A Matter of Law: Patient Record Keeping, Part 2

by Legal and Regulatory Affairs Staff

 Keeping good patient records is a matter of sound practice for psychologists. Among their many uses, appropriate records can help ensure continuity of care and protect practitioners in the event of legal proceedings. Knowing legal and regulatory requirements and related factors that affect record keeping is crucial to your practice.

This is the second of two articles addressing questions about record keeping that practitioners often raise with staff in the APA Practice Directorate.

There is not always a clear answer to this question unless it has been addressed contractually in an employment agreement. If there is disagreement on the issue of record ownership when a psychologist leaves an employment setting, the practitioner may look to several factors in settling the dispute, including

• Generally accepted practice in your geographic area. Does the employer or the psychologist typically keep the record?
• Clients’ perceptions. Do clients think they are coming to clinic X where Dr. Y works and expect that their records would be housed there? Or do they consider themselves as Dr. Y's patient and that they do not have a relationship with the clinic or other setting?
• How the records are kept in the employment setting. Is each psychologist responsible for keeping his or her own records and in the manner that the practitioner chooses?

Obviously it is easiest for all parties concerned if such issues are clarified as employment begins.

It is important to know state law in considering this question. Laws vary on the amount of access that patients should have to their records, but many states grant considerable rights to patients.

Some state laws specifically give psychologists the discretion to deny client access to records if the psychologist believes it will harm a client to see the records. These laws differ in how they define the type and severity of harm necessary to justify withholding patient access. For example, one law might establish a patient harm standard as “harmful to the patient's physical, mental, or emotional health” while another may entail “substantial risk of significant adverse or detrimental consequences to the patient.”

The Health Insurance Portability and Accessibility Act (HIPAA), addressed further in the next question-and-answer, also relates to patient access. This federal rule denies patient access to psychotherapy notes, but otherwise allows access to the rest of the record unless certain exceptions apply — for example, in cases where access poses a danger of physical harm to the patient or others.

However, the HIPAA Privacy Rule defers to state laws that provide greater patient access than HIPAA does. The result is that in most states patients have some access to psychotherapy notes.

A detailed analysis of this interplay between the Privacy Rule and state access laws is provided in the Explanation form for each state contained in the APA Practice Organization’s Privacy Rule compliance product, “ HIPAA for Psychologists .”

Providing details about the many ways that the HIPAA Privacy and Security Rules have a bearing on patient record keeping exceeds the scope of this question-and-answer guide.

The most significant impact of the Privacy Rule on record keeping for psychologists is that it gives practitioners the option to keep separate "psychotherapy notes." Under the Privacy Rule, psychotherapy notes are given a higher level of protection than the rest of the patient’s record. In particular, psychotherapy notes are protected from disclosure to health insurers.

The concept of psychotherapy notes is explained a December 2000 commentary on the Privacy Rule by the U.S. Department of Health and Human Services. According to the commentary, psychotherapy notes are intended for the therapist’s own use, and are not the type of information needed by, or meant to be shared with, other health care professionals or insurers. The definition specifically excludes items that do need to be shared -- such as modalities and frequencies of treatment furnished, and summaries of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date.

The HIPAA Security Rule affects record keeping by creating standards on how electronic records are kept safe and secure both as they are stored and transmitted. The Security Rule is detailed and extensive. It covers all the steps that a HIPAA-compliant psychologist must take to ensure the safety of electronic records, from password protection to making certain that old records are destroyed in a secure manner.

Even if a psychologist is not required to comply with HIPAA, he or she may wish to review elements of the Security Rule since it may be considered a credible source in determining the standard of practice regarding the security of patient records.

This article is the sixth in a series, “A Matter of Law,” about the practical effect of various laws and regulations on practicing psychologists. Read A Matter of Law: Patient Record Keeping, Part 1.

PLEASE NOTE: Legal issues are complex and highly fact-specific and require legal expertise that cannot be provided by any single article. In addition, laws change over time. The information in this article should not be used as a substitute for obtaining personal legal advice and consultation prior to making decisions regarding individual circumstances.