For those who work in fields that require HIPAA compliance - I’m looking for opinions.

20 Comments

1. AnonymousMay 1,2024 at 12:27PM UTC

   Do you have internal legal counsel or compliance that you could reach out to for guidance and clarification?

2. AnonymousMay 1,2024 at 12:28PM UTC

   The DON isn't a third party provider though. She works at your job with you where the patients currently receive care. Why would she need special HIPAA to see the notes? As DON, doesn't she have an obligation to monitor and ensure quality of care at the facility?

3. AnonymousMay 1,2024 at 12:38PM UTC

   This is the answer, HIPAA applies to third parties. Not applicable in the situation you defined. Please folks. Get up to speed on this issue before pontificating about HIPAA violations.

4. Kate HopkinsMay 1,2024 at 1:02PM UTC

   I disagree - we aren't pontificating. HIPAA applies to the providing organization as well. If I work somewhere and access a medical record without a valid reason under HIPAA, that's a violation. I have worked at many places where employees have been fired because they improperly accessed medical records without a valid reason.

   So yes, the request of this DON is definitely a potential HIPAA violation.

5. Kate HopkinsMay 1,2024 at 12:56PM UTC

   She does - but having unfettered access to patient records isn't the way to monitor and ensure quality of care. There are quality assurance processes structures for doing this. This would include access to records for the person tasked with doing QA. But "send me your weekly therapy notes so I can keep on top of what is going on" isn't a structured QA process.

6. Cynthia Armistead NewmanMay 1,2024 at 12:34PM UTC

   It's been a few years since my HIPAA training (I no longer work with healthcare data), so I can't remember. Is it a legal violation, not just an ethical one? I'd be extremely cautious here!

7. Kate HopkinsMay 1,2024 at 12:52PM UTC

   You're 100% correct - she shouldn't have unfettered access to patient's medical records without a valid reason - e.g. treatment, billing and a few other categories. That holds true even if she is a leader with the organization. I've been a healthcare leader for decades and I can't imagine a situation where I would request this level of access.

   Here's the pertinent HHS info on this (look under permitted uses and disclosures):

   https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html

   Talk with your compliance officer for backup (hopefully not her!)

8. Terrie McWhorterMay 1,2024 at 2:28PM UTC

   You are the provider. You can chat with her about your medical opinion on each patient but NO she does NOT have the right to go through your notes without an ROI. Not only is it unethical, it is not HIPAA compliance that she is going for here!!!

9. AnonymousMay 1,2024 at 3:06PM UTC

   The DON at the assisted living facility requesting your
   mental health therapy notes weekly without a ROI signed by the clients is not
   in compliance with HIPAA rules. Here’s a breakdown of why:
   1. The HIPAA Privacy Rule protects the PHI. Sharing
   PHI without the individual's explicit consent or a valid legal requirement
   generally constitutes a violation. Mental health therapy notes are considered PHI and are afforded additional protections under HIPAA.

   2. Under HIPAA, even when PHI disclosure is permitted, it should be limited to the "minimum necessary" to accomplish the intended purpose​​.
   Sharing comprehensive therapy notes likely exceeds what is necessary for the DON to perform her duties.

   3. While HIPAA does allow for the disclosure of PHI for treatment activities without specific consent, sharing detailed therapy notes with the DON does not typically fall under these categories without a clear, defined need that aligns with the facility’s operations directly related to the individual's treatment​​.

   4. Beyond HIPAA, sharing therapy notes without consent may violate ethical guidelines established by mental health professional bodies, which typically emphasize client confidentiality and only allow disclosure with client consent, except in specific circumstances (such as imminent risk of harm).

   5. The best approach is to explain to the DON that:
   a. You are bound by both legal and ethical obligations to protect
   the confidentiality of your clients.
   b. Any sharing of detailed notes would require an ROI from each client.
   c. You can discuss general treatment issues in a way that does not disclose specific PHI, or better yet, only discuss clients’ care with the DON with express permission from the clients themselves.

   If the DON insists on accessing the therapy notes without client consent and an appropriate ROI, it may be advisable to seek guidance from a legal professional or your professional liability insurance provider to ensure that you adhere to HIPAA regulations and professional ethical standards. It’s also prudent to document all these interactions for your records.

10. RiaMay 1,2024 at 4:25PM UTC

    Well said

11. RiaMay 1,2024 at 4:25PM UTC

    This is troublesome. You should absolutely NOT release therapy notes to the Director of Nursing. Its a serious HIPAA violation as well as a breach of the therapists patient confidentiality. Only the patient can consent (or conservator/guardian if patient is not competent to consent) to the release of their medical/therapy records. You need to escalate this to the nursing facility's general counsel.

12. Brandon AndersonMay 2,2024 at 12:30PM UTC

    People want to know everything about you if they find you interesting…

13. AnonymousMay 2,2024 at 1:35PM UTC

    I think you replied to the wrong thread. Just wanted to let you know so your advice can get to the intended recipient. :)

14. AnonymousMay 2,2024 at 1:57PM UTC

    Im trying to understand the DOH’s angle.
    Why does she want this data? What does the DOH want to know about the data? Is she expecting to see specific files or trends across the population? Is she looking to use this data to establish programs that are more tailored to their mental health, for example? (Does anyone here know what she wants this info for? )

    Aside from the legal aspects... If the purpose is to use information to improve care, that can (and is likely legally required to) be achieved in other ways. Are there studies that you can point her to that address what she wants to know?

    id suggest a mentor to
    help you navigate this closely. whatever you say, it’ll have to be in writing and with tact. Sometimes what happens when you tell colleagues “no” (especially for something that they want) they act out with subtle forms of retaliation.

15. Lori GoldenMay 2,2024 at 2:05PM UTC

    I would imagine your superior legally and automatically has access to any clinical notes from her area of responsibility.

16. Liz MilneMay 2,2024 at 5:36PM UTC

    I would have a conversation with her: as the person in charge overall, she presumably needs to know if anyone might harm themself or others, or if they've expressed medical symptoms to you that they haven't told the home staff.

    But, yes, medical info should only be shared with those who need to know, so a ROI, if the patient is of sound mind, or sight of a medical POA, if not. Something you can hold up if you're ever questioned as to why you shared info?

    Not sure of US rules/ laws, but I think that's reasonable?

17. AnonymousMay 2,2024 at 5:55PM UTC

    Yeah, that's a pretty hard no. That would violate the patient's privacy. I would ask her to outline for you her thinking and purpose for wanting the notes. As a provider, I'm not sure you can even say if the patient has self harm ideations.

18. Kimberly HMay 2,2024 at 6:20PM UTC

    Hi. I worked in LTC/AL for almost a decade as a dietitian. If you are documenting in the residents medical record that the AL utilizes (example Point Click Care) then she is free to review them there. However, if you are seeing the residents outside of the AL, I do not see any reason why you would provide external chart notes to her on a weekly basis. I hope this helps clarify the situation? This is how it was always done in the states that I worked (I was a corporate dietitian and practiced in 9 states), and any outside provider only sent back recommendations, orders, or feedback.

    Thank you!

19. Jessica FerlandMay 3,2024 at 1:02PM UTC

    What is a DON? Director of Nursing?

20. BarbaraMay 3,2024 at 4:15PM UTC

    Ethical violations! Nope! ??