Health Information Compliance Alert

Question: At our psychology practice, we often have group therapy sessions. How does HIPAA fit in when patients’ health information is shared with other patients in the group setting?

North Dakota Subscriber

Answer: The HHS Office for Civil Rights (OCR) offers guidance on this exact subject and notes that group therapy is a type of treatment and includes a treatment disclosure.

“Disclosures of protected health information in a group therapy setting are treatment disclosures and, thus, may be made without an individual’s authorization,” OCR explains. “Furthermore, the HIPAA Privacy Rule generally permits a covered entity to disclose protected health information to a family member or other person involved in the individual’s care.”

However, “where the individual is present during the disclosure, the covered entity may disclose protected health information if it is reasonable to infer from the circumstances that the individual does not object to the disclosure,” OCR continues. “Absent countervailing circumstances, the individual’s agreement to participate in group therapy or family discussions is a good basis for inferring the individual’s agreement.”