Permitted disclosures of mental health information and substance use disorder information without patient consent

To:	Psychiatric hospital executives and administrators, inpatient behavioral health administrators, involuntary treatment experts, legal counsel, and government affairs staff.
From:	Jaclyn Greenberg, JD, LLM, Policy Director, Legal Affairs JaclynG@wsha.org, 206- 216-2506
Subject:	Permitted disclosures of mental health information and substance use disorder information without patient consent

Purpose

The purpose of this bulletin is to provide psychiatric hospitals and acute care hospitals with inpatient behavioral health programs or that accept Single Bed Certification guidance on when they may disclose information related to mental health and substance use disorder (SUD) treatment to a patient’s family and other close relations without the patient’s consent.

Under state and federal privacy laws, the disclosure of personal health information generally requires patient consent. However, certain disclosures are permitted without consent, such as to notify a close relation of the patient’s location and general condition.

Applicability/Scope

All hospitals are subject to federal and state privacy laws, including HIPAA and RCW 70.02.

Hospitals that also provide SUD diagnosis, treatment or referral are also subject to 42 CFR Part 2, the federal law governing the confidentiality of substance use records.

Recommendation

1. Review this bulletin with legal counsel and consider whether any changes are needed to your hospital policies or procedures regarding the disclosure of a patient’s mental health, substance use disorder or co-occurring disorder-related information to family, close relations and caregivers.
2. Review this bulletin with appropriate staff and educate them about when they may release information, what information may be released, and to whom. Potential staff include frontline care staff, department administrators, and clinical staff.

Overview

WSHA has heard of examples of hospitals declining to share any information with family about loved ones who are receiving involuntary mental health treatment under the Involuntary Treatment Act. Although consent (also referred to as authorization) is generally required to use or disclose personal health information, Washington’s medical privacy law, RCW 70.02 and the federal privacy law, HIPAA, explicitly permit disclosure of certain information in limited circumstances to certain narrow categories of people.

Several variables determine when information may be released, including whether:

• The information is related solely to mental health treatment, or includes substance use-related information;
• The patient has capacity; and
• The patient is an adult or minor.

1. Adult patients—permitted disclosures of mental health information to “close relations” without consent. In general, under RCW 70.02.205 and HIPAA, when a family member or other persons “in a close relationship” seek health care information, including mental health information, about an adult patient, the law permits disclosure if:

• • The disclosure is directly relevant to the close relation’s involvement in the patient’s care; or
  • The disclosure is for purposes of notifying the close relation of the patient’s location, general condition or death.

The purpose for disclosure	Directly relevant to recipient’s involvement with, or payment related to, the patient’s health care. OR Notifying or assisting in notification about patient’s location, general condition, or death. This includes disclosure of information to identify or locate a close relation in order to provide them with a notification.
To whom information may be disclosed	For disclosures related to a person’s involvement with a patient’s care, the use or disclosure may be to a patient’s family member, including: state registered domestic partner other relative a close personal friend, or another person identified by the patient For disclosures related to notification about a patient’s location, general condition or death, the use or disclosure may be to the patient’s: family member personal representative, or another person responsible for the care of the patient
When information can be disclosed	The patient is incapacitated or unavailable. The patient is not present or obtaining the patient’s authorization or providing the opportunity to agree or object to the use or disclosure is not practicable due to the patient’s incapacity or an emergency circumstance. The health care provider or health care facility may in the exercise of professional judgment, determine whether the use or disclosure is in the best interests of the patient and disclose only information that is directly related to the family or friend’s involvement in the patient’s health care or payment for care. OR The patient has capacity to consent and does not object or lack of objection can be inferred. If the patient is present and has capacity at the time the information is shared, the health care provider or health care facility can make reasonable inferences about a patient’s consent to sharing of information based on the patient’s lack of objection when the information is shared, or based on a history of involvement in the patient’s care from friends and caregivers.
What information may be disclosed	The information disclosed may include the patient’s diagnoses, treatment recommendations, issues concerning safety and safety plans, risk factors for suicide, and available community resources. The information disclosed should be limited to the minimum necessary the accomplish the purpose of the disclosure.

References: RCW 70.02.205 and 45 CFR §§ 164.510

The above framework applies to health care information generally and includes mental health information specifically.

Categorizing “mental health information.” This phrase is a shorthand for what RCW 70.02 defines as “Information and records related to mental health services.” [i]  One useful way to categorize whether a certain record falls within this definition is to look to the information’s source.[ii] Generally, records created or maintained by a mental health provider or psychiatric hospital are considered “mental health information” even if those records contain general healthcare information. However, for acute care hospitals and other generalized settings only the records created by mental health providers would be considered “mental health information.” Psychotherapy notes are not mental health information; they are separately and more strictly protected.

2. Adult patients – disclosures of substance use treatment information require consent. The privacy rules for SUD treatment programs are controlled by federal law under 42 CFR Part 2, which contains much stricter privacy requirements than HIPAA or RCW 70.02. Generally, no disclosure of any patient information or records related to SUD treatment, including the fact that the patient has been admitted, can be made without a patient’s written consent. The written consent requirements are detailed and should be reviewed carefully.

While Part 2 does permit certain disclosures without patient consent, such as for a bona fide medical emergency to medical personnel, none apply to the release of information to family or close relations. Recent and upcoming changes to Part 2 rules have not changed this.

3. Minor patients—permitted disclosures of mental health information without consent.
   
   I. General rules. The use and disclosure of minor’s mental health information is governed by RCW 70.02.240. Under that section:

• • Mental health information may be shared with a minor’s parents, including those acting as a parent, as that term is broadly defined in RCW 71.34.020 for purposes of Family-Initiated Treatment.
  • A minor’s guardian, next of kin, or conservator can be informed that the minor is presently in the facility or that the minor is seriously physically ill. This may include a statement evaluating the mental and physical condition of the minor and information about the probable duration of the minor’s confinement.
  • The next of kin may also be informed of the minor’s death

II. Rules related to disclosing mental health information related to Adolescent Initiated Treatment and Family Initiated Treatment under RCW 71.34. In addition to RCW 70.02.240, there are specific rules related to when information may be disclosed to parents, family and others in the context of treatment options under the state’s Behavioral Health Services for Minors statute, RCW 71.34. This includes Adolescent Initiated Treatment and Family Initiated Treatment.

• • Applicability by age range. Under Washington law, a minor is any person under the age of eighteen. Under RCW 71.34, an adolescent is a minor a person who is age 13 to 17. This section refers to permitted disclosures of adolescents, who may consent to their own mental health treatment.
  • Adolescent Initiated Treatment. A mental health professional, working with an adolescent who is voluntarily receiving mental health treatment, should not proactively release information or records to a parent unless the adolescent states a clear, documented desire to do so or there is an imminent threat to the health and safety of the adolescent or others. If a mental health professional discloses mental health information of an adolescent to a parent, the mental health professional must provide notice of this disclosure to the adolescent and the adolescent must have a reasonable opportunity to express any concerns about this disclosure to the mental health professional prior to the disclosure. Any objections to disclosure must be documented in the adolescent’s medical record.

• • Family Initiated Treatment. When an adolescent receives a mental health evaluation or treatment at the direction of a parent, the mental health professional is encouraged to exercise his or her discretion to proactively release to the parent such information and records related to mental health services received by the adolescent, excluding psychotherapy notes, that are necessary to assist the parent in understanding the nature of the evaluation or treatment and in supporting their child.

4. Minor patients—disclosures of substance use treatment information generally require written patient consent. Under state law, a minor’s information or records about their substance use-related admission, evaluation or treatment may be provided to a parent only if the minor provides written consent or if permitted under federal law, namely two narrow exceptions under 42 CFR Part 2. The below information may be disclosed to a parent, guardian, or other individual authorized under state law to act in the minor’s behalf.

• • For minors under 13, the mere fact of the minor’s application for treatment may be disclosed if the minor lacks capacity to “make a rational choice” regarding providing written consent to disclosure “because of extreme youth or mental or physical condition to make a rational decision on whether to consent to disclosure.” This exception applies when state law requires parent consent for SUD treatment. Since parental consent is not required for adolescents over 13 under Adolescent Initiated Treatment, this exception does not appear to be available for patients in this age group. This means, written consent by the patient is required if the patient is aged 13 or older.
  • Relevant facts about a minor’s treatment may be disclosed to reduce a “substantial threat to the life or physical well-being of the minor or any other individual” if the minor lacks capacity to make a rational choice regarding consent, the minor’s situation poses a substantial threat to the life or physical well-being of the minor or any other individual and communicating relevant facts will reduce the threat.
  • Rules for seeking written consent under Adolescent Initiated Treatment and Family Initiated Treatment. A mental health professional or chemical dependency professional providing substance use disorder evaluation or treatment to an adolescent may seek the written consent of the adolescent to provide such information or records to a parent when her or she has determined that both seeking the written consent and sharing the substance use disorder treatment information or records would not be detrimental to the adolescent.

5. Other disclosures. For purposes of disclosing mental health information to family or other close relations, two additional permitted two disclosures may be relevant.

• • Disclosures in the case of a serious and imminent threat. No consent is necessary to disclose personal health care information generally if it would lessen or prevent a “serious and imminent threat to the health or safety of a person or the public,” and the information is disclosed only to a person or people who are able to prevent the threat, including the target of the threat. There is a further permitted disclosure specifically for mental health information if the disclosure is to a person whose “health and safety has been threatened, or who is known to have been repeatedly harassed by the patient.”

These categories of permitted disclosures refer to a provider’s “duty to protect,” commonly referred to as the “duty to warn.” This area of law is unsettled. Hospitals are advised to consult legal counsel for specific cases raising concerns of threat or harassment.

• • Disclosure of information and records for forensic patients. Forensic patient records are subject to the same disclosure laws as other hospitalized patients under RCW 70.02 and do not require any special consent for release or disclosure.

Background and References

State and federal privacy laws generally prohibit disclosing a patient’s personal health information without their consent, including information relating to the person’s mental health, substance use and co-occurring disorder related treatment. There are permitted disclosures without patient consent but they are narrowly drawn and depending on the patient’s age, the type of treatment they are seeking/receiving, and the patient’s capacity.

Mental health information. HIPAA sets the baseline level of privacy rules and allows state privacy laws that are more protective to the patient to govern. In the case of the use and disclosure of mental health information, HIPAA does not prescribe specific rules but RCW 70.02 does. Therefore, state law governs the use and disclosure of mental health information, although it mostly coincides with HIPAA’s general rules for disclosure without patient authorization.

Note that the U.S. Department of Health and Human Services (HHS) released a proposed rule amending HIPAA in December 2020 that if it were to become law, would broaden the standards for permitted disclosures. However, RCW 70.02, as the more protective statute, would continue to govern. See here for a summary of the proposed rule changes.

References in the bulletin:

• 02.050 – Disclosure without patient’s authorization—Need-to-know basis.
• 02.205 – Disclosure without patient’s authorization – Persons with close relationship
• 02.265 – Adolescent behavioral health services—Disclosure of treatment information and records—Restrictions and requirements
• 02.230 – Mental health services, confidentiality of records – Permitted disclosures
• 02.240 – Mental health services—Minors – Permitted disclosures
• 77.210 – Right to adequate care and treatment—Records and reports. (Forensic)
• 45 CFR § 164.512 – Uses and disclosures for which an authorization or opportunity to agree or object is not required.
• 45 CFR § 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object.
• WSHA Bulletin – Changes to RCW 71.34
• Bree Collaborative – Risk of violence to others report and recommendations

There are several other potentially relevant sections of RCW 70.02 detailing disclosure of solely mental health information. There are also internal inconsistencies within these sections of the statute. Hospitals are advised to consult legal counsel for specific cases.

Substance use-related information. For SUD (and co-occurring disorder information), the federal law and regulations regarding the Confidentiality of Substance Use Disorder Patient Records under 42 CFR Part 2, apply. Part 2 protects the confidentiality of information relating to a patient’s identity, diagnosis, prognosis or treatment with any federally assisted SUD Program that provide substance abuse education, prevention, training, treatment, rehabilitation, or research. Part 2 SUD Programs include approved SUD treatment programs, evaluation and treatment facilities such as freestanding psychiatric hospitals, and general medical facilities that provide SUD diagnosis, treatment, or referral for treatment.

Unlike HIPAA and RCW 70.02, Part 2 was not originally structured to facilitate the appropriate exchange of personal health information while also maintaining patient privacy and confidentiality. Part 2 SUD Programs are generally prohibited from disclosing any information that would identify a person as having or having had a SUD without the person’s written consent. Written consent is required from the patient is almost all cases, even if that patient is a minor.

References in the bulletin:

• 42 CFR § 2.31 – Consent requirements.
• 42 CFR § 2.14 – Minor patients.
• 42 CFR § 2.20 – Relationship to state laws.
• More information about 42 CFR Part 2 can be found here.
• WSHA Bulletin – Disclosure of SUD records during COVID-19

The Substance Abuse and Mental Health Services Administration (SAMHSA) recently issued new regulations in August 2020, updating parts of Part 2 with the goal of easing some of the more rigid requirements and increasing coordination with HIPAA. However, nothing in the final rule changes the general requirement for consent—it modifies how the consent may be provided and what it can authorize, among other changes.

• See Fact Sheet: SAMHSA 42 CFR Part 2 Revised Rule.

Additional changes to Part 2 are coming in 2021. Under Section 3221 of the CARES Act, the third federal stimulus bill to address the current public health emergency, there are several significant changes to Part 2, including the long sought-after objective of better alignment with HIPAA. Among the key provisions, Section 3221 modifies the written consent requirements to contemplate that once written consent is obtained, the SUD records may be used/disclosed by any covered entity, business associate or SUD program for purposes of treatment, payment or operation, as permitted under HIPAA. To the extent this change can be thought of as permitted disclosures, it does not appear to extend to disclosures to family. Rulemaking for Part 2 to implement these changes is forthcoming in 2021.

• For an analysis on these changes, see Manatt – The Cares Act Brings Key Changes to the SUD Confidentiality Statute

[i] Under RCW 70.02.010 (23), “Information and records related to mental health services” means a type of health care information that relates to all information and records compiled, obtained, or maintained in the course of providing services by a mental health service agency or mental health professional to persons who are receiving or have received services for mental illness. The term includes mental health information contained in a medical bill, registration records, as defined in *RCW 70.97.010, and all other records regarding the person maintained by the department, by the authority, by behavioral health administrative services organizations and their staff, managed care organizations contracted with the authority under chapter 74.09 RCW and their staff, and by treatment facilities. The term further includes documents of legal proceedings under chapter 71.05, 71.34, or 10.77 RCW, or somatic health care information. For health care information maintained by a hospital as defined in RCW 70.41.020 or a health care facility or health care provider that participates with a hospital in an organized health care arrangement defined under federal law, “information and records related to mental health services” is limited to information and records of services provided by a mental health professional or information and records of services created by a hospital-operated community behavioral health program as defined in RCW 71.24.025. The term does not include psychotherapy notes.

[ii] The idea for a source-based definition comes from the Washington State Health Information Management Association.