What does HIPAA mean and how does HIPAA relate to you for you to know your HIPAA rights? HIPAA stands for “The Health Insurance Portability and Accountability Act” of 1996 and is part of the Social Security Act. The purpose of this Act is to protect the privacy of your healthcare information. Before you stand up for your rights, you need to know your HIPAA rights. What information is protected under HIPAA? You should be aware that any medical records kept by your therapist are meant to remain confidential, including conversations, types of treatment and when you were treated, and certain billing information. Any information disclosed during your sessions will be documented for you to have smooth transitions between therapists and other health professionals. You should also know your HIPAA rights for any legal purposes. Understanding when these rights to confidentiality can legally be overridden is pivotal in the work that you will be doing with your therapist.
Table of Contents
What rights are covered by HIPAA?
You have the right to receive a notification regarding how your records are being distributed, and you can decide who may be allowed to receive them. Therapists must get a signed release form indicating that you, the client, were informed of where your information was going and how it was being used before they may use their information for purposes outside of your treatment, such as marketing or for research purposes. You have the right to view and receive a copy of your health records within a thirty day period. You may request edits to these files whenever you see fit. If any of these rights are violated, then you can file a complaint straight to your health care provider or to the U.S Department of Health and Human Services. HIPAA was created with the intention to protect not only your rights but also to make sure that your therapist is acting in a standardized way that protects both of you.
What is different about Marriage and Family Therapy compared to other types of psychotherapy is that multiple people are often involved, which can affect confidentiality. There are a handful of situations where your therapist may be required to break confidentiality, mainly when a client shares information that could harm themselves or vulnerable populations. Who are these vulnerable populations? Confidentiality must be broken if a client is at risk of endangering a population that is unable to protect themselves like minors, the disabled, and the elderly. Under most agencies, your therapist can disclose your information to other clinicians who are working in the same organization. Some reasons your therapist might do this is for supervisory training purposes or if your partner or child are being seen at the same agency by another therapist. If you are using your health insurance as a payee or for reimbursement, most insurance companies require the ICD service code and a diagnostic code. It is important to know your HIPAA rights so that you are aware of when your health information must be shared without your consent.
What is in your client file?
Depending on your therapist, your file will look slightly different at each agency. However, there is necessary information that needs to be in every file you have opened under your name. Knowing what should be in your file will help you recognize if your therapist is on track to being HIPAA compliant and protecting your rights. You should also understand that you have the right to access this information upon request. You should have a confidentiality contract between you and your therapist. They should go over your rights to confidentiality and the specific incidences when confidentiality can be broken. Your therapist should have you fill out a personal data form where you disclose certain demographics and histories about yourself. Your therapist should also ask you to sign a release form for any other healthcare provider you are involved with that may help in your treatment with your therapist. For example, if you are coming to your sex therapist for erection issues, signing a release form with your urologist and therapist is imperative to the work that both your sex therapist and your urologist are doing with you. Another example is if you are on medication for depression, you should sign a release form for the healthcare provider that is providing you with the medication. Your file should have something signed by you to where you agree to the fees, and where you are informed about the therapist’s cancellation policy and any extra fees you may encounter in your treatment.
What you do not see up front, but that is still in your file is the therapist’s evaluation of you. After meeting with you 1-3 times, the therapist should be able to create an in-depth assessment of your presenting problem and a treatment plan with goals that they involve you in the making. Your therapist will also be writing progress notes each time they see you for a session. Progress notes are brief; they indicate who was seen and when, what you discussed in the session and targeted interventions used, and then the therapist’s interpretation of what is happening, the progress that is being made, and how it relates to the treatment goals. The therapist then records the plan that you and they came up with for the following session.
Your file will also contain any outside interaction with you or other healthcare providers. If you make a phone call or send an email/text, the therapist should be recording that this happened. If the therapist discusses medication with your psychiatrist, the therapist should be recording this conversation in your file. The therapist should also keep any additional paperwork that they receive from other providers in your file.
What is recorded, but not in your file?
The therapist might keep what is called “psychotherapy notes” on you. These side notes that allow the therapist to remember specific facts about you that are important in maintaining rapport with you, but not important to your overall treatment goals or mental health status. An example of something that your therapist might record is to remember to check in on how your child’s birthday party went the following session. The therapist may also write down hypotheses or hunches they have. These notes are separate from your file and protected by HIPAA in that they are not able to be released to anyone else, including the courts unless you specify precisely. You should understand that you do not have the right to access this information, that this is for the use of your therapist only.
How is your file protected?
Different healthcare organizations put in place certain safeguards to ensure that your information is not illegally distributed for the purposes of conducting and introducing risk management policies. That testing and developing contingency plans are done in a standard way, that certain third parties have restricted access, and reporting security incidents are done in a standard way. Therapists must reasonably limit how they use and disclose their clients’ medical information to accomplish their intended purpose, which is to treat you. Procedures must be put in place to restrict which parties may access your records, and they must provide proper training for their employees so that they are aware of the guidelines set in place by HIPAA’s Privacy and Security Rules. To maintain their license and remain in good standing by their ethics boards, all healthcare providers must be HIPAA compliant. For an agency to be HIPAA compliant, they must abide by specific guidelines set forth by the U.S. Department of Health and Human Services. Whether your therapist keeps their records in paper files or electronically, they are regulated for how to store the files, who can see the data, and how long they must keep the records after discharging you.
Where to report HIPAA violations and how do you file a complaint?
The U.S Department of Health and Human Services has made it easy for clients to submit health information privacy or security claims. You can physically write and mail your complaints, e-mail, or file complaints through the OCR Complaint Portal which is located on HIPAA’s website. You must make sure that your complaint is filed within 180 days of the incident or when you obtained the knowledge of said violation. This window can be extended if you can show “good cause,” in other words, you must have a good reason why you needed the extra time to submit your complaint. Your HIPAA rights protect you from retaliation from your therapist, and if you are a victim of any retaliation, then you should notify OCR immediately. If you have any more questions regarding HIPAA violations and your rights you can call our therapists and they will help you tease through the information on HIPAA’s website.
