The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides consumers with important privacy rights and protections with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers. Ensuring strong privacy protections is critical to maintaining individuals’ trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as mental health information. At the same time, the Privacy Rule recognizes circumstances arise where health information may need to be shared to ensure the patient receives the best treatment and for other important purposes, such as for the health and safety of the patient or others. The Rule is carefully balanced to allow uses and disclosures of information—including mental health information—for treatment and these other purposes with appropriate protections.

---

In this guidance, we address some of the more frequently asked questions about when it is appropriate under the Privacy Rule for a health care provider to share the protected health information of a patient who is being treated for a mental health condition.

We clarify when HIPAA permits health care providers to:

• Communicate with a patient’s family members, friends, or others involved in the patient’scare;
• Communicate with family members when the patient is an adult;
• Communicate with the parent of a patient who is a minor;
• Consider the patient’s capacity to agree or object to the sharing of their information;
• Involve a patient’s family members, friends, or others in dealing with patient failures toadhere to medication or other therapy;
• Listen to family members about their loved ones receiving mental health treatment;a
• Communicate with family members, law enforcement, or others when the patient presents aserious and imminent threat of harm to self or others;end
• Communicate to law enforcement about the release of a patient brought in for an emergencypsychiatric hold.

In addition, the guidance provides relevant reminders about related issues, such as the heightened protections afforded to psychotherapy notes by the Privacy Rule, a parent’s right to access the protected health information of a minor child as the child’s personal representative, the potential applicability of Federal alcohol and drug abuse confidentiality regulations or state laws that may provide more stringent protections for the information than HIPAA, and the intersection of HIPAA and FERPA in a school setting.