Question:
Answer: As a first step, decide in consultation with the psychiatric professionals involved what records the facility will maintain, and what records only the psychiatric professional will maintain, advises Heather O. Berchem, an attorney with Murtha Cullina LLP, in New Haven, Conn. The distinction is important because the facility is responsible under HIPAA only for those records maintained by the facility. And the psychiatric professionals will be responsible for complying with HIPAA regarding records they maintain, she says.
Important: If the facility will maintain any records of this type of treatment, it should consult state laws, Berchem advises. "Many states do have laws that provide more protection than HIPAA regarding certain types of psychiatric records," she notes. If state law does cover records maintained by the facility, it may specify additional requirements for releasing the records and wording that must accompany any such record when it is released, or other requirements, Berchem notes.
Also keep in mind that HIPAA itself provides special protection for psychotherapy notes. "For example, the authorization for release of psychotherapy notes cannot be combined with a general authorization for release of other types of records," says Berchem. "The HIPAA definition of 'psychotherapy notes,' however, is extremely limited and applies only to notes by a mental health professional documenting or analyzing the contents of conversation during a counseling session that are maintained separately from the medical record," Berchem adds.
Know the exclusions: "'Psychotherapy notes' under HIPAA do not include summaries of diagnoses, functional status, treatment plans, symptoms, prognosis or progress to date," Berchem instructs. And "usually long-term care facilities do not maintain 'psychotherapy notes' as defined under HIPAA."
The facility may want to consider credentialing the psychiatric care providers, Berchem says. "If these providers serve in roles other than direct treatment -- for example, serving as a member of a quality assurance, medical staff, or other committee or in a consulting capacity -- then the facility should enter into a HIPAA business associate agreement with the psychiatric professionals or group."