Practice Directorate
March 30, 2005
Mark A. Rothstein, J.D., Chair
Subcommittee on Privacy & Confidentiality
National Committee on Vital and Health Statistics
Re: Testimony on Privacy and Confidentiality Issues Concerning the National Health Information Network
Dear Chairman Rothstein and Distinguished Subcommittee Members:
I submit this testimony on behalf of the American Psychological Association (APA), the professional organization representing more than 150,000 members and affiliates engaged in the practice, research, and teaching of psychology. We appreciate this opportunity to submit this testimony regarding the development of a National Health Information Network (NHIN).
We understand that the National Committee on Vital and Health Statistics (NCVHS) assists and advises the Secretary of the Department of Health and Human Services in the study and identification of privacy, security, and access measures to protect individually identifiable health information in an environment of electronic networking. We further understand that NCVHS will make recommendations to the Secretary of Health and Human Services in the form of suggested access, security, and privacy measures that should be taken to implement a NHIN. Therefore, the APA offers the following testimony to the Subcommittee regarding our suggestions and concerns in creating and maintaining access, privacy and confidentiality for health records in a NHIN.
The form, scope, uses and control of the NHIN have not been determined. Therefore, our comments can only address potential concerns and suggestions based on directions that we anticipate that the NHIN may take. Accordingly, we would appreciate opportunities to comment again as this dialogue develops.
I. Unique Privacy Concerns Raised by Mental Health Records
Our primary concern regarding the NHIN is the need to balance accessibility of health information with privacy and confidentiality. This testimony will focus on the unique patient privacy concerns of mental health patients.
The NHIN has the laudable goal of improving patient care through greater and more efficient information access. We believe that it has the potential to substantially improve the quality of health care provided in this country by allowing instant access to critical patient information at any point of care. It also has the potential to increase the efficiency of service delivery and, importantly, lower administrative costs. Further, it has the potential to improve patient care specifically by fostering the integration of physical and mental health care as discussed in Section III.A below.
We are concerned, however, about possible unintended consequences to the extent that some of the powerful forces propelling the need for an electronic health record include economic/business concerns about efficiency. In prior instances where broad changes to the health care system were introduced to improve both efficiency and patient care (particularly with the advent of market-driven managed care techniques), many have now concluded that the new systems actually reduced the quality of care because they prioritized economic issues over patient care. The unfortunate reality is that our health care system has become increasingly dominated by corporatized “big business” for which profit making has become an essential part of business. With NHIN, our concern is that too much focus on improving the flow of health information for economic efficiency in the service of profit making and business interests could take priority over various patient care concerns, including privacy. We sincerely hope that this does not happen and that steps can be taken from the beginning to assure a balanced approach to addressing the various interests involved.
In order to develop the NHIN in a manner which will promote quality mental heath care, it is important to consider the unique privacy issues relating to mental health records. Most people understand that mental health records are particularly sensitive because they may contain a patient’s innermost and most embarrassing personal information. Many also are aware that, unfortunately, the stigma attached to mental health disorders and mental health treatment makes the records of that treatment especially sensitive. This is an area of health care where the mere fact that a person has sought treatment, if revealed, can damage careers, reputations and relationships. Any violation of privacy could be devastating to the patient. Thus, patients receiving care for mental health issues may be prone to avoid or discontinue treatment if there is a real or perceived threat to the privacy of their health records.
Mental health care is unique in that successful treatment depends on both the existence of privacy and the expectation of privacy. There is no other health field in which the mere threat of loss of privacy can interfere with the success of treatment. As the U.S. Supreme Court recognized in the case of Jaffee v. Redmond, 518 U.S. 1, 10 (1996), the psychotherapist-patient relationship is:
[R]ooted in the imperative need for confidentiality and trust…Treatment by a physician for physical ailments can often proceed successfully on the basis of a physical examination, objective information supplied by the patient, and the results of diagnostic tests. Effective psychotherapy, by contrast depends upon frank and complete disclosure of facts, emotions, memories, and fears. Because of the sensitive nature of the problems for which individuals consult psychotherapists, disclosure of confidential communications made during counseling sessions may cause embarrassment or disgrace. For this reason, the mere possibility of disclosure may impede development of the confidential relationship necessary for successful treatment. (Emphasis added).
Because of these concerns, psychologists and other licensed mental health professionals are trained to exercise great care in protecting their patients’ records. The psychologist has typically viewed his or her role as a “gatekeeper” controlling access to those records. We would urge that the establishment of the NHIN preserve mental health professionals’ role in being able to control and protect the records so that confidentiality, a trusting relationship and successful treatment may be preserved.
Psychologists have historically served an important role in determining what information in their patients’ records to disclose, because they have a great understanding of the heightened sensitivity of mental health records, what records are relevant to other treating professionals, and the special legal and ethical rules concerning the disclosure of psychological records (which are generally considerably more protective than the disclosure rules for medical records). In this role, and working in collaboration with the patients, psychologists have been able, for example, to provide a critical perspective on what is “minimum necessary” information to release to insurers and other third parties, pursuant to the HIPAA Privacy Rule, as discussed in Section III.B below.
The psychologist’s role vis-à-vis confidential mental health records is also highlighted by the NHIN’s potential benefit of improving patients’ access to their own records. The psychologist is in a key position to identify what parts of the patient’s mental health record are appropriately viewed by the patient or, alternatively, viewed by the patient with the psychologist’s simultaneous explanatory input. In recognition of this role, many state laws actually give the psychologist discretion to withhold portions of that record to prevent physical, emotional or therapeutic harm to the patient. A mental health record may be susceptible to misinterpretation by others, including the patient, or may cause a strong emotional reaction if viewed by the patient. Thus, even when access is appropriate, it is often highly advisable to have the psychologist present while the patient is reviewing his/her record in order to explain aspects of the record and help the patient cope with emotional responses to that information.
II. What mental health records would be included?
Some, but not all, of the concerns outlined above would be reduced by limiting the scope of mental health records to be included in the NHIN. The records that should most logically be included are the basic information that the HIPAA Privacy Rule views as necessary for sharing among health care professionals. This information, which we call the “clinical record”, includes basic items such as diagnosis, symptoms and treatment plan. This basic health information is necessary to assist all health care professionals who are treating patients in providing quality integrated care to them.
There are two types of mental health records that we strongly urge not be included, or only be included with specifically restricted access:
Psychotherapy notes. The HIPAA Privacy Rule recognizes that a mental health professional’s private notes concerning therapy sessions contain highly sensitive patient confidences, are primarily for the professional’s own use, and are not the type of information that needs to be shared with other health care professionals, insurers, or even patients. Accordingly, these notes are given heightened protection under the Privacy Rule, and can generally only be used by the psychologist who took those notes, absent a specific authorization from the patient. The same considerations call for excluding them from the NHIN, or restricting access so that only the psychotherapist who created them can view them (unless the patient specifically authorizes broader disclosure).
Psychological testing. Similarly, psychological test materials and results should not be included in the NHIN. First, psychological tests are particularly susceptible to misinterpretation by those not trained to interpret these tests. Parts of tests taken out of context by someone not trained to interpret the whole can be harmfully misleading. Second, the test materials themselves are unique (usually copyrighted) and they may lose their value as accurate diagnostic and evaluative instruments if they are too widely shared. This sharing can lead to several problems – from those that are intentional, such as manipulation of the test responses in order to achieve a desired result, such as with malingering, to unintentional invalidation of test results because of prior familiarity with the questions. Third, the raw data of psychological testing is as likely to contain highly personal confidential information as psychotherapy notes. Some of the questions themselves may elicit highly sensitive responses, and also the psychologist doing the testing may write observations and comments on the materials containing the questions and/or answers. Fear of loss of confidentiality may negate the effectiveness of a test in the same manner that fear of loss of privacy can interfere with successful psychotherapy. A patient may not be completely forthcoming with full answers to test questions if he or she thinks that the information may be widely disclosed.
III. Who Would Have Access to Mental Health Records and For What Purposes?
A. Access by Other Treating Professionals/Integration of Mental and Physical Health. We believe that easy accessibility of records by treating health care professionals is one of the most important goals of the NHIN. For example, in the Veterans Administration (VA) system, patients typically see multiple health care professionals during that visit. Prior to the implementation of its electronic system, health care professionals treating a VA patient would not always have access to the patient’s medical record when treating the patient because the record was either in the possession of another health care professional or was being held somewhere else in the VA hospital. Now, a health care professional can access the patient’s record at any time and can update information and add his or her notes to the record. This is a particularly important feature as mental health care becomes an increasingly integrated part of overall patient healthcare and interdisciplinary collaboration is improved. This improved access would be possible nationwide in a NHIN.
We believe the NHIN could actually have the beneficial effect of increasing the level of integration of mental health and physical health care. APA believes that such integration is important in light of the growing recognition of the link between behavior, health and illness. It is increasingly recognized that many of the physical ailments that are now the nation’s dominant medical concerns, such as diabetes and heart disease, have strong mental and behavioral components. The corollary is, of course, that treatment of diabetes is more effective if a psychologist works with the patient and physician on behavioral and emotional issues, diet, exercise and medication compliance.
Currently, mental and physical health care are all too often provided in separate spheres that have little contact with each other. The integration of these spheres has been shown to greatly improve patient care, particularly in areas such as disease management and with individuals who display “at risk” behaviors such as poor diet, lack of exercise, smoking and alcohol abuse.
Because integration of mental health with physical health information through the NHIN would generally increase access to mental health records, it must be done carefully and selectively. First, there is the potential for differing levels of privacy maintenance in the mental and physical health spheres. With physical health, it is often appropriate to make a patient’s record accessible to several physicians of different specialties, nurses and other affiliated staff. By contrast, a psychologist’s psychotherapy notes generally cannot be shared with anyone other than the psychologist (without the patient’s authorization), and access to the more public clinical record is often not shared with affiliated staff because even basic information, such as the diagnosis, can be highly sensitive. A common problem we have seen is that those on the physical health side are not always familiar with the unique and sensitive aspects of these mental health records and the greater privacy obligations imposed as a result. We are aware of instances in which psychologists have been asked to place their psychotherapy notes and patient files in common databases to which a large number of professionals and affiliated staff have access. For the psychologists to comply would, of course, place them in violation of their privacy obligations under HIPAA, state law and ethics code.
These problems could be expanded on a massive scale if the integration of mental health and physical health information through the NIHN was not carefully orchestrated. We are concerned that if these two very different systems are integrated through the NHIN, the overall level of confidentiality not be lowered to the physical health standard. We strongly urge that the NHIN not take a “lowest common denominator” approach. Perhaps the best alternative, as practiced for many years in Veterans’ Administration settings is to have a two-tiered system, with greater privacy control on the mental health portion of the record.
A second concern is the potential unintended impact of the introduction of mental health information into a large number of physical health settings that are not used to having access to this information. Since the stigma attached to mental health disorders is still pervasive, some in the system may react to and treat patients differently if they know about their disorder. Relatedly, there is the concern that health professionals with little experience and training in mental health issues may misinterpret mental health information. For example, a primary care professional would have no training in interpreting psychological test data. If a health professional were to review the test data alone, he or she might come to erroneous conclusions regarding the patient, and worse, could share this incorrect information with the patient or other treating professionals.
B. Access by Health Insurers. Key questions with the creation of an electronic health record concern the extent to which health insurers and other third party payors will be allowed access to the NHIN, for what purposes, and how would it be limited. We have witnessed a long-standing tension between mental health professionals trying to protect patient privacy and insurers requesting additional information to decide whether the mental health treatment is “medically necessary.” Under the HIPAA Privacy Rule, this tension has shifted to disputes over what is the “minimum necessary” information for the insurer to determine medical necessity. Unfortunately, the flexible but vague “minimum necessary” standard leaves considerable room for disagreement. (Fortunately, the Privacy Rule leaves little room for debate when psychotherapy notes are at issue: the insurer cannot demand access.) In some cases, the extent of information requested by the insurer has become a tactic to discourage patients from accessing services, even when these services are necessary. The psychologist’s understanding of what information is most sensitive, what is potentially subject to misinterpretation, and what justifies his/her treatment plan, places the psychologist in an optimal position to determine what is the minimum necessary information actually needed by the insurer.
The ability of the health professional to exert control over the record is critical to enable a balance between the need for information disclosure and confidentiality. Any system allowing third party payors unfettered access to mental health information in the NHIN would remove that control and create grave privacy concerns.
C. Access by Law Enforcement. A final concern in this area is whether the NHIN would be made available for law enforcement. Generally, we believe that law enforcement access to patient records should be limited to the absolute minimum disclosure and use necessary in the interest of justice. If the NHIN would be open to such purposes, what type of legal safeguards would protect patients from unreasonable privacy intrusions? We would suggest that the disclosure of mental health records for the purposes of investigations regarding victims of crime or abuse only be permitted based on some form of judicial review – warrant, subpoena, court order, etc. If patients are concerned that their information is subject to government access without due process, they may be discouraged from participating in the NHIN or from seeking necessary treatment.
IV. Questions Regarding Regulatory Scheme and Patient Participation
A number of questions are raised with the prospect of regulating a system based on the NHIN. Would the NHIN be subject to and governed by the HIPAA Privacy Rule? If so, what role would state privacy laws play — assuming that the NHIN would be a national and/or federal network? Given that the Privacy Rule was only meant to set a federal floor, we believe it would be critical that stronger state protections (e.g., on patient consent, authorization and access) still apply to NHIN so that implementing NHIN did not result in substantial lowering of patient protection.
If the Privacy Rule were to govern use and disclosure of patient information in the NHIN, it will be important to re-assess whether the NHIN creates new privacy risks or issues not contemplated when the Rule was drafted. For example, if the NHIN shifts control over access to records away from the mental health professional, it would be necessary to reconsider the adequacy and applicability of the Privacy Rule’s current mechanisms for controlling disclosure.
Another critical area of uncertainty concerns the threshold question of what choice patients would have as to whether their records would be included in the NHIN. Would their participation in NHIN be voluntary? What, if any, aspects of the NHIN will be mandatory?
In order to make such consent meaningful, patients should be advised of the potential uses of their records, by whom and for what purposes, along with the benefits of participating in the NHIN. This might be provided in a HIPAA-type privacy notice (whether or not the Privacy Rule were to apply to the NHIN).
Finally, once a patient consented to have his/her records in the NHIN, would there be some uses of those records that would require additional authorization from the patient?
For example, while most patients would want their records available to health care professionals who are treating them, they might feel quite different about giving such access to insurance companies. This might be another area where the new privacy concerns posed by the NHIN would justify making certain aspects of the Privacy Rule more stringent as applied to the NHIN. It might make sense to require that the patient gave a HIPAA-type authorization before access to their records was granted to an insurance company (if insurers were to be allowed access at all). Alternatively, patients upon “joining” the NHIN, could select what uses would only be allowed with their authorization.
V. Conclusion and Recommendations
The APA recognizes that this hearing is a beginning point toward developing a NHIN that will balance the ability to access health records with the need for privacy and confidentiality of records. We urge the Subcommittee to adopt the following recommendations relevant to mental health:
- Exclude from the NHIN, or place specific limitations on access to, psychotherapy notes and psychological test materials and raw data.
- Recognize and maintain the important role that the licensed mental health professional plays in determining what is appropriate access to mental health records by insurers, patients and others.
- Promote the integration of physical and mental health information but do so in a cautious manner that preserves the high level of confidentiality of mental health records, for example by creating a two-tier system where mental health records would be subject to more limited access.
We would appreciate the opportunity to work further with NCVHS and the Department of Health and Human Services to give additional input and suggestions on the NHIN as its development progresses.
Respectfully submitted,
/s/
Russ Newman, Ph.D., J.D.,
Executive Director for Professional Practice
American Psychological Association