Ethical and Clinical Issues in Integrated Care Settings: Patient Privacy Concerns and Electronic Health Records

Integrated care models for mental health care, in which psychiatry or other behavioral health care is incorporated into primary care (or vice versa), are increasingly promoted as an important strategy to increase the timeliness and access to mental health care (1). Some evidence demonstrates that integrated care leads to improvements in treatment for common mental health conditions, particularly depression (2, 3), but findings are not uniformly supportive (4). As the push for greater use of integrated care models continues, the need for integration of health information across disciplines, and information systems to support them, will likewise grow (5).

Ethical issues raised by integrated care models have been minimally studied or addressed thus far. Here, we raise several ethical issues posed by integrated care models, particularly related to the privacy of patient health information through the use of electronic health records (EHRs) or health information exchanges. Major putative benefits of EHRs and health information exchanges include facilitating access to medical information across multiple providers (leading, it is believed, to a reduction in medical errors), efficient exchange of information, and enhanced collaboration and quality of care. Such access may occur actively, through the intentional exchange of chart notes among providers, or passively, when providers include information in common shared fields of EHRs, such as problem lists, medication lists, or laboratory tests. However, the extensive sharing of medical information made possible by electronic platforms may come into conflict with patients’ preferences, practice standards, and professional codes of ethics for the privacy of mental health information.

In this article, we aim to describe and examine evolving tensions among patient preferences, medical necessity, government regulations, and ethical guidance related to privacy of mental health records in an environment of increasing digitization and sharing of health records. Differences in stakeholder perspectives, clinical examples, and proposed next steps for the field are discussed.

Patient Perspective

How much do patients want their non–mental health care providers—their primary care providers (PCPs), specialists, and other health care professionals and their staff—to know about their mental health issues and mental health care? Our understanding of patient preferences is limited, but patients likely have a wide range of understanding and beliefs about how mental health information is handled. On one end of the spectrum, concern about the social stigma of a mental health diagnosis is significant enough to prevent some patients from ever seeking care (6).

Among patients who do seek care, most (although not all) support electronic sharing of medical information among providers. At the same time, these individuals wish for control over who has access to what information (7, 8). In particular, patients prefer to maintain control over which members of a health care team have access to their sensitive medical information, including records containing mental health and substance abuse information (7). Patients have noted concerns about making behavioral health information widely accessible in their medical record because of possible stigmatization from non–behavioral health care providers (9).

Despite what is known about patient preferences, medical record systems typically do not provide patients with the ability to select which medical professionals are allowed access to which types of health information. On the systems level, some records systems have so-called break-the-glass mechanisms, which require additional authentication or justification for accessing areas of the medical record thought to contain sensitive medical information. However, the specific parameters of the break-the-glass mechanisms, including how they are deployed and who is required to use them, are not necessarily determined by the patient. In fact, it is unknown whether most patients realize such mechanisms exist. Complicating matters further, each health care institution, system, clinic, or provider may be designing its own rules about how these mechanisms are implemented. Moreover, it is also far from clear whether firmer barriers (i.e., further restricting access to sensitive medical information) are in the best interest of the patient and whether such barriers should be controlled by patient or provider.

Legal Guidelines

The Health Insurance Portability and Accountability Act (HIPAA) provides legal barriers to releasing protected health information (PHI), but its boundaries are designed to protect patients from unauthorized access to medical information while maintaining latitude for treating providers to access and share information. As stated in the summary of the Privacy Rule, “A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being” (10). Under the Privacy Rule of HIPAA, health care providers may disclose PHI for the purposes of treatment, payment, or health care operations, which results in a large number of people falling into the category of authorized users.

For treatment purposes, the full medical record can be shared without specific authorization by the patient (11). HIPAA requires the provider to make a good-faith effort to supply the patient with a notice of privacy practices. Although not all providers are HIPAA entities, the HIPAA Privacy Rule has come to represent a standard of care around the privacy and confidentiality of medical records.

Under federal law, additional authorization for release of information is required specifically for the release of psychotherapy notes and drug and alcohol records maintained in connection with any federally assisted alcohol and drug program (11). Notes maintained in the formal medical record containing elements such as the diagnosis and treatment plan are not considered psychotherapy notes and are treated as part of the medical record. Such protections were developed because of federal concerns regarding the stigmatization of mental health issues as well as the notion that psychotherapy notes may not be medically relevant to anyone other than the psychotherapist (11).

State laws, including Medicaid laws, may also have more stringent rules than the federal guidelines do. In some cases, written consent is required before medical information can be released (11).

Professional Standards

Although HIPAA allows treating providers to exchange some particular types of mental health records without specific patient consent, it does not preclude providers from taking additional steps to ensure the privacy and confidentiality of mental health information, such as requesting consent from patients before releasing information to other providers or limiting the mental health information included in the medical record to what is minimally necessary.

Professional standards promulgated by mental health organizations tend to favor nondisclosure of clinical records unless there are, as termed by the National Association of Social Workers, “compelling professional reasons” to disclose (12, 13). Such standards may conflict with the gestalt of an open medical information exchange system in which other providers could read mental health notes or have access to shared schedules that allow nontreating providers to know that a patient was seeking mental health treatment.

The American Psychiatric Association (APA; www.psychiatry.org) maintains resources relevant to this discussion on its Web site, including HIPAA guides and additional recommendations for cautious documentation of PHI in the medical record. In the practice of psychiatry in particular, the boundary between what is considered medical care versus what is considered psychotherapy can be blurred. To clarify those boundaries, the APA recommends that psychiatrists keep the following types of information outside the formal medical record and maintain such records within psychotherapy notes, which are afforded greater privacy protection under the law: “intimate personal content or facts; details of fantasies and dreams; process interactions; sensitive information about other individuals in the patient’s life; the therapist’s formulations, hypotheses, or speculations; topics/themes discussed in therapy sessions” (14). Such details are arguably not necessary for continuity of care, reimbursement, or clinical operations (14).

The American Medical Association does not suggest additional protections beyond those outlined by the HIPAA Privacy Rule for management of PHI. However, the literature suggests that PCPs prefer that mental health providers share more mental health information, even if it is sensitive, in the problem lists of EHRs than they currently do, likely reflecting the role of such information in the comprehensive treatment of patients’ general health (15). Thus, PCPs and behavioral health clinicians sharing an EHR may have different standards and expectations regarding the sharing of sensitive health information (16).

Case 1

A 50-year-old male is seen in a primary care clinic and referred to the clinic’s embedded psychiatrist for an evaluation of depression and anxiety. The patient reveals to the psychiatrist that he has been escalating his alcohol use to one to two bottles of wine every night. The psychiatrist discusses the possibility of an alcohol use disorder contributing to his symptoms. The patient requests that the diagnosis and details of his alcohol use be kept out of his medical chart and not shared with his PCP. The psychiatrist is concerned about leaving important information out of the medical record but is unsure if she can put this information in the chart without the patient’s consent because the PCP would technically have access to it.

The Case Continues

Later in the day, the PCP notes to the psychiatrist in their team meeting that the patient has developed hypertension and has not responded to several trials of antihypertensives. The psychiatrist becomes concerned that the alcohol use could be contributing to the patient’s medical problems. The psychiatrist reviews legal and professional standards and consults with a legal advisor. The psychiatrist ultimately decides that she should provide the information about the patient’s alcohol use to the PCP for treatment purposes.

Case 2

A 40-year-old woman has seen a psychiatrist within a multidisciplinary health system for medication management and psychotherapy for treatment of bipolar disorder. She has been stable for many years, taking 1,200 mg of lithium daily in addition to participating in weekly psychotherapy sessions. She was involved in a motor vehicle accident that resulted in multiple fractures, surgery, and hospitalization for surgical services in the same health system where she sees her psychiatrist. On postoperative day 1, she requested additional pain medication beyond what was prescribed and became increasingly distraught when her requests were denied. Upon seeing a diagnosis of bipolar disorder in the EHR problem list, the nurse suggested to the patient that she might need an adjustment in her lithium dose to manage her emotional distress. The patient was unaware that information regarding her psychiatric diagnosis and medications was available to other treatment providers not involved in her psychiatric care.

The Case Continues

The patient returns to her psychiatrist and asks that her diagnosis and medication be removed from the shared problem list and medication lists in the medical record.

The Case Continues

The patient further states she does not believe it is medically necessary for nonbehavioral health clinicians to access this information because their training in distinguishing mental from physical distress is inadequate and they provide lower quality care to patients with psychiatric diagnoses.

Conclusion

The above cases illustrate some of the challenges faced by the psychiatrists and other behavioral health care clinicians serving as gatekeepers of mental health information into the electronic medical record. Because there are few if any legal or professional guidelines to assist providers with identifying information to maintain in a shared electronic medical record, providers should develop policies specific to their practice that take into account state and federal law, provider practice standards, and patient autonomy. The standards may vary depending on the setting: For example, a solo private practitioner may have stricter privacy policies than a physician within a coordinated care setting with multiple behavioral health and primary care providers managing behavioral health issues. In either case, providers should place a high priority on informed consent—patients should have a clear understanding of what information within the medical records is available to other providers, including problem lists, medication lists, and schedules highlighting their appointments with mental health providers.

In addition, behavioral health providers should document within the medical record what is minimally necessary to provide care for the patient and communicate with current and future providers. Additional information could be maintained as psychotherapy notes that, under the HIPAA Privacy Rule, would require formal written consent by the patient for release. The American Psychiatric Association’s Council on Psychiatry and the Law provided further guidance in defining information that could be kept outside the medical record: intimate personal content or facts; details of fantasies and dreams; process interactions; sensitive information about other individuals in the patient’s life; therapist’s formulations, hypotheses, or speculations; and topics or themes discussed in therapy sessions (14).

A final barrier to effectively balancing the patient’s interests of privacy and good health care is the stigma of mental illness within the medical profession. Some argue that ardent protection of mental health records from view of other providers contributes to that stigma by flagging these diagnoses as shameful and compartmentalizing the treatment of these conditions to mental health providers only. But it is unclear if removing privacy protections on patient mental health records would benefit individual patients. Broader education and exposure to mental health issues for nonbehavioral health providers is imperative, but attempts to provide education for physicians outside of mental health have not been very successful (17). Integrated health models in which nonbehavioral medical professionals and behavioral health clinicians conjointly treat patients may be a more organic way to increase knowledge of mental illness and reduce stigma.

Answers