HIPAA Mental Health and Substance Abuse Privacy Rules 3 — Questions and Answers
Question 1: A therapist believes their patient may harm a specific identified third party. Under HIPAA's 'duty to warn' provisions, what is permitted?
- Disclosure is never allowed regardless of threat
- Disclosure to law enforcement or the potential victim is permitted to prevent serious harm (Correct answer)
- Only the patient's family may be notified
- The therapist must obtain a court order first
Correct answer: Disclosure to law enforcement or the potential victim is permitted to prevent serious harm
HIPAA permits disclosure of PHI to prevent serious and imminent threat to the health or safety of a person or the public, including notifying law enforcement or the potential victim.
Question 2: Under 42 CFR Part 2, can a patient's SUD records be used against them in a criminal investigation?
- Yes, with a court order
- No, Part 2 prohibits use of SUD records to investigate or prosecute patients (Correct answer)
- Yes, but only for violent crimes
- Yes, if the prosecutor subpoenas the records
Correct answer: No, Part 2 prohibits use of SUD records to investigate or prosecute patients
42 CFR Part 2 explicitly prohibits the use of SUD treatment records to investigate or prosecute patients for any crime committed before or during treatment.
Question 3: A health plan requests mental health records for utilization review. Without specific authorization, a covered entity may release:
- Complete therapy session notes
- Only the minimum necessary PHI, excluding psychotherapy notes (Correct answer)
- All records if the request is in writing
- Nothing — health plans cannot access mental health records
Correct answer: Only the minimum necessary PHI, excluding psychotherapy notes
For healthcare operations like utilization review, a covered entity may release the minimum necessary PHI but must exclude psychotherapy notes, which always require specific authorization.
Question 4: A minor seeks confidential substance abuse counseling in a state that allows minors to consent to such treatment. Under HIPAA, who controls the PHI?
- The minor's parents always control the PHI
- The minor controls the PHI when they have the legal right to consent to the treatment (Correct answer)
- The treating provider controls all minor PHI
- The state government determines PHI control
Correct answer: The minor controls the PHI when they have the legal right to consent to the treatment
When a minor has the legal right under state law to consent to treatment, HIPAA generally gives the minor the right to control their PHI for that treatment.
Question 5: Which of the following is a key difference between HIPAA's mental health protections and 42 CFR Part 2?
- HIPAA applies only to government agencies; Part 2 applies to private providers
- Part 2 requires patient consent for nearly all disclosures; HIPAA allows more routine sharing (Correct answer)
- HIPAA has stricter penalties than Part 2
- Part 2 only covers inpatient psychiatric facilities
Correct answer: Part 2 requires patient consent for nearly all disclosures; HIPAA allows more routine sharing
42 CFR Part 2 requires patient consent for nearly all disclosures of SUD records, whereas HIPAA permits disclosure for treatment, payment, and operations without specific authorization.
Question 6: A covered entity receives a valid authorization to release a patient's mental health records. The entity notices the records include psychotherapy notes. What should they do?
- Release everything under the single authorization
- Release only the general mental health records; psychotherapy notes require a separate specific authorization (Correct answer)
- Deny the entire request and ask for a new authorization
- Contact the patient's attorney before releasing anything
Correct answer: Release only the general mental health records; psychotherapy notes require a separate specific authorization
Psychotherapy notes require their own specific authorization separate from general mental health records, even when a valid authorization has been obtained for other records.
Question 7: Under the CARES Act of 2020, 42 CFR Part 2 was amended to allow SUD records to be used for which purpose without patient consent?
- Marketing pharmaceutical products
- Payment and healthcare operations by entities that received consent at admission (Correct answer)
- Employment background checks
- Life insurance underwriting
Correct answer: Payment and healthcare operations by entities that received consent at admission
The CARES Act allowed Part 2 programs to use SUD records for payment and healthcare operations purposes — similar to HIPAA — when a general consent was obtained at the time of admission.
HIPAA Mental Health and Substance Abuse Privacy Rules 3
A therapist believes their patient may harm a specific identified third party.
Under HIPAA's 'duty to warn' provisions, what is permitted?