Key Privacy Protections

• Confidentiality of Mental Health Information: HIPAA protects all PHI, including standard mental health records (diagnoses, treatment plans, progress notes) and psychotherapy notes. Psychotherapy notes are highly sensitive and must be kept separate from the rest of the medical record legalclarity.org.

• Psychotherapy Note Rules: These notes are defined as personal records of a mental health professional documenting or analyzing a private counseling session. They require specific patient authorization for most uses and disclosures, with limited exceptions legalclarity.org.

• Patient Rights: Clients have the right to access and request corrections to their PHI, request restrictions on use/disclosure, and receive an accounting of disclosures. Access generally does not include psychotherapy notes legalclarity.org.

When Information Can Be Shared
Therapists may share PHI with others involved in a person’s care if:

• The patient has consented.

• The patient has been given an opportunity to object and has not objected.

• The patient is incapacitated (e.g., unconscious, delirious, intoxicated, experiencing psychosis) GoodTherapy.

Special Situations

• Family Members: HIPAA allows sharing with family members or others involved in care, but the patient’s capacity to consent must be considered HHS.gov.

• Safety and Imminent Harm: Therapists may disclose to family, law enforcement, or others if there is a serious and imminent threat of harm to self or others HHS.gov.

• Emergency Psychiatric Holds: Disclosure to law enforcement is permitted when a patient is taken into custody for an emergency psychiatric hold HHS.gov.

Compliance Responsibilities

• Covered Entities: Must implement HIPAA policies, train staff, and ensure secure handling of PHI :HIPAA Journal.

• Business Associates: If a counselor works with a third party (e.g., billing company), that party must comply with HIPAA’s Privacy and Security Rules :HIPAA Journal.

• State Laws: Some states have stricter mental health confidentiality laws; therapists must follow the more stringent rules: hipaapartners.com.

In summary: Therapists and counselors must protect all PHI, especially psychotherapy notes, follow patient consent requirements, and share information only when legally permitted or when the patient cannot consent. Staying compliant ensures patient trust, avoids penalties, and supports effective treatment.