Possible Legal Barriers for PCP Access to Mental Health Treatment Records

  • Leslie S. Rothenberg
  • David A. Ganz
  • Neil S. Wenger


Provider and payer groups have endorsed the goal of improving the integration of primary care and behavioral health across a variety of programs and settings. There is an interest in sharing patients’ medical information, a goal that is permissible within HIPAA, but there are concerns about more restrictive state medical privacy laws. This article assesses whether a substantial number of state medical privacy laws are, or could be interpreted to be, more restrictive than HIPAA. Preliminary investigation found that in almost one third of the states (including large-population states such as Florida, Georgia, Massachusetts, New York, and Texas), primary care physicians (PCPs) may have difficulty accessing mental health treatment records without the patient’s (or his/her guardian/conservator’s) written consent. If a comprehensive legal analysis supports this conclusion, then those advocating integration of behavioral and primary care may need to consider seeking appropriate state legislative solutions.


Mental Health Behavioral Health Behavioral Health Care Behavioral Health Provider Covered Entity 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


The strong relationship between mental illness and physical health, and the recognition of the importance of mental health care, led to efforts to “return mental health care to the mainstream of American medicine,” beginning in the 1960s with the community mental health movement and congressional passage of the Community Mental Health Centers Act.1 However, as Druss notes, “the promise of greater integration between medicine and mental health was never fulfilled, due to a combination of limited financial resources, weak organizational ties to general hospitals, and a philosophy that emphasized social rather than medical models of mental illness.”2 (p. 198)

While much emphasis has been placed on the potential benefits of integrating behavioral health care, there has been less focus on the challenges to achieving such a goal. These challenges include limited opportunity for primary care providers and behavioral health professionals to develop working relationships, the stigma that both patients and non-mental health providers may attribute to mental health care, and providers’ concern about “confidentiality, territoriality, and fear of scrutiny by other professionals…”3 (pp. 121–122) In addition, primary care providers and behavioral health professionals may have differing views about what constitutes appropriate care, including how much time to spend with patients and how to foster behavior change most effectively.4 As observed by Kessler, “There has been such a long history of mental health existing in an insulated silo, that specialty behavioral care continues to be the most pervasive model and is rewarded and financed for just being there with little attention to outcomes or relevance.”5 (p. 70)

The Institute of Medicine in 2001, as part of a broader effort to improve quality in the U.S. health care system, recommended among other steps that “[c]linicians and institutions should actively collaborate and communicate to ensure an appropriate exchange of information and coordination of care.”6 (p. 9) In the context of mental/behavioral health, this recommendation found more specificity in the Institute’s 2006 report, Improving the Quality of Health Care for Mental and Substance-Use Conditions. After highlighting the separate worlds in which mental health treatment providers and primary medical treatment providers operated and the co-occurrence of mental health [and substance-use] problems and illnesses with chronic general medical illnesses, the report made numerous recommendations designed to facilitate the “sharing of patient information across providers treating the same patient so that care can be coordinated.”7 (p. 232)

In perhaps the most important development, as has been suggested by Croft and Parrish,8 (p. 258) three elements of the Affordable Care Act9—“increasing access, restructuring financing and reimbursement mechanisms, and enhancing infrastructure”—may provide significant momentum toward facilitating the integration of physical and behavioral health care. Both the Substance Abuse and Mental Health Services Administration and the National Council for Behavioral Health have outlined in greater detail the potential impact on patients, insurance plans, and behavioral health care workers and facilities.10 , 11

Additionally, Barry and Huskamp12 argue that the Affordable Care Act’s “expansions of Medicaid, [and] the creation of health insurance exchanges with subsidies for low-income people” together with the ACA’s “emphasis on integrated care models, including patient-centered medical homes and accountable care organizations (ACOs)” (pp. 973–974) may provide the financing and delivery system changes necessary to improve both the coordination and quality of mental health and addiction treatment.

The integration anticipated by these various plans and strategies, however, depends on not only the willing cooperation of the health professionals involved but also on the ability of those professionals to access each other’s records when treating mutual patients, whether for behavioral health or general health issues. The 2006 Institute of Medicine report referenced earlier contained the following caution:

The bottom line is that clinicians providing treatment to individuals with M/SU [mental health/substance use] illnesses must comply with multiple sets of rules governing the release of information: one prescribed federally and pertaining to information on treatment for alcohol or drug problems, state laws that pertain to information on health care for mental and substance-use conditions (depending upon whether they are more stringent than the federal rules), and other policies prescribed by the organization or multiple organizations under whose auspices patient care is provided.7 (p. 233)

Included as an appendix to the 2006 report is a study by Prof. Timothy Jost titled, “Constraints on Sharing Mental Health and Substance-Use Treatment Information Imposed by Federal and State Medical Records Privacy Laws,” that “examines the interaction between these bodies of law, reviewing the federal HIPAA [Health Insurance Portability and Accountability Act of 1996] regulations, state statutes that govern mental health medical records privacy, and the federal statute governing confidentiality of substance abuse records.”7 (p. 405)

The legal constraints to which Jost refers were created by Congress in the statute establishing HIPAA and the regulations that would be issued under its authority. In the HIPAA statute (Pub. L. 104–191, title II, § 264, Aug. 21, 1996, 110 Stat. 2033, ¶ (c)(2)), Congress inserted a provision that permitted state medical record privacy laws that were more stringent (or restrictive) than those in the HIPAA regulations to take precedence over HIPAA. The HIPAA regulations (45 C.F.R. § 160.203(b)) acknowledge that reality by noting that HIPAA only preempts state laws that are less stringent than HIPAA. Those state laws that are more stringent or provide greater medical privacy than HIPAA preempt HIPAA.7 (p. 407)

In Jost’s conclusion, he noted the reality that many state laws governing the disclosure of mental health records (reflecting perhaps the historical social stigmas attached to mental health) were far more restrictive than those governing other types of medical records, and that those laws might well be judged to be more stringent than the HIPAA regulations. If that conclusion were reached, it would inhibit coordinated treatment in such states by both primary medical and mental health providers, regardless of national agendas to promote such coordination. Jost urged that both federal and state lawmakers and regulators consider this legal policy dilemma and achieve a thoughtful balance between the need for the confidentiality of mental health records and the need to make such information available to primary care providers caring for the same patients.7 (p. 417)

Because a “comprehensive legal analysis” of these issues was beyond the scope of his project, Jost noted that his study was solely “intended to identify the major issues raised by the interaction between the laws of the various states and federal law.”7 (p. 405) Since the publication of Jost’s work, a “comprehensive legal analysis” of these issues, although desirable, does not appear to have been completed. In the interim, a preliminary and somewhat informal evaluation of state laws concerning disclosure of mental health records could be done, if only to provide further support for the importance of doing a full-blown study of the issues at a later date.

The objective of this project was to examine the current state laws (plus those of the District of Columbia) with regard to the disclosure of mental health information without patient consent in order to test Jost’s hypothesis: “A substantial number of state medical privacy laws are, or could be interpreted as being, more restrictive than HIPAA [particularly 45 C.F.R. §164.506(c)(2) (“(2) A covered entity may disclose protected health information for treatment activities of a health care provider.”)].” This provision is part of what is often called HIPAA’s “TPO” (treatment, payment, and operations) exception to the usual requirement for consent to access records.


Because Jost’s study was published in 2006 and is based on data “obtained from the state law database of the Health Privacy Project, www.healthprivacy.org7 (p. 405) whose latest edition was published in 2002,13 a two-step protocol was devised:
  1. 1)

    Using LexisNexis Academic, a legal researcher reviewed the latest versions of all the state statutes mentioned in the Health Privacy Project that were considered relevant to the question of whether a psychiatrist or psychologist in that state could provide access to the mental health treatment record [excluding, as the HIPAA provision does, psychotherapy notes and substance abuse treatment records] of a patient to the patient’s primary care physician (PCP) without consent; reviewed all of Jost’s conclusions with regard to those same states; and formed an initial and independent conclusion as to whether the state statute(s) could be interpreted as being more restrictive or stringent than HIPAA and thus would preempt the HIPAA provision (45 C.F.R. § 160.203(b)); and

  2. 2)

    The researcher then sought by phone and/or email a second (and, occasionally, a third) local opinion on the question from a lawyer in one of two cohorts: (a) a state legal advisor to the state mental health agency or an assistant state attorney general who usually provided such legal advice to such agencies [selected from the Legal Division Members list of the National Association of State Mental Health Program Directors] or (b) a private health care lawyer from that state with experience in HIPAA and medical privacy questions [selected from the membership list of the American Health Lawyers Association]. State legal advisors were contacted initially, and only if they did not respond or if their conclusion about the restrictiveness of their own state law was uncertain, were private health care lawyers contacted. Ultimately, more than 60 public and private lawyers participated and were generous in providing pro bono opinions. Some state legal advisors indicated that they were unable to offer even a personal and informal opinion to parties who were not governmental clients of their office.


In the event of a difference of opinion between the researcher and the state lawyer(s) and to try to assure the reliability of these interpretations, the researcher always adopted the view of the public and/or private lawyers in the state whose laws were being reviewed as to the relevant statutes or administrative regulations and their proper characterization on the assumption that they would have a more accurate view of the local interpretation of that law, not simply in theory but in practice. They often had a first-hand view of how the state mental health agency and local behavioral health providers and their professional societies were interpreting the laws. This became a critical factor in several instances where public lawyers were familiar with administrative regulations on which their state mental health agency was relying and in one state where the mental health privacy law was clearly more restrictive in its language but was seen by a reliable observer as being ignored in practice by many of its providers because of its perceived complexity.


Table 1 provides a broad overview of the results from a survey of the 50 states plus the District of Columbia (which has its own medical privacy laws). Using a simple “YES” (the state laws are judged to be less restrictive or stringent than HIPAA and do not preempt) or “NO” (the state laws are judged to be more restrictive or stringent than HIPAA and do preempt) determination, it was found that 32 (63%) of the 51 jurisdictions were judged, both by statutory language and/or the local legal opinion(s), to be less restrictive or stringent with regard to this specific HIPAA provision; 15 (29%) were similarly judged to be more restrictive or stringent and thus could be said to preempt this HIPAA provision; and 4 (8%) were judged to be individual combinations of both more and less restrictive.
Table 1

Informal survey results of state (and district) medical privacy laws


Preliminary determination

Relevant law(s)/comment



Ala Code §§ 22-56-4(b)(6) and 22-56-10



Alaska Stat §§ 18.23.310, 47.30.590 and 47.30.845(1)



Ariz Rev Stat §§ 12-2294(c)(1), 12-2292, 36-509(A)(1)



No relevant statute, but regs agree (AR DHS §4009.3.2.5(C)(1))



Cal Civ Code § 56.10(c)(1) and Welf & Inst Code § 5328(a)



Colo Rev Stat Ann § 27-65-121(1)(a)



Conn Gen Stat § 52-146f(1), (2) (restrictive language, requires notice to patient and review)



Del Code Ann tit. 16, § 5161(13) (requires consent or court order)



D C Code Ann. § 7-1203.01 (restrictive language)



Fla Stat Ann § 394.4615 (requires consent or court order)



Ga Code Ann § 37-3-166 (requires consent/medical emergency)



Haw Rev Stat §§ 323B-3(a), 333E-6(a), 333F(a), and 334-5



Idaho Code § 66-348(2) and IDAPA §



740 Ill Comp Stat § 110/9(1) (restrictive language)



Ind Code Ann § 16-39-2-6(a)(1)(A)(iii)



Iowa Code § 228.2(a)(3) (requires medical emergency or consent)



Kan Sta. Ann §§ 65-6825(a)(2) and 65-6828



Ky Rev Stat Ann § 210.235(4)(a)



No relevant statute



Me Rev Stat Ann tit 34-B, § 1207(9)(A)



Md HEALTH-GEN Code Ann §§ 4-305(b)(4), 4-307


NO as to inpatients, YES as to outpatients

Mass Gen Laws ch 123, § 36



Mich Comp Laws § 330.1748(6)(a) (requires consent or medical emergency)



Minn Stat Ann § 144.293 (requires consent or medical emergency)



Miss Code Ann § 41-21-97(c)



Mo Rev Stat § 630.140(3)(2)



Mont Code Ann § 53-21-166(1) and 50-16-801



Neb Rev Stat § 38-2136(1) (requires consent)



Nev Rev Stat § 433A.360 (requires consent)



N H Rev Stat Ann § 135-C:19-a (requires consent/review)



N J Stat Ann § 30:4-24.3 and N J A C §§ 10:37-6.79(f) & 13:42-8.3(f)(4)



N M Stat Ann §§ 43-1-19(B) and 32A-6A-24(C),(D)(1)



N Y MENTAL HYG § 33.13(7)(requires consent)



N C Gen Stat §§ 90-21.20B(e) and 122C-55(a1)



N D Cent Code § 25-03.1-43



Ohio Rev Code Ann §§ 5122.31(A)(2) and (A)(7)



Okla Stat tit 43A §1-109(E)(1)



Or Rev Stat § 179.505(6)



55 Pa Code § 5100.32(a)(1)



R I Gen Laws § 40.1-5-26(b)(2) (interpreted to require consent)



S C Code Ann § 44-22-100(4)



S D Codified Laws §§ 27A-12-26 & 27A-12-29(1)



Tenn Code Ann. § 33-3-105(5)



Tex Health & Safety Code Ann. § 611.004(7) (interpreted to require consent)



Utah Code Ann 58-60-114(2)(c), 62A-15-707(1)(c)



Vt Stat Ann tit 18 § 7103(b)



Va Code Ann §§ 32.1-127.1:03(D)(7) and 37.2-804.2



Wash Rev Code Ann § 70.02.230(2)(t)


NO in legal language, YES in practice

W Va Code §§ 27-3-1(b)(6) and (b)(7)



Wis Stat Ann § 51.30(4)(b)(8g)



Wyo Stat Ann § 25-10-122(b) and 35-2-609(a)(i)

Total YES 32 (63%), total NO 15 (29%), and total mixed YES/NO 4 (8%)

YES means the state laws are judged to be less restrictive or stringent than HIPAA and do not preempt

NO means the state laws are judged to be more restrictive or stringent than HIPAA and do preempt

aDepending on patient setting/status

Such an overview, however, misses the enormous variation in the language of the statutes and the capability of some of them to be subject to conflicting legal interpretations. In many instances, the statutory language is clear in terms of its relevance to being more or less restrictive than the HIPAA standard, but there are also numerous illustrations of wording that leave clarity to be desired. Table 2 provides specific examples of this diversity in legislative drafting.
Table 2

State statutory language

Statutes Interpreted to Permit Disclosure with Explicit Reference to HIPAA

 Arizona (Ariz Rev Stat § 12-2294(c)(1))(“45 Code of Federal Regulations, part 160 and part 164, subpart E”)

 Hawaii (Haw Rev Stat §323B-3(a))(“45 Code of Federal Regulations Part 164, Subpart E”)

 Kansas (Kan Stat Ann §65-6285(a)(2))(“45 C.F.R.. . .164.506”)

 Kentucky (Ky Rev Stat Ann §210.235(4)(b))(“federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191”)

 Missouri (Mo Rev Stat 630.140(3)(2))(“federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended”)

 North Carolina (N C Gen Stat §90-21.20B(e))(“45 C.F.R. § 164.506”)

 North Dakota (N D Cent Code § 25-03.1-43)(“title 45, Code of Federal Regulations, part 164”)

 Washington (Wash Rev Code Ann § 70.02.230(2)(t))(“federal health information portability and accountability act”)

Statutes Interpreted to Permit Disclosure with General Reference to Federal Law

 Ohio (Ohio Rev Code Ann §5122.31(a)(2))(“in accordance with other provisions of state or federal law authorizing such disclosures”)

 South Dakota (S.D. Codified Laws § 27A-12-26)(“in conformity with federal law)

Statutes Interpreted to Permit Disclosure with Specific Reference to Physicians, Health Care Providers or Continuity of Health Care

 Alaska (Alaska Stat § 47.30.845(1))(“a physician or a provider of health, mental health, or social and welfare services involved in caring for, treating, or rehabilitating the patient”)

 California (Cal Civil Code § 56.10(c)(1))(“providers of health care, health care service plans, contractors, or other health professionals or facilities for purposes of diagnosis or treatment of the patient”)

 Indiana (Ind Code Ann § 16-39-2-6(a)(1)(A)(iii))(“a health care provider or mental health care provider, if the mental health records are needed to provide health care or mental health services to the patient”)

 Maryland (Md HEALTH-GEN Code Ann § 4-305(b)(4))(“to another health care provider for the sole purpose of treating the patient or recipient on whom the medical record is kept”)

 Insert new state before New Jersey:Maine (Me. Rev. Stat. Ann. tit. 34-B, § 1207(9)(A) ("9. Disclosure for care management or coordination of care.  Notwithstanding any provision of this section to the contrary, a health care practitioner may disclose without authorization health information for the purposes of care management or coordination of care pertaining to a client as provided in this subsection. [A.] Disclosure is permitted to a health care practitioner or health care facility as defined in Title 22, section 1711-C, subsection 1.") New Jersey (N J Stat Ann § 30:4-24.3)(“to the patient’s personal physician…if it appears that the information is to be used directly or indirectly for the benefit of the patient”)

 Oklahoma (Okla Stat tit 43A § 109(E)(1))(“mental health information necessary to carry out another provider’s own treatment, payment, or health care operations”)

 Oregon (Or Rev Stat § 179.505(6))(“officers or employees of that provider, its agents or cooperating health care services providers who are currently acting within the official scope of their duties to evaluate treatment programs, to diagnose or treat or to assist in diagnosing or treating an individual when the written account is to be used in the course of diagnosing or treating the individual”)

 Vermont (Vt Stat. Ann tit 18 § 7103(b))(“to the individual’s…physician”)

 Virginia (Va Code Ann § 37.2-804.2)(“to any other health care provider or other provider evaluating or providing services to or monitoring the treatment of the person”)

 Wisconsin (Wis Stat Ann § 51.30(4)(b)(8g))(“To a health care provider, or to any person acting under the supervision of the health care provider who is involved with an individuals care, if necessary for the current treatment of the individual”)

Statutes Interpreted to Permit Disclosure with Broader Language

 Colorado (Colo Rev Stat Ann § 27-65-121(1)(a))(“In communications between qualified professional personnel in the provision of services or appropriate referrals”)

 Idaho (Idaho Code § 66-348(2) and IDAPA §“If disclosure may be necessary to carry out any of the provisions of this act” and in the Idaho administrative code provision cited: “Department employees and contractors may use and disclose records as necessary to perform normal business functions, including health treatment”)

 Mississippi (Miss Code Ann § 41-21-97(c))(“when necessary for the continued treatment of a patient”)

 Pennsylvania (55 Pa Code § 5100.32(a)(1))(“To those actively engaged in treating the individual”)

 Montana (Mont Code Ann § 53-21-166(1))(“in communications between qualified professionals in the provision of services or appropriate referrals”)

 South Carolina (S C Code Ann. § 44-22-100(4))(“when furthering the welfare of the patient”)

 Tennessee (Tenn Code Ann § 33-3-105(5))(“A service recipient moves from one service provider to another and exchange of information is necessary for continuity of service”)

 Utah (Utah Code Ann § 58-60-114(2)(c)) (“the disclosure is made under a generally recognized professional or ethical standard that authorizes or requires the disclosure”)

Statutes Interpreted to Not Permit Disclosure Despite Broader Language

 Minnesota (Minn. Stat. Ann. § 144.293(subd. 5)(2)(“to other providers within related health care entities when necessary for the current treatment of the patient”)(Subd. 5(1) provides an exemption “for a medical emergency when the provider is unable to obtain the patient’s consent due to the patient’s condition or the nature of the medical emergency”)

 Rhode Island (R.I. Gen. Laws § 40.1-5-26(b)(2)(“(b) Information and records may be disclosed only: (2) In communications among qualified medical or mental health professionals in the provision of services or appropriate referrals, or in the course of court proceedings. The consent of the patient, or his or her guardian, must be obtained before information or records may be disclosed by a professional person employed by a facility to a professional person not employed by the facility who does not have the medical responsibility for the patient’s care”)(subsection (b)(5) provides an exemption “To proper medical authorities for the purpose of providing emergency medical treatment where the person’s life or health are in immediate jeopardy”)

 Texas (Tex Health & Safety Code Ann § 611.004(7))(“to other professionals and personnel under the professionals’ direction who participate in the diagnosis, evaluation, or treatment of the patient”)

Statutes Interpreted to Require Consent with No Exemption for Treatment

 Delaware (Del Code Ann tit. 16, § 5161(13)(e))(“With the consent of the patient, or, if the patient is a minor, with the consent of a parent or legal guardian”)

 Florida (Fla Stat Ann § 394.4615(2)(a)(“(2) The clinical record shall be released when: (a) The patient or the patient’s guardian authorizes the release”)

 Georgia (Ga. Code Ann. § 37-3-166(a)(2)(“A copy of the record may be released to any person or entity designated in writing by the patient or, if appropriate, the parent of a minor, the legal guardian of an adult or minor, or a person to whom legal custody of a minor patient has been given by order of a court”)(Exemptions are provided in subsections (a)(1) “When the chief medical officer of the facility where the record is kept deems it essential for continued treatment, a copy of the record or parts thereof may be released to physicians or psychologists when and as necessary for the treatment of the patient” and in (a)(6) “In a bona fide medical emergency, as determined by a physician treating the patient, the chief medical officer may release a copy of the record to the treating physician or to the patient’s psychologist”)

 Iowa (Iowa Code § 228.2(3))(“However, mental health information may be transferred at any time to another facility, physician, or mental health professional in cases of a medical emergency or if the individual or the individual’s legal representative requests the transfer in writing for the purposes of receipt of medical or mental health professional services”)

Michigan (Mich Comp Laws § 330.1748(6)(d))(“if consent is obtained from the recipient, the recipient’s guardian with authority to consent, the parent with legal custody of a minor recipient, or the court-appointed personal representative or executor of the estate of a deceased recipient, information made confidential by this section may be disclosed to all of the following: (a) A provider of mental health services to the recipient”)(§ 7(c) provides an exemption “To a provider of mental or other health services or a public agency, if there is a compelling need for disclosure based upon a substantial probability of harm to the recipient or other individuals”)

 Nebraska (Neb. Rev. Stat. § 38-2136(1)(“With the written consent of the person”)

 Nevada (Nev. Rev. Stat. § 433A.360(1)(b))(“The record must be released to physicians. . .as specifically authorized in writing by the consumer, the consumer’s parent, guardian or attorney”)

 New Hampshire (N.H. Rev. Stat. Ann. § 135-C:19-a(I))(“Prior to the disclosure, the mental health center or facility shall request in writing the consent of the client. If consent cannot be obtained, the client shall be informed of the reason for the intended disclosure, the specific information to be released and the person or persons to whom the disclosure is to be made”)

 New York (N Y MENTAL HYG § 33.13(7))(“with the consent of the patient or client or of someone authorized to act on the patient’s or client’s behalf, to persons and entities who have a demonstrable need for such information and who have obtained such consent”)

Statutes Interpreted to Limit Disclosure to Mental Health Providers or To Require Prior Review and Notice to the Patient

 Connecticut (Conn Gen Stat § 52-146f(1))(“Communications or records may be disclosed to other persons engaged in the diagnosis or treatment of the patient or may be transmitted to another mental health facility to which the patient is admitted for diagnosis or treatment if the psychiatrist in possession of the communications or records determines that the disclosure or transmission is needed to accomplish the objectives of diagnosis or treatment. The patient shall be informed that the communications or records will be so disclosed or transmitted”)

 District of Columbia (D C Code Ann § 7-1203.01)(“(a) Mental health information may be disclosed to other individuals employed at the individual mental health facility when and to the extent necessary to facilitate the delivery of professional services to the client. (b) Mental health information may be disclosed by participating providers to other participating providers when and to the extent necessary to facilitate the delivery of mental health services and mental health supports to the consumer”)

Some states (such as Alabama, Arkansas, and Louisiana) appear to have no relevant statutes that could conflict with the HIPAA provision, although Alabama does provide a “right” to confidentiality for mental health records with the qualification that this right is no greater than the confidentiality afforded to medical records in general (see Ala Code §§ 22-56-4(b)(6) and 22-56-10). Yet other states have apparently attempted to make their state law compatible with the HIPAA provision and in the process created some confusion (see, e.g., 740 Ill Comp Stat § 110/9(1) which provides an exemption for disclosure to “the therapist’s supervisor, a consulting therapist, members of a staff team participating in the provision of services, a record custodian, a business associate, an integrated health system, a member of an interdisciplinary team, or a person acting under the supervision and control of the therapist”).

West Virginia (W Va Code § 27-3-1(b)(7)) specifically added an exemption with a reference to “the Privacy Rule of the federal Health Insurance Portability and Accountability Act of 1996, 45 C. F. R. § 164.506” and then proceeded to qualify the exemption by stating that it only applies “for thirty days from the date of admission to a mental health facility if: (i) The provider makes a good faith effort to obtain consent from the patient or legal representative prior to disclosure; (ii) the minimum information necessary is released for a specifically stated purpose; and (iii) prompt notice of the disclosure, the recipient of the information and the purpose of the disclosure is given to the patient or legal representative.” A knowledgeable reviewer from that state reports that many behavioral health providers found those qualifications so confusing that, in practice, they ignore them.

The failure to either include language regarding behavioral health outpatients or to distinguish outpatients and inpatients has led to instances where reviewers interpret disclosures under HIPAA as possible for one patient group and not the other solely based on where the patient was seen or treated (see, e.g., Massachusetts whose only applicable statute (Mass Gen Laws ch. 123, § 36) applies to inpatients and requires the head of its Department of Mental Health to approve any disclosure). Wyoming law has been interpreted as having a more restrictive confidentiality statute for inpatients requiring consent (Wyo Stat Ann § 25-10-122) and an exemption for disclosure in a statute for outpatients (Wyo Stat Ann 35-2-609(a)(i)).

Finally, there are differences within the same state’s laws not only in their perceived restrictiveness but also in how they address differences in the patient’s age. New Mexico has one statute (N.M. Stat. Ann. § 43-1-19(B)(1)) that provides an exemption only for “when the request is from a mental health or developmental disability professional or from an employee or trainee working with a person with a mental disability or developmental disability, to the extent that the practice, employment or training on behalf of the client requires access to such information is necessary” and another dealing with children (N.M. Stat. Ann. § 32A-6A-24) in which one subsection (C) requires consent from the child (fourteen years of age or older with capacity to consent) to consent to disclosure and another subsection (D)(1) exempts disclosure for children under age 14 when “necessary for treatment of the child and is made in response to a request from a clinician.”

Implications for Behavioral Health

If enhanced communication and collaboration among professionals are essential to the ultimate success of integrated behavioral health care, then access to patients’ medical records (unfortunately often the only vehicle for such discussions), regardless of the clinical setting and the titles of the professionals contributing to those records, is essential. Without ignoring all of the other previously discussed obstacles to that goal and not even considering electronic access challenges, state-erected barriers to such communication and collaboration in the form of excessively restrictive privacy laws may be truly insurmountable.

These restrictions and the confusing thicket of statutory language in many statutes not only affect primary care physicians and their allied health professionals but also impact psychiatrists, psychologists, psychiatric nurses, and social workers, and their colleagues. Perhaps their greatest impact, however, may be on behavioral health patients, on whose behalf these restrictive laws were enacted, and their families, particularly given that many of those patients may prefer to receive their care in the primary care setting.14 , 15

On a preliminary basis and focusing only on the perceived legal constraints, one reasonably can conclude that in almost one third of the states (including large-population states such as Florida, Georgia, Massachusetts, New York, and Texas), PCPs and other treatment professionals may have difficulty accessing mental health treatment records without the patient’s (or his/her guardian/conservator’s) written consent. If a comprehensive legal analysis supports this conclusion, then those advocating the goal of integrating behavioral and primary care may need to consider prioritizing the Institute of Medicine’s recommendation that “Federal and state governments should revise laws, regulations, and administrative practices that create inappropriate barriers to the communication of information between providers of health care for mental and substance-use conditions and between those providers and providers of general care.”7 (p. 249)

However, a majority of the states surveyed do not present legal access issues for primary care providers (PCPs) seeking to access patients’ mental health treatment records. (The past socialization and training of mental health professionals may present greater challenges in these states as mental health professionals often are not accustomed to collaborating with their primary care medical colleagues, and vice versa.)

Indeed, several state legislatures (prompted by the introduction of electronic health records and desiring to harmonize their existing medical privacy laws with HIPAA, if only to obviate the need for constant inquiries about potential differences) have found creative solutions to accomplish this goal. In perhaps the broadest and simplest approach, Hawaii in 2012 passed a provision that reads: “Notwithstanding any law to the contrary, any use or disclosure of individually identifiable health information by any covered entity or business associate that is permitted by 45 Code of Federal Regulations Part 164, Subpart E, shall be deemed to comply with all state laws relating to the use, disclosure, or confidentiality of such information.” (Haw Rev Stat § 323B-3(a))

Other states, such as Kansas and Oregon, have drafted narrower, more specific provisions. The relevant Kansas statutes reference specific sections of HIPAA and indicate that to the extent state statutes may be in conflict with these, the HIPAA sections are controlling. (Kan Stat Ann §§ 65-6825(a)(2) and § 65–6828) The Oregon statute simply addresses the specific issue of sharing medical records among treatment providers by providing an exemption to the state’s confidentiality statute when records are to be shared “to diagnose or treat or to assist in diagnosing or treating an individual when the written account is to be used in the course of diagnosing or treating the individual.” (Or Rev Stat § 179.505(6)). The Kentucky statute uses slightly broader wording to accomplish the same objective: “(4) Disclosure may be necessary for: (a) Treatment of the patient by any health care provider involved in the patient’s care” (Ky Rev Stat Ann. § 210.235(4)(a)). Maine (Me Rev Stat Ann tit 34-B, § 1207(9)(A)) and Maryland (Md HEALTH-GEN Code Ann §§ 4-305(b)(4), 4–307) have used slightly different variations in language.

Thus, there are other state statutory models available should the states whose medical privacy laws (many of which pre-date the enactment of HIPAA in 1996) are possibly more restrictive or stringent than HIPAA wish to consider revising them. In such states, a collaboration for change might include state mental health program directors, both public and private health care lawyers, and state associations and chapters of primary care physician and behavioral health professional organizations as well as state organizations of patient support and advocacy groups.



The technical assistance of Patricia Smith is gratefully acknowledged.

Conflict of Interest

No authors have a conflict of interest to report, financial or otherwise.


  1. 1.
    Community Mental Health Centers Act, Pub L No. 88–164, tit 2, 77 Stat 290, 1963.Google Scholar
  2. 2.
    Druss BG. The mental health/primary care interface in the United States: history, structure, and context. General Hospital Psychiatry 2002; 24(4): 197–202.CrossRefPubMedGoogle Scholar
  3. 3.
    Mauksch LB, Leahy D. Collaboration between primary care medicine and mental health in an HMO. Family Systems Medicine 1993; 11(2): 121–135.CrossRefGoogle Scholar
  4. 4.
    Pomerantz AS, Corson JA, Detzer MJ. The challenge of integrated care for mental health: leaving the 50 minute hour and other sacred things. Journal of Clinical Psychology in Medical Settings 2009; 16(1): 40–46.Google Scholar
  5. 5.
    Kessler R. The difficulty of making psychology research and clinical practice relevant to medicine: experiences and observations. Journal of Clinical Psychology in Medical Settings 2008; 15(1): 65–72.CrossRefPubMedGoogle Scholar
  6. 6.
    Institute of Medicine Committee on Quality of Health Care in America. Crossing the Quality Chasm: A New Health System for the 21st Century. Washington, DC: The National Academies Press, 2001.Google Scholar
  7. 7.
    Institute of Medicine Committee on Crossing the Quality Chasm: Adaptation to Mental Health and Addictive Disorders. Improving the Quality of Health Care for Mental and Substance-Use Conditions. Washington, DC: The National Academies Press, 2006.Google Scholar
  8. 8.
    Croft B, Parish SL. Care integration in the Patient Protection and Affordable Care Act: Implications for behavioral health. Administration and Policy in Mental Health and Mental Health Services Research 2013; 40(4): 258–263.CrossRefPubMedGoogle Scholar
  9. 9.
    Patient Protection and Affordable Care Act, Pub L No. 111–148, 124 Stat 119, 2010.Google Scholar
  10. 10.
    U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration. Report to Congress on the nation's substance abuse and mental health workforce issue. January 24, 2013. Available online at Accessed June 15, 2013.
  11. 11.
    National Council for Behavioral Health. Summary of the major provisions in the Patient Protection and Affordable Health Care Act, updated 10/22/10. Available online at Accessed June 15, 2013.
  12. 12.
    Barry CL, Huskamp HA. Moving beyond parity: Mental health and addiction care under the ACA. New England Journal of Medicine 2011; 365(11): 973–975.CrossRefPubMedPubMedCentralGoogle Scholar
  13. 13.
    Pritts J, Choy A, Emmart L, et al. (eds). The State of Health Privacy, Second Edition. Washington: Georgetown University, 2002. Available online at, and Accessed June 15, 2013.
  14. 14.
    Wetherell JL, Kaplan RM, Kallenberg G, et al. Mental health treatment preferences of older and younger primary care patients. International journal of psychiatry in medicine 2004; 34(3): 219–233.CrossRefPubMedGoogle Scholar
  15. 15.
    Oyama O, Burg MA, Fraser K, et al. Mental Health Treatment by Family Physicians: Current Practices and Preferences. Family Medicine 2012; 44(10): 704–711.PubMedGoogle Scholar

Copyright information

© National Council for Behavioral Health 2015

Authors and Affiliations

  • Leslie S. Rothenberg
    • 1
    • 2
    • 3
  • David A. Ganz
    • 2
    • 3
    • 4
  • Neil S. Wenger
    • 2
    • 3
    • 5
  1. 1.Pacific PalisadesUSA
  2. 2.Department of Medicine, David Geffen School of MedicineUniversity of CaliforniaLos AngelesUSA
  3. 3.The RAND CorporationSanta MonicaUSA
  4. 4.Veterans Affairs Greater Los Angeles Healthcare SystemLos AngelesUSA
  5. 5.UCLA Health Ethics CenterLos AngelesUSA

Personalised recommendations