HIPAA Requirements Affecting the Initial Informed Consent Conversation

Any mental health professional who electronically transmits patient-identifiable information will have legal requirements under HIPAA.

Under the HIPAA Regulations, psychotherapists are legally responsible for informing prospective patients about certain rights in a “Notice of Privacy Practices.

*NOTE: some of these require the “Notice” to be amended to include setting-specific information.  For example, the first item requires amending the form to include (1) state-specific information, including state laws that can limit confidentiality; and (2) setting-specific limits of confidentiality, including access by other clinicians and by non-clinical staff; and confidentiality risks created by the use of electronic technology.

• Right to be informed in advance about the provider’s privacy/confidentiality policies;*
• Right to obtain access to their own records;
• Right to place certain conditions on how they are to be contacted;
• Right to request limitations on disclosures;
• Right to obtain documentation of disclosures made with or without patient consent
• Right to request amendments to their records
• Right to file grievances

In addition, the “Notice of Privacy Practices” must include a statement such as this:  “Uses and disclosures not described in this Privacy Notice will be made only with your authorization.”  (see HIPAA “Omnibus Rule”.)

In other words, any disclosure of confidential information that the prospective patient was not informed about in the initial “Notice of Privacy Practices” will require obtaining the patient’s explicit consent at the time of the disclosure.  This means the initial “Notice of Privacy Practices” must include an accurate description of the actual disclosure policies and potential confidentiality limits in the setting, making it very important for practitioners to use a setting-specific “Notice,” not a “canned” HIPAA form.

NOTE:  The HIPAA Notice of Privacy Practices is NOT an Informed Consent Form.  A signature on that form simply documents that the “Notice” was received; it does not give consent for anything.  Furthermore, unless significantly amended by the psychotherapist, it does not include information required for informing patients before obtaining consent for psychotherapy.

You can view this page here: https://centerforethicalpractice.org/hipaa-required-initial-notices/

(2019)