HIPAA protects mental-health information while allowing appropriate uses and disclosures. A workable privacy programme helps a covered provider make those decisions consistently; it does not treat every request as prohibited or every family relationship as authority to receive a complete record.
This guide focuses on the operating questions that practice managers, privacy officers and system owners need to resolve together. Clinical judgement, applicable state law and additional confidentiality rules can affect a particular disclosure, so the workflow needs a clear route to the appropriate decision maker.
Know which record is being requested
Start with an inventory of where information is created and used: clinical records, appointment messages, billing, patient portals, recordings and separately maintained professional notes. Identify who can view, export and amend each category. Avoid assuming that one access setting works equally well for every record.
HHS distinguishes psychotherapy notes from the wider medical record. These are a mental-health professional’s separately maintained notes documenting or analysing counselling conversations. Routine items such as medication information and summaries of diagnosis or treatment plans are not automatically psychotherapy notes.
Psychotherapy notes generally require authorisation for disclosure, subject to limited exceptions. Configure systems and staff instructions around the actual distinction. Labelling an entire chart psychotherapy notes can obstruct appropriate access and sharing; storing genuinely separate notes in a general export can create a different problem.
Separate treatment, access and family requests
Use a request form or intake record that captures the requester, their role, the information sought and the purpose. A treating professional, a patient exercising access rights and a relative asking about an appointment are presenting different decisions. Do not route all three through an identical release process without examining the applicable rules.
HIPAA can permit relevant sharing with a person involved in care or payment when the patient agrees or does not object. Professional judgement has a role in certain incapacity or emergency circumstances. A family relationship alone does not establish unrestricted access, and personal-representative authority requires its own assessment.
Hypothetical example: a practice receives a call from an adult patient’s sibling who has arranged transport. Staff can identify the purpose and refer any uncertain disclosure decision, rather than sending a full clinical record because the sibling appears helpful. The workflow separates arranging practical support from broad access to confidential information.
Check additional rules before relying on a template
Assess state-law requirements and any other applicable confidentiality regime. A national template should not make unsupported claims that every state permits the same disclosure. Record who maintains the local requirements and how staff obtain advice when a request falls outside routine cases.
42 CFR Part 2 applies to certain substance-use-disorder records and programmes; it is not a label for all mental-health information. HHS identifies 16 February 2026 as the compliance date for the applicable requirements of its 2024 final rule. Among its changes are a single consent option for future treatment, payment and health-care-operations uses and disclosures, with conditions and separate protections for certain records.
Review existing forms and instructions against the rules that actually apply. Do not retain a blanket statement that every redisclosure always requires a new consent, or assume that alignment with HIPAA removed every additional Part 2 protection. Keep specialised decisions with appropriately informed clinical, privacy and legal personnel.
Test the workflow across portals and suppliers
Trace a record through ordinary tasks: appointment reminders, electronic referrals, portal access, billing and a request for a copy. Check the recipient and content at each handover. A vendor’s security statement does not establish that the practice configured permissions or messages appropriately.
Where a provider performs business-associate functions, review the relevant agreement and responsibilities. Understand support access, exports, retention and incident communications. Our business-associate agreement guide helps connect contract terms with the actual service.
Hypothetical example: a clinic adds a portal that permits proxy access. Before launch, it tests an adult account, a changed proxy permission and a separately restricted document. The test reveals that an old proxy permission still applies to a new message type. Resolving that configuration is more useful than relying on a product badge.
Make difficult requests easy to escalate
Give staff a practical escalation route for unclear authority, disputed access, legal demands or potential serious harm. Identify the role that can decide and the information it needs. An urgent case should not depend on locating an obsolete policy owner or waiting for a routine committee meeting.
A safety-related disclosure needs the relevant professional judgement and legal conditions; a website article cannot determine that decision for an individual patient. The operating task is to ensure that the right person can make and document it promptly, with reliable information about the records and recipient.
For ordinary patient access, keep the request visible through receipt, review, response and any justified limitation. Mental-health information should not be withheld automatically merely because it is sensitive. Use the applicable access rules and distinguish psychotherapy notes from other records.
Review decisions as well as technology
Sample completed requests and permission changes. Can a reviewer understand the purpose, authority, information disclosed and reason for an exception? Use anonymised or fictional exercises for staff learning where practical, rather than circulating real patient details unnecessarily.
Review changes to services, record types and suppliers. A new transcription feature or portal integration can alter information flows even when the main clinical system remains the same. Assign an owner to update the inventory and instructions before staff adopt a workaround.
The HIPAA Privacy Rule guide covers the broader programme, while the access-control guide develops the supporting permission work. A scoped gap assessment can test these workflows and identify decisions requiring specialist advice.
Reference basis
- HHS, Information Related to Mental and Behavioral Health.
- HHS, HIPAA Privacy Rule and Sharing Information Related to Mental Health.
- HHS, FAQ on extra protections for psychotherapy notes.
- HHS, Fact Sheet: 42 CFR Part 2 Final Rule, updated January 2026.
Questions and answers
Is all mental-health information classified as psychotherapy notes?
No. The HIPAA definition is narrower and includes a separation requirement. Ordinary medical-record information is not automatically included. Identify the actual record type before applying a restriction or disclosure process.
Can a relative obtain the complete record simply because they help the patient?
No. Relevant involvement in care or payment is different from unrestricted record access. Consider the patient's agreement or objection, the circumstances, any personal-representative authority and other applicable law.
Does Part 2 apply to every mental-health practice?
No. Assess the programme, records and activities against its applicability rules. Where it applies, use current requirements and distinguish ordinary permitted uses from records or purposes that need separate protections.
Will buying a secure portal make the practice compliant?
No. The practice still needs appropriate permissions, record handling, supplier responsibilities and staff decisions. Test real workflows and exceptions as well as technical settings.
What should a focused mental-health privacy review examine first?
Choose a sensitive record flow, such as a proxy request or external referral. Trace the information, authority, system permissions and response record, then resolve any mismatch with the applicable rules and clinical needs.
Review a sensitive information workflow
Bring the record flow, systems and decision that staff find difficult. Discuss a focused HIPAA privacy assessment with clear operational questions and evidence to review.