Background: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. HIPAA allows a state to establish standards that are more stringent than its provisions. In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. The UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.

Washington has heightened protections for information related to mental health, the human immunodeficiency virus (HIV), and sexually transmitted disease (STD). For mental health information, the fact of admission and all information and records compiled in the course of providing services to patients at public or private mental health agencies is confidential. With respect to HIV and STD information, it is prohibited to disclose the identity of a person who has considered or requested a test for a STD; the identity of the subject of a HIV antibody test or test for any other STD; the results of those tests; and information regarding the diagnosis of or treatment for HIV infection and for any other confirmed STD. Both the protections related to mental health, HIV, and STD information have several exceptions to allow the disclosure of the information without the patient's authorization or consent.

In 2013 legislation was enacted to combine health care information, mental health information, and STD information into a single statutory scheme, while continuing to recognize many of the different standards for information.

Summary of Bill: The term information and records related to mental health services is clarified to include mental health information contained in a medical bill, registration records, and all records about the person that are maintained by the Department of Social and Health Services, regional support networks, and treatment facilities. In addition to mental health agencies, the term includes information maintained by a mental health professional. The term excludes psychotherapy notes, which are defined to include notes recorded by a mental health professional that document the contents of conversations during counseling sessions and that are separated from the rest of the individual's medical record. The term mental health treatment records is eliminated, and references to it are changed to information and records related to mental health services.

The term mental health professional is expanded to include persons who work in a private setting, in addition to a public setting. Exceptions to the right of a patient to receive an accounting of disclosures of health care information are applied to mental health treatment information. The exceptions relate to uses or disclosures that pertain to treatment, payment, and health care operations; the patient's own health care information; uses or disclosures that are permitted or required by law; authorizations by the patient; directory information; persons involved in the patient's care; national security; correctional institutions or law enforcement officials; and limited data sets without identifying information.

Duplicative standards related to permissible disclosures of information and records related to mental health are eliminated so that a single standard applies to situations in which the communication is between mental health professionals and a state or local correctional facility where the patient is confined or supervised. The requirement that a person who receives health care information to perform services on behalf of a health care provider may not use the information in a manner inconsistent with the duties of the health care provider is changed so that the information may not be used in a manner that would violate confidentiality provisions if performed by the provider. The requirement that third-party payors only disclose health care information to the extent that a health care provider may disclose information without authorization is changed so that the third-party payor may only release health care information as provided under the UHCIA.

The requirement that a health care provider or facility terminate a contractual relationship with any entity that violates its responsibility to keep information confidential is made permissive.

The duration of an authorization to disclose health care information to a financial institution or an employer of the patient is extended from 90 days to one year.

Disclosures of health care information for research purposes may include health care information related to chemical dependency as authorized in state and federal law.

A reference to disclosures permitted in a treatment facility where a patient is receiving treatment is changed to clarify that the provision applies to mental health service agencies.