HIPAA Mental Health and Substance Abuse Privacy Rules 4 — Questions and Answers
Question 1: A psychiatric hospital wants to include a patient's mental health diagnosis in the facility directory. Under HIPAA, what must occur first?
- The treating psychiatrist must approve
- The patient must be given the opportunity to restrict or prohibit directory listing (Correct answer)
- The hospital board must vote to approve the policy
- The patient must sign a HIPAA authorization form
Correct answer: The patient must be given the opportunity to restrict or prohibit directory listing
Under HIPAA's facility directory provision, patients must be given the opportunity to restrict or prohibit the inclusion of their information in the directory before it is used.
Question 2: An employer contacts a covered behavioral health provider requesting an employee's mental health records. Under HIPAA, the provider may release records:
- Immediately upon the employer's written request
- Only with the employee's valid written authorization (Correct answer)
- If the employer has a business associate agreement
- If the records are for workers' compensation only
Correct answer: Only with the employee's valid written authorization
Mental health records may only be released to an employer with the patient's valid written authorization, as employers are not typically covered entities with treatment relationships.
Question 3: Which scenario represents a HIPAA-compliant disclosure of mental health PHI for public health purposes without patient authorization?
- Sharing records with a researcher studying medication efficacy
- Reporting a patient's diagnosis to a public health authority to prevent disease spread (Correct answer)
- Disclosing records to a pharmaceutical company for marketing
- Providing records to a state medical board investigating a complaint
Correct answer: Reporting a patient's diagnosis to a public health authority to prevent disease spread
HIPAA permits disclosure of PHI to public health authorities for activities like preventing or controlling disease, even without patient authorization.
Question 4: A substance abuse counselor at a federally assisted program receives a court order to disclose patient records under 42 CFR Part 2. What additional requirement must be met?
- A second court order from a higher court
- The court order must use procedures that give adequate patient notice and opportunity to respond (Correct answer)
- The patient's attorney must be present
- The state health department must co-sign the order
Correct answer: The court order must use procedures that give adequate patient notice and opportunity to respond
Under 42 CFR Part 2, a court order authorizing disclosure must include procedures that provide the patient with adequate notice and an opportunity to seek a protective order.
Question 5: A covered entity is asked to provide mental health records for a civil lawsuit in which the patient is a plaintiff claiming emotional distress damages. The patient has NOT authorized release. What applies?
- The records must be released because the patient put their mental health at issue
- The covered entity must review state law and may require a court order (Correct answer)
- The records are always protected and cannot be released
- The opposing attorney can access the records directly
Correct answer: The covered entity must review state law and may require a court order
When a patient puts their mental health at issue in litigation, state law may allow disclosure, but the covered entity should require a court order or valid authorization and consult applicable law.
Question 6: Under HIPAA, a patient requests an amendment to their psychotherapy notes claiming they are inaccurate. The provider may deny this request if:
- The notes were created more than two years ago
- The psychotherapy notes were created by the provider and the provider disagrees they are inaccurate (Correct answer)
- The patient has already received a copy of the notes
- The notes contain information from a third party
Correct answer: The psychotherapy notes were created by the provider and the provider disagrees they are inaccurate
A covered entity may deny an amendment request to psychotherapy notes if the notes were created by the covered entity and the provider determines the information is accurate and complete.
Question 7: A 42 CFR Part 2 program wants to report a patient's SUD treatment information to their state prescription drug monitoring program (PDMP). This disclosure:
- Is always allowed because PDMPs are government agencies
- Requires patient consent unless a specific state law or exception applies (Correct answer)
- Is prohibited under all circumstances
- Is allowed for any schedule II substance only
Correct answer: Requires patient consent unless a specific state law or exception applies
Disclosing Part 2 records to a PDMP generally requires patient consent unless state law specifically authorizes the disclosure or another Part 2 exception applies.
HIPAA Mental Health and Substance Abuse Privacy Rules 4
A psychiatric hospital wants to include a patient's mental health diagnosis in the facility directory.
Under HIPAA, what must occur first?