Disclosure of Mental Health Records in Court-Mandated Outpatient Treatment Proceedings and the Health Insurance Portability and Accountability Act (HIPAA)

Ana Gomez; Susan C. Knight

Disclosure of Psychiatric Records to Determine the Need for Court-Ordered Outpatient Treatment Without Notice to the Patient or the Patient's Permission Violates the Privacy Rule Adopted by the Federal Government Pursuant to HIPAA

In the Matter of Miguel M. v. Barron, 950 N.E.2d 107 (N.Y. 2011), the New York Court of Appeals considered whether the release of a patient's mental health records to establish the need for mandated court-ordered outpatient treatment without giving notice or seeking the patient's consent violates provisions of HIPAA. In particular, the court considered whether the disclosure is permitted under HIPAA's “public health” exception or “treatment” exception, despite state laws that permit the disclosure.

Facts of the Case

N.Y. Mental Hyg. Law § 9.60 (1999), commonly known as Kendra's Law, stemmed from the death of Kendra Webdale after a man with paranoid schizophrenia, who was noncompliant with psychiatric treatment, pushed her in front of an oncoming subway train. After this incident, the New York legislature enacted a system of assisted outpatient treatment (AOT). The goal of AOT was to help those with chronic mental illness avoid hospitalization by providing them community supervision, which includes court-ordered outpatient treatment. To qualify under this law, evidence must be established that a mentally ill person's lack of compliance with treatment has resulted in at least two psychiatric hospitalizations in the past 36 months. Public officials were given the task of enforcing Kendra's Law.

It was in light of these provisions that Dr. Barron, the Director of Psychiatry at Elmhurst Hospital Center, initiated proceedings for Miguel M. to be evaluated for qualification under the provisions of AOT. Dr. Garza, the director of AOT at Elmhurst Hospital Center, testified that he received Mr. M.'s mental health records by directly requesting them from centers where Mr. M. obtained treatment. Mr. M. was not given notice that his records would be requested. He did not authorize the release of his records, and no court order was obtained, nor was a subpoena served, for their release. Mr. M.'s counsel objected to the inclusion of the records, as evidence in the AOT proceeding, but they were included despite his objection. The Supreme Court, Queens County, Matter of M.M., 852 N.Y.S.2d. 696 (N.Y. Sup. Ct. 2007), ordered Mr. M to six months of AOT. Mr. M appealed the decision.

On appeal, In the Matter of Miguel M., 66 A.D.3d 51 (N.Y. App. Div. 2009), the Supreme Court of New York, Appellate Division, Second Department, affirmed the ruling of the lower court. The court found that disclosures of Mr. M.'s mental health records were permissible under the Privacy Rule of HIPAA, 45 C.F.R. 164.512 (b)(1)(i) (2003), because the circumstances of the case qualified under the exception provisions, such that patient authorization was not required. The court regarded the requesting doctor as a “public health authority” and the AOT program and the AOT director's investigative duties as a “public health intervention” and “public health investigation,” respectively, under the above statute. They also held that HIPAA did not preempt the state statute related to the confidentiality of clinical records. Mr. M appealed the decision to New York's highest court, the Court of Appeals.

Ruling and Reasoning

The court held that the Privacy Rule adopted by the federal government pursuant to HIPAA did not allow the disclosure of mental health information to an entity for use in a proceeding to mandate mental health treatment where the patient did not authorize disclosure and was not given notice of the request for records. The core question was whether the disclosure of Mr. M.'s medical records was allowed by virtue of either exception to the Privacy Rule. The court interpreted the language of the Privacy Rule differently from the lower court, in that the “public health” exception was viewed as a reference to facilitate government activities that protect the public masses from large-scale health concerns, such as epidemics and environmental hazards. Thus, the disclosure of Mr. M.'s mental health records did not fit within the definition of the public health exception.

The Privacy Rule also provides an exception for the disclosure of protected health information “for treatment activities of a health care provider.” However, the court viewed this exception as applicable to providers working together, such as a primary care doctor and a specialist. Thus, it was outside of the scope of the instant case in which treatment was to be rendered by a volunteer provider against the patient's wishes.

Although neither exception was applicable, the court asserted that Dr. Barron could have pursued a court order or issued a subpoena to obtain Mr. M.'s records, but he would have had to give Mr. M. notice that his records were subject to such a request. Outside of extenuating circumstances, Dr. Barron could not have obtained a court order for the records without giving Mr. M. notice. Dr. Barron would simply have had to put forth a “reasonable effort” to notify Mr. M.

Discussion

In short, the court stated, “we hold only that unauthorized disclosure without notice is … inconsistent with the Privacy Rule” (Miguel M., p 112). The court did not feel that it was imposing a difficult burden by requiring that patients be given a chance to object before their records are disclosed. They emphasized that their intent was not to encumber the enforcement of Kendra's Law. The court did not expect that there would be great difficulty in obtaining a patient's mental health records, because even if the individual objected, they expected that this would often be overruled. It seems logical that a court would order the release of medical records over the objection of someone who is mentally ill, since the purpose of Kendra's Law is to order treatment for individuals with mental illness who are considered at risk of decompensation.

Certain sections of New York's Civil Procedure Law and Rules (N.Y. CPLR) that legislate HIPAA-authorized consents were amended and subsequently enacted on August 3, 2011. These revisions affect the above decision and state that subpoenas issued for the purpose of obtaining medical records (including mental health records) must be issued with “HIPAA compliant authorizations” (i.e., the patient's consent). Therefore, a court order is the only way to obtain medical records when a patient does not give consent; a subpoena is insufficient (Clark J: HIPAA as an evidentiary rule. J Law Health 26:1–28, 2013).

If a jurisdiction adopted a strict interpretation of N.Y. CPLR 2011 revisions (or similar statutes), it could necessitate a cumbersome and time-consuming process to obtain mental health records when the patient does not consent and no exceptions apply. Such a process could thwart the original intent of mandated outpatient treatment programs such as AOT. A jurisdiction that is less stringent may enact a simple process of notice to the patient followed by a subpoena if the patient does not respond. Interpretative provisions will vary with jurisdiction, depending on multiple factors including resources, legal precedent, and the balance between social justice attitudes toward the rights of the mentally ill versus societal rights to public safety.