Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              FAQ
                              Mental Health


    

    

    Navigate to:
  Authorizations (30)
          Business Associates (41)
          Compliance Dates (2)
          Covered Entities (14)
          Decedents (9)
          Disclosures for Law Enforcement Purposes (5)
          Disclosures for Rule Enforcement (1)
          Disclosures in Emergency Situations (2)
          Disclosures Required by Law (6)
          Disclosures to Family and Friends (28)
          Disposal of Protected Health Information (6)
          Facility Directories (7)
          Family Medical History Information (3)
          FERPA and HIPAA (10)
          Group Health Plans (3)
          Incidental Uses and Disclosures (10)
          Judicial and Administrative Proceedings (8)
          Minimum Necessary (14)
          Notice of Privacy Practice (20)
          Preemption of State Law (10)
          Privacy Rule: General Topics (12)
          Protected Health Information (2)
          Public Health Uses and Disclosures (13)
          Research Uses and Disclosures (20)
          Right to an Accounting of Disclosures (8)
          Right to File a Complaint (1)
          Right to Request a Restriction (4)
          Safeguards (13)
          Security Rule (24)
          Smaller Providers and Businesses (145)
          Student Immunizations (8)
          Transition Provisions (3)
          Treatment, Payment, and Health Care Operations Disclosures (30)
          Workers Compensation Disclosures (5)
          Limited Data Set (6)
          Marketing (17)
          Marketing - Refill Reminders (16)
          Personal Representatives and Minors (12)
          Right to Access and Research (58)
          Mental Health (35)
          Health Information Technology (41)
          Telehealth (11)Text resize icon

                    




Mental Health
  
  
  
      203-May specialists provide therapy to patients in a group setting
    Disclosures of protected health information in a group therapy setting are treatment disclosures and, thus, may be made without an individual’s authorization.
Read the full answer
      221-Can a personal representative access to the individual's medical record
    The HIPAA Privacy Rule treats an adult or emancipated minor’s personal representative as the individual for purposes of the Rule regarding the health care matters that relate to the representation, including the right of access under 45 CFR 164.524.
Read the full answer
      227-Does the HIPAA Privacy Rule allow parents the right to see their children’s medical records
    Yes, the Privacy Rule generally allows a parent to have access to the medical records about his or her child, as his or her minor child’s personal representative when such access is not inconsistent with State or other law.
Read the full answer
      230-Who controls the health information rendered while the individual was an unemancipated minor
    The individual who is the subject of the protected health information can exercise all rights granted by the HIPAA Privacy Rule with respect to all protected health information about him or her, including information obtained while the individual was an unemancipated minor consistent with State or other law.
Read the full answer
      231-May a psychologist notify a parent before treating his or her minor child even though the child is able to consent
    The HIPAA Privacy Rule would defer to State or other applicable law that addresses the disclosure of health information to a parent about a minor child.
Read the full answer
      360-My state requires consent to use or disclose health information. Does the HIPAA Privacy Rule take away this protection
    The Privacy Rule does not prohibit a covered entity from obtaining an individual's consent to use or disclose his or her health information and, therefore, presents no barrier to the entity's ability to comply with State law requirements.
Read the full answer
      485-Can that a patient has been treated and released be released as part of the facility directory
    The fact that a patient has been
Read the full answer
      516-Does HIPAA allow a provider to disclose PHI about a troubled teen to the parent
    Where the HIPAA Privacy Rule applies, does it allow a health care provider to disclose protected health information (PHI) about a troubled teen to the parents of the teen?
Read the full answer
      520-Does HIPAA permit a provider to disclose PHI about a patient if the patient presents a serious danger to self or others
    Where the HIPAA Privacy Rule applies, does it permit a health care provider to disclose protected health information (PHI) about a patient to law enforcement, family members, or others if the provider believes the patient presents a serious danger to self or others?
Read the full answer
      546-Does HIPAA permit a covered entity to disclose psychotherapy notes to a HIO
    Does the HIPAA Privacy Rule permit a covered entity to disclose psychotherapy notes to or through a health information organization (HIO)?
Read the full answer
      557-Can a covered entity use HIPAA to give individuals the right to decide to disclose information through an HIO
    Can a covered entity use existing aspects of the HIPAA Privacy Rule to give individuals the right to decide whether sensitive information about them may be disclosed to or through a health information organization (HIO)?
Read the full answer
      May a covered entity collect, use, and disclose criminal justice data under HIPAA
    In specified circumstances, yes.
Read the full answer
      2086-Does the HIPAA Privacy Rule permit a doctor to discuss a patient’s health status, treatment, or payment arrangements with a person who is not married to the patient or is otherwise not recognized as a relative of the patient under applicable law?
    Yes. The HIPAA Privacy Rule at45 CFR 164.510(b) permits covered entities to share with an individual’s family member, other relative, close personal friend, or any other person identified by the individual, the information directly relevant to the involvement of that person in the patient’s care or payment for health care.
Read the full answer
      2087-Does HIPAA allow a health care provider to communicate with a patient’s family, friends, or other persons who are involved in the patient’s care?
    Yes. In recognition of the integral role that family and friends play in a patient’s health care, the HIPAA Privacy Rule allows these routine – and often critical – communications between health care providers and these persons.
Read the full answer
      2088-Does HIPAA provide extra protections for mental health information compared with other health information?
    Generally, the Privacy Rule applies uniformly to all protected health information, without regard to the type of information.
Read the full answer
      2089-Is a health care provider permitted to discuss an adult patient’s mental health information with the patient’s parents or other family members?
    In situations where the patient is given the opportunity and does not object, HIPAA allows the provider to share or discuss the patient’s mental health information with family members or other persons involved in the patient’s care or payment for care.
Read the full answer
      2090-When does mental illness or another mental condition constitute incapacity under the Privacy Rule?
    Section 164.510(b)(3) of the HIPAA Privacy Rule permits a health care provider, when a patient is not present or is unable to agree or object to a disclosure due to incapacity or emergency circumstances, to determine whether disclosing a patient’s information to the patient’s family, friends, or other persons involved in the patient’s care or payment for care, is in the best interests of the patient.
Read the full answer
      2091-If a health care provider knows that a patient with a serious mental illness has stopped taking a prescribed medication, can the provider tell the patient’s family members?
    So long as the patient does not object, HIPAA allows the provider to share or discuss a patient’s mental health information with the patient’s family members.
Read the full answer
      2092-Can a minor child’s doctor talk to the child’s parent about the patient’s mental health status and needs?
    With respect to general treatment situations, a parent, guardian, or other person acting in loco parentis usually is the personal representative of the minor child, and a health care provider is permitted to share patient information with a patient’s personal representative under the Privacy Rule.
Read the full answer
      2093-At what age of a child is the parent no longer the personal representative of the child for HIPAA purposes?
    HIPAA defers to state law to determine the age of majority and the rights of parents to act for a child in making health care decisions, and thus, the ability of the parent to act as the personal representative of the child for HIPAA purposes. See 45 CFR 164.502(g).
Read the full answer
      2094-Does a parent have a right to receive a copy of psychotherapy notes about a child’s mental health treatment?
    No. The Privacy Rule distinguishes between mental health information in a mental health professional’s private notes and that contained in the medical record.
Read the full answer
      2095-What options do family members of an adult patient with mental illness have if they are concerned about the patient’s mental health and the patient refuses to agree to let a health care provider share information with the family?
    The HIPAA Privacy Rule permits a health care provider to disclose information to the family members of an adult patient who has capacity and indicates that he or she does not want the disclosure made, only to the extent that the provider perceives a serious and imminent threat to the health or safety of the patient or others and the family members are in a position to lessen the threat.
Read the full answer
      2096-Does HIPAA permit a doctor to contact a patient’s family or law enforcement if the doctor believes that the patient might hurt herself or someone else?
    Yes. The Privacy Rule permits a health care provider to disclose necessary information about a patient to law enforcement, family members of the patient, or other persons, when the provider believes the patient presents a serious and imminent threat to self or others. The scope of this permission is described in a letter to the nation’s health care providers.
Read the full answer
      2097-If a law enforcement officer brings a patient to a hospital or other mental health facility to be placed on a temporary psychiatric hold, and requests to be notified if or when the patient is released, can the facility make that notification?
    The Privacy Rule permits a HIPAA covered entity, such as a hospital, to disclose certain protected health information, including the date and time of admission and discharge, in response to a law enforcement official’s request, for the purpose of locating or identifying a suspect, fugitive, material witness, or missing person.
Read the full answer
      2098-If a doctor believes that a patient might hurt himself or herself or someone else, is it the duty of the provider to notify the family or law enforcement authorities?
    A health care provider’s “duty to warn” generally is derived from and defined by standards of ethical conduct and State laws and court decisions such as Tarasoff v. Regents of the University of California.
Read the full answer
      2099-Does HIPAA prevent a school administrator, or a school doctor or nurse, from sharing concerns about a student’s mental health with the student’s parents or law enforcement authorities?
    Student health information held by a school generally is subject to the Family Educational Rights and Privacy Act (FERPA), not HIPAA.
Read the full answer
      3000-Does having a health care power of attorney (POA) allow access to the patient’s medical and mental health records under HIPAA?
    Generally, yes. If a health care power of attorney is currently in effect, the named person would be the patient’s personal representative (The period of effectiveness may depend on the type of power of attorney: Some health care power of attorney documents are effective immediately, while others are only triggered if and when the patient lacks the capacity to make health care decisions and then cease to be effective if and when the patient regains such capacity).
Read the full answer
      3001-When does HIPAA allow a doctor to notify an individual’s family, friends, or caregivers that a patient has overdosed?
    If the patient who has overdosed is incapacitated and unable to agree or object, a doctor may notify a family member, personal representative, or another person responsible for the individual’s care of the patient’s location, general condition, or death. See 45 CFR 164.510(b)(1)(ii). Similarly, HIPAA allows a doctor to share additional information with a patient’s family member, friend, or caregiver as long as the information shared is directly related to the person’s involvement in the patient's health care or payment for care. 45 CFR 164.510(b)(1)(i).ER:
Read the full answer
      3002-What constitutes a “serious and imminent” threat that would permit a health care provider to disclose PHI to prevent harm to the patient, another person, or the public without the patient’s authorization or permission?
    HIPAA expressly defers to the professional judgment of health professionals in making determinations about the nature and severity of the threat to health or safety posed by a patient. OCR would not second guess a health professional’s good faith belief that a patient poses a serious and imminent threat to the health or safety of the patient or others and that the situation requires the disclosure of patient information to prevent or lessen the threat. Health care providers may disclose the necessary protected health information to anyone who is in a position to prevent or lessen the threatened harm, including family, friends, caregivers, and law enforcement, without a patient’s permission.
Read the full answer
      3003-If an adult patient who may pose a danger to self stops coming to psychotherapy sessions and does not respond to attempts to make contact, does HIPAA permit the therapist to contact a family member?
    Yes, under two possible circumstances:

Given that the patient is no longer present, if the therapist determines, based on professional judgment, that there may be an emergency situation and that contacting the family member of the absent patient is in the patient’s best interests; or
	If the disclosure is needed to lessen a serious and imminent threat and the family member is in a position to avert or lessen the threat.Read the full answer
      3004-Does HIPAA require a mental health provider to let a patient know that the provider is going to share information with others before disclosing PHI to prevent or lessen a serious and imminent threat?
    Not at the time of disclosure; however, the Notice of Privacy Practices should contain an example of this type of disclosure so patients are informed in advance of that possibility. See 45 CFR 164.520(b).
Read the full answer
      3005-How does HIPAA interact with the federal confidentiality rules for substance use disorder treatment information in an emergency situation—which rules should be followed?
    A health provider that provides treatment for substance use disorders, including opioid abuse, needs to determine whether it is subject to 42 CFR Part 2 (i.e., a “Part 2 program”) and whether it is a covered entity under HIPAA. Generally, the Part 2 rules provide more stringent privacy protections than HIPAA, including in emergency situations. If an entity is subject to both Part 2 and HIPAA, it is responsible for complying with the more protective Part 2 rules, as well as with HIPAA. HIPAA is intended to be a set of minimum federal privacy standards, so it generally is possible to comply with HIPAA and other laws, such as 42 CFR Part 2, that are more protective of individuals’ privacy.
Read the full answer
      3006-When does HIPAA allow a hospital to notify an individual’s family, friends, or caregivers that a patient who has been hospitalized for a psychiatric hold has been admitted or discharged?
    Hospitals may notify family, friends, or caregivers of a patient who has been hospitalized for a psychiatric hold has been admitted or discharged in several circumstances.
Read the full answer
      3007-Does HIPAA permit health care providers to share protected health information (PHI) about an individual who has mental illness with other health care providers who are treating the same individual for care coordination/continuity of care purposes?
    HIPAA permits health care providers to disclose to other health providers any protected health information (PHI) contained in the medical record about an individual for treatment, case management, and coordination of care and, with few exceptions, treats mental health information the same as other health information.
Read the full answer
      3008-Does HIPAA permit health care providers to share PHI about an individual with mental illness with a third party that is not a health care provider for continuity of care purposes?
    HIPAA, with few exceptions, treats all health information, including mental health information, the same. HIPAA allows health care providers to disclose protected health information (PHI), including mental health information, to other public or private-sector entities providing social services (such as housing, income support, job training) in specified circumstances.
Read the full answerBack to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​