The HIPAA Privacy Rule and state law govern whether patients have access to psychotherapy notes. But understanding which one takes precedence and when is important to avoid falling into a legal morass.
The Privacy Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was created to provide standards for protecting the confidentiality of patients’ individually identifiable health information. While the Privacy Rule gives patients a right to access their medical records, it permits psychiatrists who are covered by HIPAA to deny patients access to strictly defined psychotherapy notes. It’s important to note, however, that under HIPAA psychiatrists are obligated to release these same notes to a third party if the patient requests that this be done. Moreover, laws in some states may allow patients firsthand access to those same psychotherapy notes, and such state laws continue to apply, notwithstanding HIPAA.