Health Insurance Portability and Accountability Act (HIPAA)
Patient Notification of Privacy Rights
THIS NOTICE DESCRIBES HOW YOUR MENTAL HEALTH RECORDS MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.
The Licensing Laws of the State of Tennessee provide privileged
communication protections for conversations between your therapist and
you in the context of your established professional relationship with your
therapist. There is a difference between privileged conversations
and documentation in your mental health records. Records are kept
documenting your care as required by law, professional standards, and other
review procedures. HIPAA very clearly defines what kind of information
is to be included in your “designated medical record” as well
as some material, known as “Psychotherapy Notes” which is not
accessible to insurance companies and other third-party reviewers,
and in some cases, not to the patient himself/herself.
HIPAA provides privacy protections regarding your personal health information,
which is called “protected health information,” which could
personally identify you. PHI consists of three (3) components: treatment,
payment, and health care operations.
Treatment refers to activities in which I provide, coordinate
or manage your mental health care or other services related to your mental
health care. Examples include a psychotherapy session, psychological
testing, or talking to your primary care physician about your medication
or overall medical condition.
Payment is when I obtain reimbursement for your mental health
care. The clearest example of this parameter is filing insurance
on your behalf to help pay for some of the costs of the mental health services
provided to you.
Health care operations are activities related to the performance
of my practice such as quality assurance. In mental health care,
the best example of health care operations is when utilization review occurs,
a process in which your insurance company reviews our work together to
see if your care is “medically necessary.”
The use of your protected health information refers to activities
my office conducts in filing your claims, scheduling appointments, keeping
records and other tasks within my office related to your care. Disclosures refers
to activities you authorize which occur outside my office, such
as the sending of your protected health information to other parties (i.e.,
your primary care physician, the school your child attends).
- Uses and Disclosures of Protected Health Information (PHI)
The State of Tennessee requires authorization and consent for treatment,
payment and health care operations. HIPAA does nothing to change
this requirement by law in Tennessee. I may disclose PHI for the
purposes of treatment, payment and healthcare operations with your consent. You
have signed this general consent to care and authorization to conduct payment
and health care operations, authorizing me to provide treatment and to
conduct administrative steps associated with your care (i.e., file insurance
Additionally, if you ever want me to send any of your protected health
information of any sort to anyone outside my office, you will always first
sign a specific authorization to release information to this outside party. A
copy of that authorization form is available upon request. The requirement
that you sign an additional authorization form is an added protection to
help insure your protected health information is kept strictly confidential. An
example of this type of release of information might be your request that
I speak with your physician about your treatment and/or medications. Before
I talk to that physician, you will first have signed the proper authorization
for me to do so.
There is a third, special authorization provision potentially relevant
to the privacy of your records: my psychotherapy notes. In
recognition of the importance of the confidentiality of conversations between
therapist-patient in treatment settings, HIPAA permits keeping ‘psychotherapy
notes’ separate from the overall ‘designated medical record.” ‘Psychotherapy
notes’ cannot be secured by insurance companies, nor can they
insist upon their release for payment of services. “Psychotherapy
notes’ are my notes and are defined as follows: “ notes
recorded in any medium by a mental health provider documenting and analyzing
the contents of a conversation during a private, group or joint family
counseling session and that are separated from the rest of the individual’s
medical record.” “Psychotherapy notes” are necessarily
more private and contain much more personal information about you; hence,
the need for increased security of the notes. “Psychotherapy
notes’ are not the same as your “progress notes’ which
provide the following information about your care each time you have an
appointment at my office: assessment/treatment start and stop times,
the modalities of care, frequency of treatment furnished, results of clinical
tests, and any summary of your diagnosis, functional status, treatment
plan, symptoms, prognosis and progress to date.
Certain payors of care, such as Medicare and Workers Compensation, require
the release of both your progress notes and psychotherapy notes in order
to pay for your care. If I am forced to submit your psychotherapy
notes in addition to your progress notes for reimbursement for services
rendered, you will sign an additional authorization directing me to release
my psychotherapy notes. Most of the time I will be able to
limit reviews of your PHI to only your “designated record set” which
includes the following: all identifying paperwork you completed at
your initial visit, all billing and reimbursement information, a summary
of our first appointment, your mental status and progress notes for each
session, your treatment plan, discharge summary, reviews by managed care
companies, results of psychological testing, and any authorizations you
have signed. Please note that the actual test questions or raw data
of psychological tests are not part of your ‘designated
mental health record set.
You may, in writing, revoke all authorizations to disclose PHI at any
time. You cannot revoke an authorization to disclose PHI that has
already been disclosed, or an authorization that was obtained as a condition
for obtaining insurance in cases where Tennessee law provides the insurer
the right to contest the claim under the policy.
Business Associates Disclosures
HIPAA requires that I train and monitor the conduct of those performing
ancillary administrative services for my practice and refers to these people
as “Business Associates.” These include our secretaries, telephone
answering service, health insurance billing service and collection agency. These
business associates need to receive some of your PHI in order to do their
jobs properly. To protect your privacy they have agreed in their
contract with us to safeguard your information in accordance with state
and federal standards.
Uses and Disclosures Not Requiring Consent nor Authorizations
By law, PHI may be released without your consent or authorization
in the following instances:
- Child abuse
- Suspected sexual abuse of a child
- Adult and domestic Abuse
- Health oversight activities (i.e. licensing boards investigations)
- Judicial or administrative proceedings (i.e., court ordered treatment
- Serious threat to health or safety (i.e., Duty to Warn law, national
- Workers Compensation claims (if you seek to have your care reimbursed
under Workers Compensation, all of your care is automatically subject
to review by your employer and/or insurer(s).
No information will ever be released for any sort of marketing purposes.
Patient’s Rights and My Duties
You have a right to the following:
right to request restrictions on certain uses and disclosures of
your PHI. I may or may not agree to these restrictions, but if
I do, they shall apply unless our agreement is changed in writing.
The right to receive confidential communications by alternative means
and at alternative locations. For example, you may not want
your bills sent to your home address so I will send them to another location
of your choosing.
The right to inspect and receive a copy of your PHI in the designated
mental health record set foras long as PHI is maintained in the record.
The right to amend material in your PHI, although I may deny
an improper request and/or respond to any amendment(s) you make to your
record of care.
The right to an accounting of non-authorized disclosures of your PHI.
The right to a paper copy of notices/information from me, even
if you have previously requested electronic transmission of same.
The right to revoke any authorization of your PHI except to the
extent that action has already been taken.
For more information on how to exercise each of the rights, please do
not hesitate to ask me for further assistance. I am required by law
to maintain the privacy of your protected health information and to provide
you with a notice of your Privacy Rights and my duties regarding your PHI. I
reserve the right to change my privacy policies and practices as needed. Current
practices are applicable unless you receive a revision of my policies at
a future time. My duties as a therapist include maintaining the privacy
of your PHI, providing you with this notice of your rights and my privacy
practices with respect to your PHI, and abiding by the terms of this notice
unless it is changed and you are so notified.
I am the appointed “Privacy Officer” for my practice per HIPAA
regulations. If you have any concerns that your privacy rights have
been compromised, please let me know immediately. You may also send
a written complaint to the Secretary of the U.S. Department of Health and
The notice shall be effective April 14, 2003.
Association Of Behavioral Counselors PLLC.
367B North Parkway Suite 1
Jackson, TN. 38305