HIPAA Compliance Guide for Rehabilitation Psychology Practices

Which rehabilitation psychology practices must comply with HIPAA?

A rehabilitation psychology practice must comply with HIPAA if it is a HIPAA covered entity—for example, a health care provider that electronically transmits health information in connection with a transaction for which HHS has adopted a standard. Standard transactions include electronic insurance claims. A provider may still be covered when a billing service or other third party conducts the transaction on its behalf. Simply using email or another electronic tool does not, by itself, make a provider a covered entity. See HHS guidance on covered entities and business associates.

When a practice is covered, HIPAA applies to protected health information it creates, receives, maintains, or transmits, in paper or electronic form. The Security Rule focuses specifically on electronic protected health information (ePHI). A practice’s size or private-practice status does not alone determine whether it is covered; the standard-transaction test does.

Practices also commonly use outside organizations—such as billing companies, cloud-storage providers, or electronic health record vendors—that handle PHI on the practice’s behalf. These organizations may be HIPAA business associates. Covered entities generally need a written business associate agreement (BAA) with a business associate that specifies permitted uses and disclosures and requires appropriate safeguards. Business associates also have direct HIPAA obligations. Review HHS guidance on business associates.

How should practices distinguish psychotherapy notes from the designated record set?

HIPAA defines psychotherapy notes narrowly. They are notes recorded by a mental health professional that document or analyze the contents of a private counseling conversation, and they must be kept separate from the rest of the patient’s medical record. A separate file or label alone does not make ordinary clinical documentation psychotherapy notes; both the content and the way the notes are maintained matter. See HHS guidance on psychotherapy notes.

The definition excludes information such as medication prescriptions and monitoring, session start and stop times, treatment modalities and frequency, clinical test results, and summaries of diagnosis, functional status, treatment plans, symptoms, prognosis, or progress. Information maintained in the patient’s medical record is not psychotherapy-note material under the HIPAA definition.

A designated record set includes medical and billing records, claims and payment records, and other records used, in whole or in part, to make decisions about an individual. Rehabilitation psychology SOAP notes that document diagnosis, functional status, interventions, treatment plans, or progress will generally be part of the clinical record rather than separately maintained psychotherapy notes. The format or title of a note does not decide its status. See HHS guidance on designated record sets and access.

Maintain any qualifying psychotherapy notes separately from the accessible medical and billing record, restrict access to staff who need it, and avoid copying psychotherapy-note content into routine clinical documentation unless it is clinically necessary. Keep the clinical information needed for treatment, payment, and care coordination in the designated record set.

What patient access rights apply to clinical and billing records?

Patients generally have the right to inspect or obtain a copy of the PHI about them in the practice’s designated record set. That right of access applies to relevant records in paper or electronic form, including clinical notes, billing and payment records, and records held by a business associate for the practice. Separately maintained psychotherapy notes are excluded from the HIPAA right of access, as are certain other limited categories of information. See HHS’s right-of-access guidance.

A practice generally must act on an access request within 30 calendar days. If it cannot meet that deadline, it may take one additional 30-day extension, but it must give the patient written notice within the original period explaining the delay and stating when it will respond. When granting access, the practice should provide the information in the requested form and format if it is readily producible. Permitted fees are limited to reasonable, cost-based charges under HIPAA.

Do not deny access simply because a record is old, archived, or held by a vendor. HIPAA allows denial only in limited circumstances, and some denials are subject to review. Keep a process for receiving, tracking, and responding to requests; verify the requester’s identity and authority; and coordinate with business associates that maintain responsive records. For the limited grounds for denial, see HHS guidance on denying access.

Which administrative, physical, and technical safeguards protect ePHI?

The HIPAA Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of ePHI. Safeguards must fit the organization’s circumstances and risks; HIPAA does not prescribe one universal security setup for every practice. A central requirement is a documented risk analysis that identifies where ePHI is created, received, maintained, or transmitted and assesses threats and vulnerabilities. See HHS guidance on Security Rule risk analysis.

• Administrative safeguards: Assign security responsibilities; conduct and document risk analysis and risk management; train workforce members; establish access and incident-response policies; and maintain contingency plans, such as procedures for backups and restoring access after an emergency.
• Physical safeguards: Control access to rooms and equipment; secure workstations and devices; prevent unauthorized viewing of screens or paper records; and manage the storage, reuse, and disposal of devices and media containing ePHI.
• Technical safeguards: Use appropriate access controls, unique user identification, authentication, audit controls, integrity protections, and transmission security to restrict and monitor electronic access to ePHI.

Encryption is an addressable implementation specification—not a blanket rule that every system must use one particular encryption method. The practice must assess whether encryption is reasonable and appropriate in its environment. If it is not, the practice must document its decision and implement an equivalent alternative measure when reasonable and appropriate. “Addressable” does not mean the safeguard can be ignored without assessment and documentation. See HHS guidance on encryption and the HHS summary of the Security Rule.

How should psychologists manage and secure clinical records?

Use written procedures that explain how staff create, access, amend, disclose, store, and dispose of clinical records. Give each workforce member access appropriate to their job, promptly change access when roles change, and remove access when it is no longer needed. Train staff to verify recipients before sending records and to use practice-approved systems for communications containing PHI.

Separate qualifying psychotherapy notes from the designated record set, apply tighter access controls to them, and avoid placing their contents in routine billing or care-coordination workflows. For electronic records, review access logs, maintain backups, secure devices and remote access, and use risk-appropriate protections for information in transit and at rest. For paper records, limit access to storage areas and prevent records from being left visible in shared or public spaces.

HIPAA’s Privacy Rule does not set a general medical-record retention period. State law and other applicable requirements may set retention rules, so check the rules that apply to your practice. Regardless of how long a record is kept, protect it while it is maintained and dispose of it securely. See HHS guidance on medical-record retention.

What are the limits and exceptions to psychotherapy-note protections?

In most cases, a practice needs the patient’s valid psychotherapy note authorization before using or disclosing separately maintained psychotherapy notes. This protection generally applies even when another health care provider requests the notes for treatment. A general release or routine consent should not be treated as a substitute for an authorization that meets HIPAA’s requirements. See HHS guidance on mental health information and psychotherapy notes.

HIPAA recognizes limited exceptions to the authorization requirement. These include the note originator’s use of the notes for treatment; certain supervised training programs; defending the covered entity in a legal action brought by the individual; and specified disclosures required or permitted by law, such as certain HHS compliance investigations, lawful oversight of the note originator, coroner or medical examiner functions, and disclosures to avert a serious and imminent threat to health or safety.

The serious-threat exception is not a general permission to disclose psychotherapy notes whenever there is a concern. HIPAA permits disclosure when the covered entity has a good-faith belief that it is necessary to prevent or lessen a serious and imminent threat and discloses to someone reasonably able to help address it. The disclosure must also be consistent with applicable law and ethical standards. State laws may impose additional requirements or protections. See HHS guidance on disclosures to address serious threats.

In practice, sound compliance depends on correctly identifying which records are in the designated record set, limiting access to ePHI, responding to patient requests on time, and documenting safeguards and authorization decisions.

FAQs

Can patients access SOAP notes held by a rehabilitation psychology practice?

Generally, yes, if the SOAP notes are part of the patient’s designated record set. Notes that describe diagnosis, functional status, treatment plans, symptoms, or progress are not excluded from access merely because they document psychotherapy or are labeled “SOAP notes.” Separately maintained psychotherapy notes that meet HIPAA’s narrow definition are excluded from the HIPAA right of access.

Are separately maintained psychotherapy notes part of the designated record set?

Qualifying psychotherapy notes are excluded from the HIPAA right of access to the designated record set when they document or analyze counseling conversations and are kept separate from the rest of the medical record. Other clinical documentation—including treatment summaries and progress notes—may remain part of the designated record set.

When does disclosing psychotherapy notes require patient authorization?

Authorization is generally required before using or disclosing psychotherapy notes, including for most treatment, payment, or health care operations purposes and disclosures to other providers. HIPAA provides limited exceptions, including certain uses by the note originator for treatment and specified disclosures required or permitted by law. Check applicable state law as well.

What safeguards must a practice use to protect ePHI?

A practice must use administrative, physical, and technical safeguards that are reasonable and appropriate to protect ePHI’s confidentiality, integrity, and availability. This includes conducting a risk analysis, managing identified risks, controlling and monitoring access, securing workstations and devices, and protecting information in electronic systems and during transmission. Safeguards should be documented and reviewed as the practice’s systems and risks change.