Is a therapist ever allowed to use/share my information without my knowing (for publications, case studies, etc.), provided he/she conceals my identity or otherwise makes me "untraceable"? I'm worried about becoming "material."
As you may be aware, the rules about health care privacy and confidentiality can be a bit complicated, but your question presents an opportunity to explore the issue further. Overall, the privacy and confidentiality of mental health or medical information is protected by state and federal laws and regulations. These laws are designed to protect how personal information is shared, maintain a person’s trust in their health care provider, and encourage them to seek care when necessary. They also provide protocol for events in which health information may need to be shared. Turning to your concern, the short answer to your question is that it depends what type of information you’re worried about being shared. In most cases, information found in your medical and mental health records can’t be shared without your authorization, but health care information that lacks any personally identifying information can be used for research purposes (more on that later). Additionally, if you’re worried about the confidentiality of notes taken by your therapist during a session, you may find it helpful to know that special privacy rules exist to protect this type of information to address concerns beyond their potential inclusion in publications or case studies.
When it comes your mental health information being used for research purposes, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule allows for de-identified health care information to be used in publications or for studies without consent from the individual. The key word here is de-identified, meaning the information must not contain any protected health information (PHI). PHI is any identifiable health information about an individual and includes details about past, present, or future health conditions, any care an individual receives, as well as health care payment information. PHI also includes demographic information related to health information. The rationale behind this privacy rule is to allow information to be used for research or other endeavors without jeopardizing privacy. HIPAA’s privacy rule is a federal regulation that provides the minimum level of protection and states may have their own additional PHI regulations. One more thing to note, individuals can give authorization to use or disclose their PHI for research. If an individual changes their mind later and doesn't want their information to be used, the researcher can legally continue to use and disclose the PHI that they’ve already obtained to maintain the integrity of the research. However, any new information collected cannot be used.
In terms of mental health records in general, it’s also good to be aware that there are special privacy protections in place under HIPAA for psychotherapy notes. Psychotherapy notes are ones taken by a mental health professional and aren’t included in a patient’s medical record. A patient must give their authorization to have psychotherapy notes disclosed for any purpose. This is because these types of notes often contain sensitive information and aren’t needed for treatment, payment, or other operational health care purposes. The exception to this authorization rule is made for reporting abuse or when there’s a situation in which an individual may harm themselves or others.
The Privacy Rule does allow health care providers to communicate relevant health care information with a patient’s family, friends, or other individuals involved in the patient’s care, so long as the patient has given the okay to share them. If the patient is unconscious or incapacitated, the information can be shared with this same group of people if and when the health care provider determines that it’s in the patient’s best interest.
If you’re worried about your privacy being breached then perhaps it may be helpful to have a discussion with your therapist. This can be an opportunity to review a copy of the Notice of Privacy Practices (which providers are required both to share with and ask for a signed acknowledgement of receipt from their patients) together, voice concerns, and establish a common ground regarding needs, expectations, trust, and intentions with her/him. If you continue to feel uneasy after this conversation, you may also want to check out How to find a therapist to discover tips on how to find a provider that’s a good match for all your needs.Alice!