Protecting the Privacy of Foster Kids’ Therapy Notes

There is a question that has been asked of me multiple times over the past few months that I would like to answer. The question is: “Should a child’s foster parent(s) be granted access to their child’s psychotherapy notes?” The answer is not as straightforward as it may seem.

The short answer is: “No, a child’s foster parent(s) should not be granted access to their child’s psychotherapy notes.”

First, we must understand what the HIPAA privacy rule is, as it will ultimately answer the question. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, is a federal law which resulted in the establishment of the HIPAA Privacy Rule in December 2000. The HIPAA Privacy Rule is designed to protect information about individuals’ health care treatment. To understand privacy protections in the United States, you must start with this federally established framework and then consult state laws to determine whether there are any additional requirements to observe.

Second, we must understand what the HIPAA Privacy Rule has to say about “individual personal representatives.” An individual personal representative is any person with the authority to receive or access another individual’s protected health information (PHI).

In some cases, adults and emancipated minors have individual personal representatives, such as someone holding “power of attorney” or in a court-appointed adult guardianship or conservatorship. Otherwise, adults and emancipated minors do have uniquely boundaried privacy protections, whereas minors (children under 18 years old, with the exception of children—typically 16 or 17 only—who have been formally “emancipated” from dependency status by a court of law) always have at least one individual personal representative.

Children and adolescents in foster care tend to have many individual personal representatives, including representatives from Child Protective Services, attorneys, designated child-placing agency representatives such as case managers, foster parents acting as medical consenters, and, in some cases, juvenile probation officers. In rare cases, even court-appointed special advocates (CASA) may obtain status as medical consenters through a court and would, then, hold the distinction of an individual personal representative.

In addition, foster kids benefit from an extensive continuum of care including doctors, dentists, psychiatrists, clinical psychologists, school psychologists, school counselors, collaborative treatment team participants such as child-placing agency treatment directors (such as myself), and other consultants (at my agency, we have psychiatric fellows and residents as well as a program manager, intake coordinator, and, in some cases, a higher-level program administrator who all may participate in the ongoing treatment staffing related to a child’s case planning), therapists (individual, sibling, family, group), early childhood interventionists (speech, physical, and occupational therapists), and skills trainers. Each of these treatment providers freely accesses PHI of other providers in the course of treatment, which is necessary and beneficial for collaborative treatment.

Ultimately, these supports are beneficial, but often, along this stream of care, the “minimum necessary requirement,” a best-practices principle generally recognized and affirmed through the HIPAA Privacy Rule, is not sufficiently revered, and foster kids’ private and protected health information may not always be protected in practice with the same degree of diligence that it is in so many other sectors of health care. It is in this current that foster parents often believe that they, too, are entitled to the most private of health care information, their child’s therapy providers’ psychotherapy notes. I know this to be true from my own professional experience.

The third thing that you must understand to answer this question is that psychotherapy notes are given unique privacy protections within the HIPAA Privacy Rule, more so than all other protected health information (PHI), including purely diagnostic or evaluative information, case notes, other treatment services such as developmental therapies (speech, physical, occupational), as well as other treatment summaries or reports. Even reports via email from a therapist summarizing general or overall progress of therapy—or any other generalizing or summarizing report—are not given the same protections as psychotherapy notes themselves (U.S. Department of Health & Human Services [HHS], 45 CFR 164.508, 2006).

There is one final piece of this puzzle: The HIPAA Privacy Rule clarifies that, in certain circumstances, parents are not privileged to act as their minor children’s personal representatives—with respect to certain protected health information—and thus neither control the child’s health care decisions nor the protected health information related to that care:

1. If no existing state statute or binding legal precedent requires a parent’s consent prior to a minor child obtaining psychotherapy treatment, and if the minor child then consents to his or her own psychotherapy treatment without the expressed consent of a parent, then, with respect to the minor child’s participation in that psychotherapy treatment, no parent acts as the child’s personal representative and, thus, the parent(s) will not be provided access to the psychotherapy notes without the child’s written consent.
2. If a court grants or other law authorizes another adult to act as the personal representative for a minor child as it relates to the child’s health care, then the minor child may obtain consent for such psychotherapy treatment from another personal representative, as provided, without consent from a parent. Similarly, in this case, with respect to the minor child’s participation in that psychotherapy treatment, the parent(s) will not be provided access to the psychotherapy notes without the child’s written consent.
3. If a parent provides a written and signed waiver expressly relinquishing his or her own right to participation in a confidential relationship between their minor child and a psychotherapist, then the privacy of the psychotherapy notes—as well as, in some cases, other protected health information—will remain boundaried and protected between the provider and the minor child, and parent access will be restricted unless the minor child provides written consent to the access of these protected records.

Further clarification in the Code of Federal Regulations (CFR) should be noted: “Even in these exceptional circumstances, where the parent is not the ‘personal representative’ of the minor, the Privacy Rule defers to state or other laws that require, permit, or prohibit the covered entity to disclose to a parent, or provide the parent access to, a minor child’s protected health information. Further, in these situations, if state or other law is silent or unclear concerning parental access to the minor’s protected health information, a covered entity has discretion to provide or deny a parent with access to the minor’s health information, if doing so is consistent with state or other applicable law, and provided the decision is made by a licensed health care professional in the exercise of professional judgment”(U.S. Department of Health & Human Services [HHS], 45 CFR 164.502, 2003).

Because foster children do not require the consent of foster parents before they can obtain psychotherapy services—and may obtain consent, if required, by way of other representative adults (such as child welfare caseworkers, child-placing agency case managers, etc.), whether the child independently consents or secures a nonparent consent to participate in such therapy, then, under the HIPAA Privacy Rule, the foster parent(s), for the purposes of this particular health care service, will not be provided distinction under the law as the child’s personal representative, and, thus, will not be provided the right to access documentation from the treatment record.

However, again, it is not that the HIPAA Privacy Rule expressly denies that foster parents have access to their children’s therapy notes, and, in fact, a “covered entity,” or provider (meaning, the child’s therapist) does retain prerogative to provide or deny a parent access with discretion if doing so is consistent with state and other applicable laws. Yet, this should be justified therapeutically.

In most cases, it is difficult to make a case that it is in the best interests of the child, therapeutically, to take away what is typically the only confidential outlet a foster child or teen has within the convoluted and institutional system in which they live and, thus, it is best practice in my state (K. Teutsch, personal communication, January 4, 2013) and in every state to preserve the therapeutic relationship by preserving the boundaries of confidentiality within that relationship and of privacy concerning the psychotherapy notes.

References:

1. K. Teutsch, Division Administrator for Medical Services, Texas Department of Family and Protective Services, personal communication, January 4, 2013.
2. U.S. Department of Health & Human Services – Office for Civil Rights (2006). HIPAA Administrative Simplification: Regulation Text [45 CFR 160, 162, & 164]. Washington, DC: US Government.
3. U.S. Department of Health & Human Services – Office for Civil Rights (2003). OCR HIPAA Privacy: Personal Representatives [45 CFR 164.502(g)]. Washington, DC: US Government.

The preceding article was solely written by the author named above. Any views and opinions expressed are not necessarily shared by GoodTherapy.org. Questions or concerns about the preceding article can be directed to the author or posted as a comment below.