected health information with others, including other treating providers. Generally, covered entities are not required to grant a patient’s request for restriction, except when the patient requests to restrict disclosures to an insurance company and the patient has paid the provider in full, out-of-pocket. However, if a covered entity agrees to a restriction, it must abide by that restriction until the restriction is removed by the provider or the patient in compliance with HIPAA.
Practical Takeaways
Because the Act is permissive and not mandatory, the first decision health care providers need to make as a result of the Act is whether they will implement the new law or continue handling uses and disclosures of mental health treatment records for the purposes of treatment, payment and health care operations in accordance with the more stringent provisions of Wis. Stat. §§ 146.82 and 51.30. Providers who choose to implement the new law will need to review and update their policies and procedures accordingly. Additionally, such providers will need to review their consents, notice of privacy practices and other information related to patients’ rights to ensure that those documents do not give patients the impression that their mental health treatment records are maintained with a higher degree of confidentiality. Providers should also consider patients’ expectations regarding the confidentiality of mental health treatment records and take steps to make patients aware of the change in the law and of any change in the providers’ practices as a result of the broader ability to share mental health treatment records for purposes of treatment, payment and health care operations. If the patient has given a provider written authorization to use protected health information about the patient for a specific purpose, those authorizations will need to be reviewed to consider their scope and whether the authorization limits the provider’s ability to operate under the Act. Finally, from an operations perspective, providers will need to consider any limitations on their ability to separate AODA and mental health treatment records from other patient records they maintain and how this impacts implementation of the Act.
If you have questions or would like additional information, please contact:
- Monica C. Hocum at 414-721-0454 or mhocum@wp.hallrender.com;
- Leia C. Olsen at 414-721-0466 or lolsen@wp.hallrender.com;
- Rachel S. Delaney at 414-721-0448 or rdelaney@wp.hallrender.com;
- Stephane P. Fabus at 414-721-0904 or sfabus@wp.hallrender.com; or
- Your regular Hall Render attorney.
