Skip to main content

​
Permitted without authorization

You can use and share PHI, within limits, for three purposes:
  • Treatment. Providing care, consulting with a supervisor or another treating provider, coordinating care.
  • Payment. Billing, eligibility checks, claims, superbills.
  • Health care operations. Running the practice: supervision, quality review, training, scheduling.
Certain other disclosures are required or permitted by law: mandatory reporting, duty to warn, responding to a valid court order. Those are in Mandatory reporting and Release of information.

​
Everything else needs authorization

Sharing PHI with a client’s family, a school, an employer, another provider not involved in treatment, an attorney, or anyone else outside those categories requires the client’s written HIPAA authorization, on our form, on file before the disclosure. A client saying “sure, tell my mom” in session is not enough. See Release of information.

​
Psychotherapy notes

Your process notes, if you keep them separate from the clinical record, have extra protection under HIPAA and can’t be released even with a general authorization. Keep them separate if you keep them at all, and know that most of what you write is the clinical record, not psychotherapy notes.

​
Minimum necessary

The habit that prevents most privacy problems: use, request, and share only the minimum information needed for the purpose.
  • Consulting on a case? Use initials or “my 2 pm client,” not a name, unless the name is needed.
  • Sending a superbill? It has diagnosis codes because the payer needs them. It doesn’t need your session notes.
  • Coordinating with the front office about a reschedule? They need the appointment, not the reason for it.
  • Looking something up in the system? Open the client you need, not the whole list.
Minimum necessary doesn’t apply to treatment disclosures between treating providers, or to disclosures the client authorized. It applies to almost everything else.

​
Access is logged

Our systems record who opened which record and when. Access to a record you have no work reason to open is a violation, even if you never share what you saw.

​
Client rights

Clients have the right to see and get a copy of their record, to request corrections, to know who we’ve shared it with, to request restrictions, and to ask us to contact them a certain way. Route any of these requests to the front office and Helen. Don’t handle them informally.

​
The rule of thumb

If you’re about to share something about a client and you’re wondering whether you should, that’s the signal. Stop and ask Helen. The cost of asking is a minute. The cost of guessing wrong isn’t.