LEGAL ISSUES: FACTS AND THOUGHTS
HIPAA Privacy Rules Applicable To All Texas MHP's 

FACTS:
The Federal Government has reached its long arm into the offices of every mental health professional in Texas. The Privacy Rule of the Health Insurance Portability and Accounting Act will become effective April 14, 2003. A goal of this federal law is to create a nationwide floor for privacy rules for health care information. It will not supercede state law that is more protective of health care information. States, such as Texas have passed statutes that require compliance with the Privacy Rules even if the mental health professional is not a "Covered Entity" as defined by HIPAA. It will be a very rare mental health professional who will not be required to comply with the Privacy Rule. All mental health professionals should invest the time and energy in preparing for compliance on April 14, 2003 even if they do not currently engage in any electronic transmissions of protected health information.

THOUGHTS:
It is imperative that mental health professionals acquaint themselves with these new privacy rules and make the necessary practice adjustments. This will include modifying client intake and consent forms to provide the additional information to be disseminated to clients before services are provided and to document HIPAA compliance. Some of the disclosure requirements of HIPAA are summarized as follows:

• Clients must be informed of their right to an accounting of disclosures made of their health care information over the previous six (or fewer) years (except for certain disclosures such as for treatment payment, to the individual, per the individual's written authorization and for national security or intelligence purposes).
• Clients must be informed of their right to access their health care information. An exception exists for psychotherapy notes where Texas law would apply allowing mental health information to be withheld from a patient if the mhp determines that disclosure would be harmful to the client.
• Clients must be informed of their right to amend personal information as long as information is maintained in the client's file (unless it is accurate and complete).
• Clients must be informed of their right to request restrictions on certain uses and disclosures of their health care information so long as the disclosures are not required by law.
• Clients must be informed of the permitted uses and disclosure of their health care information (heretofore described as "confidentiality and the exceptions to confidentiality").

Mental health professionals are now specifically required to provide clients written notice of this information at the time services are first provided (excluding emergencies). The authors have taught for years the importance of detailed intake and consent forms that clients review and sign to document informed consent. Federal and State Law now mandates written notice regarding privacy issues but hopefully this will not be a new practice or procedure for most Texas mental health professionals. However careful review and revision of existing practice forms and consultation with a knowledgeable attorney in one's location of practice is necessary to insure compliance with these new requirements. 

Texas Commission on Alcohol & Drug Abuse (TCADA) list the follows websites with HIPAA information:

• The Administrative Simplification website of the U.S. Department Of Health & Human Services: http://aspe.hhs.gov/admnsimp/index.shtml
• The HIPAA website of the U.S. Department of Civil Rights (charged with HIPAA enforcement): http://www.hhs.gov/ocr/hipaa
• The Strategic National Implementation Process: http://snip.wedi.org
• The Centers For Medicare and Medicaid Services: http://cms.hhs.gov/hipaa
• The HIPAA website of the Substance Abuse and Mental Health Services Administration (SAMHSA): http://hipaa.samhsa.gov/
• The HIPAA advisory website of Phoenix Health Systems: http://www.hipaadvisory.com 

TCADA further advises that the HIPAA privacy rule requires providers to have "administrative, technical, and physical safeguards to protect privacy of information and safeguard information from prohibited uses or disclosures" and recommends the following websites:

• The security page of the National Institutes of Health Center for Information Technology: http://www.alw.nih.gov/Security/
• The CERT Coordination Center of the Software Engineering Institute of Carnegie Mellon University: http://www.cert.org
• The SANS (System Administration, Networking and Security) Institute: http://www.sans.org
• The final HIPAA rule, scheduled to be published in the Federal Register on Feb. 20, is available for viewing online at: http://www.cms.hhs.gov/hipaa/hipaa2/default.asp
  

Thomas L. Hartsell, J. D., (214) 363-0555. Mr. Hartsell is an Academically Certified Mediator and Professor of Mediation at Southern Methodist University

Barton E. Bernstein, J.D., LMSW

THOMAS L. HARTSELL, JR.
Attorney & Counselor at Law
402 University Tower
6440 North Central Expressway
Dallas, Texas 75206-4133
214/ 363-0555
FAX 214/ 369-3590
Cellular 972/ 741-3307
E-mail tlhartsell2@aol.com