privacy medical hipaa mental-health
Are documents generated by the patient part of psychotherapy notes under HIPAA?
<p>HIPAA defines psychotherapy notes as follows (emphasis added):</p>

<blockquote>
  <p><em>Psychotherapy notes means notes <strong>recorded</strong> (in any medium) <strong>by a health care provider</strong> who is a mental health professional documenting or analyzing the contents of <strong>conversation during a private counseling session</strong> or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.</em></p>
</blockquote>

<p>If a health care provider asks a patient to provide personal documents relevant for therapy (for example, "bring your diary to the next session" or something like that), is the content of these documents considered as protected under HIPAA as well? After all, one might argue that such documents are:</p>

<ol>
<li>Not <em>medical</em> by nature at the time they are generated</li>
<li>Not recorded by the provider, but by the patient</li>
<li>Not generated <em>during</em> a counseling session</li>
</ol>

<p>Under <a href="https://www.ecfr.gov/cgi-bin/retrieveECFR?gp=&amp;SID=4099d471e883009f7b7cd7cb5e48ac9f&amp;mc=true&amp;n=pt45.2.164&amp;r=PART&amp;ty=HTML#sp45.2.164.e" rel="nofollow noreferrer">45 CFR 164.502</a>, </p>

<blockquote>
  <p>A covered entity or business associate may not use or disclose
  protected health information, except as permitted or required by this
  subpart or by subpart C of part 160 of this subchapter</p>
</blockquote>

<p>PHI is defined in <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=4099d471e883009f7b7cd7cb5e48ac9f&amp;mc=true&amp;node=pt45.2.160&amp;rgn=div5#se45.2.160_1103" rel="nofollow noreferrer">45 CFR 160.103</a>:</p>

<blockquote>
  <p>Protected health information means <strong>individually identifiable health
  information</strong>: (1) Except as provided in paragraph (2) of this
  definition, that is: (i) Transmitted by electronic media; (ii)
  Maintained in electronic media; or (iii) Transmitted or maintained in
  any other form or medium. (2) Protected health information excludes
  individually identifiable health information: (i) In education records
  covered by the Family Educational Rights and Privacy Act, as amended,
  20 U.S.C. 1232g; (ii) In records described at 20 U.S.C.
  1232g(a)(4)(B)(iv); (iii) In employment records held by a covered
  entity in its role as employer; and (iv) Regarding a person who has
  been deceased for more than 50 years.</p>
</blockquote>

<p>A diary is not necessarily personally identifiable, but let us say the patient writes his name in the diary, so that it is. "Health information" is also defined:</p>

<blockquote>
  <p>Health information means any information, including genetic
  information, whether oral or recorded in any form or medium, that: (1)
  Is created or <strong>received by a health care provider</strong>, health plan, public
  health authority, employer, life insurer, school or university, or
  health care clearinghouse; and (2) <strong>Relates to the past, present, or
  future physical or mental health or condition of an individual</strong>; the
  provision of health care to an individual; or the past, present, or
  future payment for the provision of health care to an individual.</p>
</blockquote>

<p>A patient diary is not necessarily a professional diagnosis, but it does relate to mental health. Therefore, the diary is PHI, and is subject to the privacy rule. PHI isn't defined in terms of the reason for writing something down, or the time that it is written, or who wrote it: it is about having a relationship to a persons health.</p>

<p>The definition of psychotherapy notes is mostly tangential. Although a patient has a right to access his PHI per 45 CFR 164.524, there is an exception for psychotherapy notes, that a patient does <em>not</em> have a right to notes recorded by a mental health professional. Also note that</p>

<blockquote>
  <p>Psychotherapy notes excludes medication prescription and monitoring,
  counseling session start and stop times, the modalities and
  frequencies of treatment furnished, results of clinical tests, and any
  summary of the following items: Diagnosis, functional status, the
  treatment plan, symptoms, prognosis, and progress to date.</p>
</blockquote>

<p>That is, the other stuff that the mental health professional record other than specifically their professional notes is excluded from the psychotherapy notes category, which was created to exclude patient access. But it is still PHI (there is no paragraph that excludes psychotherapy notes from the scope of PHI).</p>
