The “Minimum Necessary”: How Much Will You Need to Divulge to Insurers?

Final guidance from the federal government is imminent about how much of a patient’s protected health information (PHI)-including psychotherapy notes-a psychiatrist must provide to a health insurer. The economic stimulus bill passed in February 2009 mandated changes to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) patient privacy protections. The Department of Health and Human Services (HHS) issued a proposed rule implementing those changes in July. Health providers, including psychiatrists, responded to the implementation proposal in September.

The proposed changes are particularly important to psychiatrists because the HHS will issue guidance on the “minimum necessary” amount of information a physician must provide to a health insurance company for the purposes of payment, treatment, or health care operations.

Generally, psychiatrists do not have to get a patient’s specific authorization to release PHI for purposes of treatment, payment, or health care operations. But the information released must be the “minimum necessary.” That term, which is not well defined, has been causing problems for mental health providers in the wake of the implementation of the Paul Wellstone and Pete Domenici Mental Health Parity and Addiction Equity Act that took effect on January 1. That act requires companies that already offer mental health coverage to expand those benefits. Health insurers have been pushing psychiatrists and other mental health providers for more information on patients than in the past as part of their “medical necessity” determinations. There have been increasing demands from insurers for more detailed patient information, including a demand for details in their psychotherapy notes, most of which cannot be released without the patient’s specific authorization. (There are a few exceptions, such as when a psychiatrist is sued.) Psychotherapy notes provide much more intimate details about a patient than his or her PHI.

“Since the federal parity legislation went into effect at the beginning of the year, we have had a surge of complaints that health insurers are reacting with intrusive telephonic reviews and intrusive requests for written information,” said Alan Nessman, senior special counsel for the American Psychological Association. “Members have complained about health insurers that conduct telephonic reviews that last for up to 30 minutes and request excessive details about the patient and his/her therapy session. We believe that this is an end-run around the psychotherapy notes protection provided by the HIPAA privacy rule.”

Bryan Touchet, MD, associate professor of psychiatry, University of Oklahoma School of Community Medicine, noted that a health insurance company recently asked him to provide all his psychotherapy notes on a patient who was on short-term work disability. Touchet advised the patient against signing the authorization. “We opted to send the insurer a summary letter of treatment,” Touchet said. The insurance company has not said whether that will be sufficient. The 2009 stimulus bill required the HHS to put out guidance on “minimum necessary” within 18 months after passage of the bill. That bill was passed on February 17, 2009.

The HHS proposed rule issued on July 14, 2010, also makes an explicit change in the duration of the privacy of PHI. It suggests that information would be publicly available after 50 years. PHI is currently protected in perpetuity. The 50-year limit is being proposed because of complaints from biographers and archivists that the 50-year standard is unreasonable, and makes their job sometimes impossible. For example, the author of a scholarly book on the American painter Gilbert Stuart-who was reputedly a manic depressive-wrote to the HHS, in support of the 50-year limit, explaining that a Rhode Island hospital legally opposed his efforts to get the mental health records of Stuart’s daughter, Emma Stuart. Those records are 134 years old.

The American Psychiatric Association (APA) has serious concerns with a 50-year term for PHI privacy. “As more technologies become electronic and the ability to store and access data becomes increasingly easier, there is more reason to be cautious about opening such information up to the public,” said James H. Scully Jr, MD, medical director and CEO of the APA. If the HHS decides to finalize the 50-year limit, the APA wants the department to mandate an exclusion for psychotherapy notes.

The HHS proposed rule also has some provisions that would apply specifically to psychotherapy notes. For example, the stimulus bill requires physicians to send patients an expanded version of a note called a “Notice of Privacy Practices” (NPP)-which is already required-that lays out how the patient’s PHI will be used. When a patient has his first visit with a physician, the patient is given an NPP to sign. The expanded NPP would note new privacy protections required by the stimulus bill; it would also delineate disclosures that can be made without the patient’s approval and those that do not require approval. The expanded NPP would explain the full privacy protection afforded psychotherapy notes. This is not currently required. “We agree that currently it may be confusing to some individuals who may fear that psychotherapy notes will be disclosed for the purposes of treatment, payment, and health care operations,” said Scully. “This would have a chilling effect on the open and honest communication essential to psychiatric care.”

But Scully wants the HHS to go further, requiring physicians to describe their record-keeping practice with respect to psychotherapy notes in the NPP. “Without such a description, it may be very confusing to patients exactly how their physician maintains such information, and it may lead to disclosure of information that a patient never intended or expected to be released,” he added.