Patient Access to Mental Health Records – The Rules Have Changed, Be Sure Your Practices Do, Too.
The proper release of medical records is an important issue for medical practitioners to understand. Many providers recognize that a patient’s records ultimately belong to the patient, not to the provider, and that patients have the right to access their medical records. There are often exceptions to this general rule, and until April of 2014, Colorado law contained a blanket exception for mental health records.
Colorado Revised Statutes (C.R.S.) §25-1-802 outlines the statutory requirements for the release of medical records held by individual health care providers, and many mental health providers mistakenly believe that the blanket denial for access to mental health records is still in effect under current law. Providers are often not aware that the text of this statute was amended by House Bill 14-1186,[i] and one of the amendments significantly changed how the release of mental health records is handled.
According to C.R.S. §25-1-802(1)(a), a patient’s medical records must be made available to the patient upon submission of a valid written authorization. Prior to the 2014 amendments, the statute contained an exception for “records pertaining to mental health problems,” and many providers used this statutory exception to avoid releasing mental health records directly to patients. House Bill 14-1186 changed this language – instead of an exception for “records pertaining to mental health problems,” the current statute has an exception for “records withheld in accordance with 45 CFR 164.524(a).” This is an important distinction that significantly narrows the exception, and mental health providers must be aware of this change to avoid running afoul of the amended statute.
Some readers might recognize 45 CFR 164.524(a) as one of the many provisions of the Health Insurance Portability and Accountability Act of 1996, commonly known as HIPAA. The provision referenced in the Colorado statute governs the access of individuals to their protected health information, and it contains a specific list of situations in which a health care provider may deny an individual access to his or her medical records. The Colorado General Assembly has directly incorporated the HIPAA provisions governing access to medical records into Colorado law, and medical providers must understand these provisions in order to remain in compliance with the amended statute.
Under the relevant HIPAA regulation, medical providers are required to provide individuals with access to their medical records. However, the regulation also outlines exceptions to this requirement, and these are the exceptions that are now part of Colorado law. The first section of the regulation identifies a set of “unreviewable grounds for denial.”[ii] According to the regulation, a provider may deny individuals access to records that fall within one of the following categories:
- Psychotherapy notes;
- Records compiled in reasonable anticipation of a legal proceeding;
- Requests by inmates of a correctional institution if access would jeopardize the health or safety of inmates or employees of the institution;
- Information created or obtained in the course of research that includes treatment (if the individual has agreed to such denial of access);
- Denials permitted by the Privacy Act (5 U.S.C. 552(a)); and
- Information obtained from non-healthcare providers under a promise of confidentiality.[iii]
As noted above, denials made in these circumstances are considered “non-reviewable.”
The other exceptions identified in the regulation are considered “reviewable” grounds for denial of access. These exceptions may be more relevant to mental health providers who are accustomed to the “records pertaining to mental health problems” exception in the Colorado statue, and they require the exercise of clinical judgment by the provider denying such access. This section of the regulation permits providers to deny an individual access to records in the following circumstances:
- A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person;
- The protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or
- The request for access is made by the individual’s personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.[iv]
Denial of access to records under these circumstances is subject to review, and decisions to deny access may be overturned. A patient may request a review of the decision to deny access, and this review must be conducted by a licensed health care professional who did not participate in the initial denial decision.[v] The decision of the reviewing official is final and must be honored by the treating provider.
The exceptions noted above are significantly narrower than the blanket exception for “records pertaining to mental health problems” that formerly governed the release of records in Colorado. Mental health providers who are not aware of the amendment to the Colorado statute are in danger of violating current law if they continue to deny individuals access to their mental health records under circumstances other than those outlined above. Providers who do deny access to records under the above circumstances must take care to document the reasons for the denial, and such documentation should ideally incorporate the language of the regulation cited above.
The other substantive change to C.R.S. 25-1-802 relates to electronic medical records. The new portion of the provision states that “the health care provider must provide the medical records in electronic format if the person requests electronic format, the original medical records are stored in electronic format, and the medical records are readily producible in electronic format.”[vi] This change is consistent with the push towards electronic medical records and may ultimately make it less cumbersome to produce records upon the request of a patient.
The above is only a brief a summary of the main substantive changes to C.R.S. 25-1-802, and mental health providers should review the amended statute in its entirety to ensure that their practices do not violate the new law. Especially in today’s rapidly-changing regulatory environment, it is a constant challenge to stay abreast of the new regulations and statutes that govern health care, but it is also a vital part of ensuring that your practices are in compliance with the law.
This article was originally published in A Piece of Our Mind, a quarterly newsletter by the Colorado Psychiatric Society (Fall 2015, Volume 41, No.3).
_________________________________________
[i] http://www.leg.state.co.us/clics/clics2014a/csl.nsf/fsbillcont2/85A6EAD509C2A75787257C300006C03B/$FILE/1186_enr.pdf.
[ii] 45 CFR 164.524(a)(2)
[iii] Id.
[iv] 45 CFR 164.524(a)(3)
[v] 45 CFR 164.524(a)(4)
[vi] CRS 25-1-802(1)(b)(I)(B)
For questions regarding this article please contact Jon Goodman.