Ethical and Clinical Issues in Integrated Care Settings: Patient Privacy Concerns and Electronic Health Records
Sound ethical decision making is essential to astute and compassionate clinical care. Wise practitioners readily identify and reflect on the ethical aspects of their work. They engage, often intuitively and without much fuss, in careful habits—in maintaining therapeutic boundaries, in seeking consultation from experts when caring for patients who are difficult to treat or have especially complex conditions, in safeguarding against danger in high-risk situations, and in endeavoring to understand more about mental illnesses and their expression in the lives of patients of all ages, in all places, and from all walks of life. These habits of thought and behavior are signs of professionalism and help ensure ethical rigor in clinical practice.Psychiatry is a specialty of medicine that, by its nature, touches on big moral questions. The conditions we treat often threaten the qualities that define human beings as individual, autonomous, responsible, developing, and fulfilled. Furthermore, these conditions often are characterized by great suffering, disability, and stigma, and yet individuals with these conditions demonstrate tremendous adaptation and strength. If all work by physicians is ethically important, then our work is especially so. As a service to Focus readers, this column provides ethics commentary on topics in clinical psychiatry. It also offers clinical ethics questions and expert answers to sharpen readers’ decision-making skills and advance astute and compassionate clinical care in the field.—Laura Weiss Roberts, M.D., M.A.
Integrated care models for mental health care, in which psychiatry or other behavioral health care is incorporated into primary care (or vice versa), are increasingly promoted as an important strategy to increase the timeliness and access to mental health care (1). Some evidence demonstrates that integrated care leads to improvements in treatment for common mental health conditions, particularly depression (2, 3), but findings are not uniformly supportive (4). As the push for greater use of integrated care models continues, the need for integration of health information across disciplines, and information systems to support them, will likewise grow (5).
Ethical issues raised by integrated care models have been minimally studied or addressed thus far. Here, we raise several ethical issues posed by integrated care models, particularly related to the privacy of patient health information through the use of electronic health records (EHRs) or health information exchanges. Major putative benefits of EHRs and health information exchanges include facilitating access to medical information across multiple providers (leading, it is believed, to a reduction in medical errors), efficient exchange of information, and enhanced collaboration and quality of care. Such access may occur actively, through the intentional exchange of chart notes among providers, or passively, when providers include information in common shared fields of EHRs, such as problem lists, medication lists, or laboratory tests. However, the extensive sharing of medical information made possible by electronic platforms may come into conflict with patients’ preferences, practice standards, and professional codes of ethics for the privacy of mental health information.
In this article, we aim to describe and examine evolving tensions among patient preferences, medical necessity, government regulations, and ethical guidance related to privacy of mental health records in an environment of increasing digitization and sharing of health records. Differences in stakeholder perspectives, clinical examples, and proposed next steps for the field are discussed.
Patient Perspective
How much do patients want their non–mental health care providers—their primary care providers (PCPs), specialists, and other health care professionals and their staff—to know about their mental health issues and mental health care? Our understanding of patient preferences is limited, but patients likely have a wide range of understanding and beliefs about how mental health information is handled. On one end of the spectrum, concern about the social stigma of a mental health diagnosis is significant enough to prevent some patients from ever seeking care (6).
Among patients who do seek care, most (although not all) support electronic sharing of medical information among providers. At the same time, these individuals wish for control over who has access to what information (7, 8). In particular, patients prefer to maintain control over which members of a health care team have access to their sensitive medical information, including records containing mental health and substance abuse information (7). Patients have noted concerns about making behavioral health information widely accessible in their medical record because of possible stigmatization from non–behavioral health care providers (9).
Despite what is known about patient preferences, medical record systems typically do not provide patients with the ability to select which medical professionals are allowed access to which types of health information. On the systems level, some records systems have so-called break-the-glass mechanisms, which require additional authentication or justification for accessing areas of the medical record thought to contain sensitive medical information. However, the specific parameters of the break-the-glass mechanisms, including how they are deployed and who is required to use them, are not necessarily determined by the patient. In fact, it is unknown whether most patients realize such mechanisms exist. Complicating matters further, each health care institution, system, clinic, or provider may be designing its own rules about how these mechanisms are implemented. Moreover, it is also far from clear whether firmer barriers (i.e., further restricting access to sensitive medical information) are in the best interest of the patient and whether such barriers should be controlled by patient or provider.
Legal Guidelines
The Health Insurance Portability and Accountability Act (HIPAA) provides legal barriers to releasing protected health information (PHI), but its boundaries are designed to protect patients from unauthorized access to medical information while maintaining latitude for treating providers to access and share information. As stated in the summary of the Privacy Rule, “A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being” (10). Under the Privacy Rule of HIPAA, health care providers may disclose PHI for the purposes of treatment, payment, or health care operations, which results in a large number of people falling into the category of authorized users.
For treatment purposes, the full medical record can be shared without specific authorization by the patient (11). HIPAA requires the provider to make a good-faith effort to supply the patient with a notice of privacy practices. Although not all providers are HIPAA entities, the HIPAA Privacy Rule has come to represent a standard of care around the privacy and confidentiality of medical records.
Under federal law, additional authorization for release of information is required specifically for the release of psychotherapy notes and drug and alcohol records maintained in connection with any federally assisted alcohol and drug program (11). Notes maintained in the formal medical record containing elements such as the diagnosis and treatment plan are not considered psychotherapy notes and are treated as part of the medical record. Such protections were developed because of federal concerns regarding the stigmatization of mental health issues as well as the notion that psychotherapy notes may not be medically relevant to anyone other than the psychotherapist (11).
State laws, including Medicaid laws, may also have more stringent rules than the federal guidelines do. In some cases, written consent is required before medical information can be released (11).
Professional Standards
Although HIPAA allows treating providers to exchange some particular types of mental health records without specific patient consent, it does not preclude providers from taking additional steps to ensure the privacy and confidentiality of mental health information, such as requesting consent from patients before releasing information to other providers or limiting the mental health information included in the medical record to what is minimally necessary.
Professional standards promulgated by mental health organizations tend to favor nondisclosure of clinical records unless there are, as termed by the National Association of Social Workers, “compelling professional reasons” to disclose (12, 13). Such standards may conflict with the gestalt of an open medical information exchange system in which other providers could read mental health notes or have access to shared schedules that allow nontreating providers to know that a patient was seeking mental health treatment.
The American Psychiatric Association (APA; www.psychiatry.org) maintains resources relevant to this discussion on its Web site, including HIPAA guides and additional recommendations for cautious documentation of PHI in the medical record. In the practice of psychiatry in particular, the boundary between what is considered medical care versus what is considered psychotherapy can be blurred. To clarify those boundaries, the APA recommends that psychiatrists keep the following types of information outside the formal medical record and maintain such records within psychotherapy notes, which are afforded greater privacy protection under the law: “intimate personal content or facts; details of fantasies and dreams; process interactions; sensitive information about other individuals in the patient’s life; the therapist’s formulations, hypotheses, or speculations; topics/themes discussed in therapy sessions” (14). Such details are arguably not necessary for continuity of care, reimbursement, or clinical operations (14).
The American Medical Association does not suggest additional protections beyond those outlined by the HIPAA Privacy Rule for management of PHI. However, the literature suggests that PCPs prefer that mental health providers share more mental health information, even if it is sensitive, in the problem lists of EHRs than they currently do, likely reflecting the role of such information in the comprehensive treatment of patients’ general health (15). Thus, PCPs and behavioral health clinicians sharing an EHR may have different standards and expectations regarding the sharing of sensitive health information (16).
Case 1
A 50-year-old male is seen in a primary care clinic and referred to the clinic’s embedded psychiatrist for an evaluation of depression and anxiety. The patient reveals to the psychiatrist that he has been escalating his alcohol use to one to two bottles of wine every night. The psychiatrist discusses the possibility of an alcohol use disorder contributing to his symptoms. The patient requests that the diagnosis and details of his alcohol use be kept out of his medical chart and not shared with his PCP. The psychiatrist is concerned about leaving important information out of the medical record but is unsure if she can put this information in the chart without the patient’s consent because the PCP would technically have access to it.
1.1.
Which of the following types of mental health information require specific patient authorization to disclose to other health care providers (beyond provision of notice of privacy practices or in situations of medical emergency or legal mandates), according to federal guidelines?
A.
Any mental health information in the medical record
B.
Psychotherapy notes
C.
Records pertaining to drug or alcohol treatment at federally funded facilities
D.
B and C only
The Case Continues
Later in the day, the PCP notes to the psychiatrist in their team meeting that the patient has developed hypertension and has not responded to several trials of antihypertensives. The psychiatrist becomes concerned that the alcohol use could be contributing to the patient’s medical problems. The psychiatrist reviews legal and professional standards and consults with a legal advisor. The psychiatrist ultimately decides that she should provide the information about the patient’s alcohol use to the PCP for treatment purposes.
1.2.
Which of the following documentation strategies would best balance the ethical tensions of patient autonomy, beneficence, and veracity?
A.
Assure patient that the diagnosis will not be discussed with the PCP and leave it out of the record.
B.
Assure the patient that the diagnosis will not be discussed with the PCP and include the diagnosis of alcohol use disorder in the EHR problem list so the PCP sees it.
C.
Inform the patient that one has the ethical obligation to disclose the alcohol use to the PCP for ongoing treatment. If the patient is in disagreement, advise the patient to find care elsewhere.
D.
Prior to establishing a treatment relationship with the patient, notify the patient that relevant health information will be shared with other treating providers within the care model.
Case 2
A 40-year-old woman has seen a psychiatrist within a multidisciplinary health system for medication management and psychotherapy for treatment of bipolar disorder. She has been stable for many years, taking 1,200 mg of lithium daily in addition to participating in weekly psychotherapy sessions. She was involved in a motor vehicle accident that resulted in multiple fractures, surgery, and hospitalization for surgical services in the same health system where she sees her psychiatrist. On postoperative day 1, she requested additional pain medication beyond what was prescribed and became increasingly distraught when her requests were denied. Upon seeing a diagnosis of bipolar disorder in the EHR problem list, the nurse suggested to the patient that she might need an adjustment in her lithium dose to manage her emotional distress. The patient was unaware that information regarding her psychiatric diagnosis and medications was available to other treatment providers not involved in her psychiatric care.
2.1.
If a patient is not aware that his or her mental health information is accessible to other clinicians within a health system, which of the following laws or ethical principles may the clinician or health system be at risk of transgressing?
A.
The HIPAA Privacy Rule, if the patient was never provided a notice of privacy practices
B.
Informed consent
C.
Veracity
D.
All of the above
The Case Continues
The patient returns to her psychiatrist and asks that her diagnosis and medication be removed from the shared problem list and medication lists in the medical record.
2.2.
Which of the following are potential risks to the patient of restricting the surgical service’s access to her diagnosis of bipolar disorder or treatment with lithium?
A.
The patient’s treating providers on the surgical service could be unprepared to assess for psychiatric exacerbations due to the trauma of the motor vehicle accident.
B.
The patient may not receive her lithium regularly, putting her at risk for a mood relapse.
C.
The surgical service may unknowingly prescribe treatments that could result in drug-drug interactions with lithium.
D.
All of the above
The Case Continues
The patient further states she does not believe it is medically necessary for nonbehavioral health clinicians to access this information because their training in distinguishing mental from physical distress is inadequate and they provide lower quality care to patients with psychiatric diagnoses.
2.3.
If the patient’s assertion that clinicians provide poorer quality of care to patients with psychiatric diagnoses is true, which ethical principle would most likely be in jeopardy?
A.
Veracity
B.
Justice
C.
Autonomy
D.
Informed consent
Conclusion
The above cases illustrate some of the challenges faced by the psychiatrists and other behavioral health care clinicians serving as gatekeepers of mental health information into the electronic medical record. Because there are few if any legal or professional guidelines to assist providers with identifying information to maintain in a shared electronic medical record, providers should develop policies specific to their practice that take into account state and federal law, provider practice standards, and patient autonomy. The standards may vary depending on the setting: For example, a solo private practitioner may have stricter privacy policies than a physician within a coordinated care setting with multiple behavioral health and primary care providers managing behavioral health issues. In either case, providers should place a high priority on informed consent—patients should have a clear understanding of what information within the medical records is available to other providers, including problem lists, medication lists, and schedules highlighting their appointments with mental health providers.
In addition, behavioral health providers should document within the medical record what is minimally necessary to provide care for the patient and communicate with current and future providers. Additional information could be maintained as psychotherapy notes that, under the HIPAA Privacy Rule, would require formal written consent by the patient for release. The American Psychiatric Association’s Council on Psychiatry and the Law provided further guidance in defining information that could be kept outside the medical record: intimate personal content or facts; details of fantasies and dreams; process interactions; sensitive information about other individuals in the patient’s life; therapist’s formulations, hypotheses, or speculations; and topics or themes discussed in therapy sessions (14).
A final barrier to effectively balancing the patient’s interests of privacy and good health care is the stigma of mental illness within the medical profession. Some argue that ardent protection of mental health records from view of other providers contributes to that stigma by flagging these diagnoses as shameful and compartmentalizing the treatment of these conditions to mental health providers only. But it is unclear if removing privacy protections on patient mental health records would benefit individual patients. Broader education and exposure to mental health issues for nonbehavioral health providers is imperative, but attempts to provide education for physicians outside of mental health have not been very successful (17). Integrated health models in which nonbehavioral medical professionals and behavioral health clinicians conjointly treat patients may be a more organic way to increase knowledge of mental illness and reduce stigma.
Answers
1.1.
The answer is D. Under the HIPAA Privacy Rule, behavioral health clinicians do not need to obtain patient consent to release information to other providers for the purposes of treatment, except when releasing psychotherapy notes or drug and alcohol records maintained in connection with any federally assisted alcohol and drug program. Nevertheless, ethical principles (veracity, informed consent) may compel clinicians to inform patients of disclosures of any patient health information.
1.2.
The answer is D. Ideally, providing informed consent to the patient prior to beginning an evaluation and treatment would best achieve the ethical principles of patient autonomy (by allowing the patient to choose to engage in treatment or not engage in treatment given the care model’s confidentiality limitations), beneficence (by respecting patient autonomy), and veracity (by being truthful about the nature of information exchange). In answer A, the psychiatrist is sacrificing beneficence for patient autonomy. In answer B, the psychiatrist is sacrificing veracity for patient autonomy and the possibility of beneficence. Answer C favors beneficence over patient autonomy but may be the most reasonable strategy after the patient has revealed the alcohol use to the psychiatrist.
2.1.
The answer is D. Under the HIPAA Privacy Rule, health information can be shared with other providers for the purposes of treatment. The “minimal necessary” standard does not apply when information is released for treatment purposes, so there are no specific restrictions on what information can be made available to other treating clinicians. However, patients must be informed of information sharing practices under HIPAA. A treating clinician may determine that there is a medical need to access or share mental health information, which may be in conflict with a patient’s preference. Informed consent “requires that an individual truly understand and freely make a decision to undertake—or not—a proposed treatment approach in light of his or her own personal health care goals” (18). A patient’s informed consent includes the patient’s decision to participate in a health care model in which the patient’s medical information may be visible to other treating providers. To achieve informed consent, true and correct information (veracity) must be imparted to the patient.
2.2.
The answer is D. Restricting access of the surgical service to all elements of the behavioral health record would potentially put the patient at risk for mood relapse, drug-drug interactions, and misdiagnosis by the surgical staff.
2.3.
The answer is B. The principle of justice addresses the equitable distribution of resources and power, which may refer to distribution of power between patient and doctor or to societal distribution of resources (18). Patients who receive lower quality of care as a result of their mental health diagnoses would be receiving a disproportionate diminishment in medical resources relative to patients without mental health diagnoses.
References
1.
Manderscheid R, Kathol R: Fostering sustainable, integrated medical and behavioral health services in medical settings. Ann Intern Med 2014; 160:61–65
2.
Szymanski BR, Bohnert KM, Zivin K, et al: Integrated care: treatment initiation following positive depression screens. J Gen Intern Med 2013; 28:346–352
3.
Gilbody S, Bower P, Fletcher J, et al: Collaborative care for depression: a cumulative meta-analysis and review of longer-term outcomes. Arch Intern Med 2006; 166:2314–2321
4.
Butler M, Kane RL, McAlpine D, et al: Integration of Mental Health/Substance Abuse and Primary Care. Evidence report/technology assessment 173. Rockville, MD, Agency for Healthcare Research and Quality, 2008
5.
Kathol RG, Patel K, Sacks L, et al: The role of behavioral health services in accountable care organizations. Am J Manag Care 2015; 21:e95–e98
6.
Corrigan P: How stigma interferes with mental health care. Am Psychol 2004; 59:614–625
7.
Caine K, Hanania R: Patients want granular privacy control over health information in electronic medical records. J Am Med Inform Assoc 2013; 20:7–15
8.
Schwartz PH, Caine K, Alpert SA, et al: Patient preferences in controlling access to their electronic health records: a prospective cohort study in primary care. J Gen Intern Med 2015; 30(Suppl 1):S25–S30
9.
Supporting Integration of Behavioral Health Care Through Health Information Exchange. Denver, CO, Colorado Regional Health Information Organization, 2012. www.corhio.org/library/documents/PDF_Collateral/supporting_integration_of_behavioral_health_care_through_hie_april_2012-web.pdf. Accessed May 5, 2017
10.
Summary of the HIPAA Privacy Rule. Washington, DC, US Department of Health and Human Services, 2003. www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/. Accessed May 5, 2017
11.
A Delicate Balance: Behavioral Health, Patient Privacy, and the Need to Know. Oakland, CA, California Healthcare Foundation, 2008. www.chcf.org/∼/media/MEDIA%20LIBRARY%20Files/PDF/PDF%20A/PDF%20ADelicateBalanceBehavioralHealthAndPrivacyIB.pdf. Accessed May 5, 2017
12.
Behnke S: Disclosures of confidential information under the new APA Ethics Code: a process for deciding when, and how. Monit Psychol 2004; 35:78
13.
Code of Ethics of the National Association of Social Workers. Washington, DC, National Association of Social Workers, 2008. www.socialworkers.org/pubs/code/code.asp. Accessed May 5, 2017
14.
Resource Document on Psychotherapy Notes Provision of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Arlington, VA, American Psychiatric Association, 2002
15.
Holmes C, Brown M, Hilaire DS, et al: Healthcare provider attitudes towards the problem list in an electronic health record: a mixed-methods qualitative study. BMC Med Inform Decis Mak 2012; 12:127
16.
Hudgins C, Rose S, Fifield PY, et al: Navigating the legal and ethical foundations of informed consent and confidentiality in integrated primary care. Fam Syst Health 2013; 31:9–19
17.
Wallace JE: Mental health and stigma in the medical profession. Health 2012; 16:3–18
18.
Roberts LW, Dyer AR: Concise Guide to Ethics in Mental Health Care. Washington, DC, American Psychiatric Association, 2004
Information & Authors
Information
Published In
History
Published in print: Summer 2017
Published online: 18 July 2017
Keywords
Authors
Funding Information
Dr. Vemuri and Dr. Dunn report no financial relationships with commercial interests.
Metrics & Citations
Metrics
Citations
Export Citations
If you have the appropriate software installed, you can download article citation data to the citation manager of your choice. Simply select your manager software from the list below and click Download.
For more information or tips please see 'Downloading to a citation manager' in the Help menu.
View Options
View options
PDF/EPUB
View PDF/EPUBLogin options
Already a subscriber? Access your subscription through your login credentials or your institution for full access to this article.
Personal login Institutional Login Open Athens loginNot a subscriber?
PsychiatryOnline subscription options offer access to the DSM-5-TR® library, books, journals, CME, and patient resources. This all-in-one virtual library provides psychiatrists and mental health professionals with key resources for diagnosis, treatment, research, and professional development.
Need more help? PsychiatryOnline Customer Service may be reached by emailing [email protected] or by calling 800-368-5777 (in the U.S.) or 703-907-7322 (outside the U.S.).