Clinically Reviewed By Nitasha Strait, Ph.D., M.Ed., MA, LMFT, CST
What does HIPAA mean, and how does HIPAA relate to you so you can know your HIPAA rights?
HIPAA stands for “The Health Insurance Portability and Accountability Act” of 1996 and is part of the Social Security Act. The purpose of this Act is to protect the privacy of your healthcare information. Before you stand up for your rights, you need to know your HIPAA rights.
What information is protected under HIPAA?
You should be aware that any medical records kept by your therapist are meant to remain confidential, including conversations, types of treatment and when you were treated, and certain billing information. Any information disclosed during your sessions will be documented for you to have smooth transitions between therapists and other health professionals. You should also know your HIPAA rights for any legal purposes. Understanding when these rights to confidentiality can legally be overridden is pivotal in the work that you will be doing with your therapist.
How does HIPAA work for couples therapy or family therapy?
In most cases, your core HIPAA rights don’t change just because you’re in Couples or Marriage Counseling or family therapy. However, how your information is handled can feel different because there’s more than one person involved. HIPAA still protects your privacy and limits who your provider can share information with, but in relational therapy the “client” may be the couple or family unit, and therapists often set clear policies up front about communication, access to the record, and what happens if one person shares something privately. The most important step is to ask your therapist how they manage confidentiality in couples/family work (including individual check-ins, emails/texts, and record access), so everyone understands the boundaries and expectations from the start.
What rights are covered by HIPAA?
You have the right to receive a notification about how your records are being distributed, and you can decide who may receive them. Therapists must get a signed release form indicating that you, the client, were informed of where your information was going and how it was being used before they may use their information for purposes outside of your treatment, such as marketing or for research purposes. You have the right to view and receive a copy of your health records within a thirty-day period. You may request edits to these files whenever you see fit.
If any of of your HIPAA rights are violated, then you can file a complaint straight to your health care provider or to the U.S Department of Health and Human Services. HIPAA was created with the intention to protect not only your rights but also to make sure that your therapist is acting in a standardized way that protects both of you.
Can HIPAA ever be legally broken?
There are a handful of situations where your therapist may be required to break confidentiality, mainly when a client shares information that could harm themselves or vulnerable populations. Who are these vulnerable populations? Confidentiality must be broken if a client is at risk of endangering a population that is unable to protect themselves, like minors, the disabled, and the elderly.
At most private practices, your therapist can disclose your information to other clinicians who are working in the same organization. Some reasons your therapist might do this are for supervisory training purposes or if your partner or child is being seen at the same agency by another therapist.
If you are using your health insurance as a payee or for reimbursement, most insurance companies require the ICD service code and a diagnostic code. It is important to know your HIPAA rights so that you are aware of when your health information must be shared without your consent.
What is in your client file?
Depending on your therapist, your file will look slightly different as there are multiple ways your therapist can take notes or write treatment plans. However, there is necessary information that needs to be in every file you have opened under your name. Knowing what should be in your file will help you recognize if your therapist is on track to being HIPAA compliant and protecting your rights. You should also understand that you have the right to access this information upon request.
What you do not see up front but that is still in your file is the therapist’s evaluation of you. After meeting with you 1-3 times, the therapist should be able to create an in-depth assessment of your presenting problem and a treatment plan with goals that they involve you in the making. Your therapist will also be writing progress notes each time they see you for a session.
Progress notes are brief; they indicate who was seen and when, what you discussed in the session and targeted interventions used, and then the therapist’s interpretation of what is happening, the progress that is being made, and how it relates to the treatment goals. The therapist then records the plan that you and they came up with for the following session.
How do I learn about my HIPAA rights?
You should have a confidentiality contract between you and your therapist. They should go over your rights to confidentiality and the specific instances when confidentiality can be broken. Your therapist may have you fill out a personal data form in which you disclose certain demographic and personal history information. Your file should include a signed statement from you agreeing to the fees and confirming that you are informed about the therapist’s cancellation policy and any additional fees you may incur during your treatment.
How does my therapist share my information with another provider?
If you want to release any information to anyone outside of your therapeutic relationship, your therapist should also ask you to sign a release form. For example, if you are coming to your sex therapist for erection issues, signing a release form with your urologist and therapist is imperative to the work that both your sex therapist and your urologist are doing with you. Another example is if you are on medication for depression, you should sign a release form for the healthcare provider that is providing you with the medication.
Your file will also contain any outside interaction with you or other healthcare providers. If you make a phone call or send an email/text, the therapist should be recording that this happened. If the therapist discusses medication with your psychiatrist, the therapist should be recording this conversation in your file. The therapist should also keep any additional paperwork that they receive from other providers in your file.
What is recorded but not in your file?
The therapist might keep what are called “psychotherapy notes” on you. These side notes allow the therapist to remember specific facts about you that are important for maintaining rapport but not for your overall treatment goals or mental health status. An example of something that your therapist might record is to remember to check in on how your child’s birthday party went the following session. The therapist may also write down hypotheses or hunches.
Psychotherapy notes are separate from your file and protected by HIPAA in that they are not able to be released to anyone else, including the courts, unless you specify precisely. You should understand that you do not have the right to access this information and that it is for your therapist’s use only.
How is your psychotherapy file protected?
Different healthcare organizations put in place certain safeguards to ensure that your information is not illegally distributed for the purposes of conducting and introducing risk management policies. That testing and developing contingency plans are done in a standard way, that certain third parties have restricted access, and reporting security incidents is done in a standard way. T
herapists must reasonably limit how they use and disclose their clients’ medical information to accomplish their intended purpose, which is to treat you. Procedures must be put in place to restrict which parties may access your records, and they must provide proper training for their employees so that they are aware of the guidelines set in place by HIPAA’s Privacy and Security Rules. To maintain their license and remain in good standing by their ethics boards, all healthcare providers must be HIPAA compliant.
For a practice to be HIPAA compliant, it must abide by specific guidelines set forth by the U.S. Department of Health and Human Services. Whether your therapist keeps their records in paper files or electronically, they are regulated for how to store the files, who can see the data, and how long they must keep the records after discharging you.
Where to report HIPAA violations and how do you file a complaint?
The U.S Department of Health and Human Services has made it easy for clients to submit health information privacy or security claims. You can physically write and mail your complaints, e-mail, or file complaints through the OCR Complaint Portal, which is located on HIPAA’s website.
You must make sure that your complaint is filed within 180 days of the incident or when you obtained the knowledge of said violation. This window can be extended if you can show “good cause”; in other words, you must have a good reason why you needed the extra time to submit your complaint.
Your HIPAA rights protect you from retaliation by your therapist, and if you are a victim of retaliation, you should notify OCR immediately. If you have any more questions regarding HIPAA violations and your rights, you can call our therapists, and they will help you tease through the information on HIPAA’s website.