forensic psychologist
forensic psychologist
Bruce Borkosky, Psy.D. PA forensic psychologist and expert witness
Bruce Borkosky, Psy.D. PA forensic psychologist and expert witness

HIPAA blog

Some thoughts on the disclosure of health care records, including both state law and HIPAA.

July 8, 2017




You can access the video and other trainings here:


Nurses and MD's can obtain 1/2 hour CE credits.


What is included in the PHI to which patients have access? Anything that is “used to make decisions” about the patient. This includes “virtually everything” (in the records).


The following are not valid reasons to withhold all or portions of the records:

  • the “age” of records (how long ago they were created)
  • if patient has not paid their bill
  • if you think that seeing the records will upset the patient (“you can’t handle the truth”)
  • if the patient has had bad interactions with the practice
  • if the patient has been discharged from the practice
  • if the patient has “moved on”
  • insecure or unencrypted transmission methods (e.g., email)
  • if the patient will do something with the records that is not in their best interest (e.g., showing CCE reports to others or posting it to social media).
  • disclosures to a 3rd party
  • requiring the patient to obtain the records from a different provider (e.g., the originator of the records, or a larger entity)


Requirements for access

  • authentication does not include “making the patient take extraordinary steps” (such as making a patient in a rural area make several 1-hour trips)
  • although 30 days is the maximum timeframe within which to comply with an access request, there really is no good reason to wait this long if you have electronic records
  • permitted fee is solely based on the cost of the labor involved in copying (not for searching, retrieval)
  • Patient must be informed of fee in advance
  • Written request (can be “virtual”)


What are valid limits / exclusions?

  • psychotherapy notes
  • if the patient has not made written request
  • If you cannot authenticate / verify patient/representative identity,
  • if the information might cause someone significant physical harm (including suicide attempt/gesture),
  • if the transmission mode would present unacceptable risk to the PHI (e.g., posting to an unsecured web page) or the provider’s system
  • information compiled in anticipation of litigation (see definition below)


Recommended practices:

  • Patient portals to provide free copies are encourage
  • Create a formal access / disclosure process


Litigation - “if you have collected information in preparation for litigation, that’s not something that you are using to make decisions about individuals. But be careful about that one, because the underlying information that may have been used to make a decision about an individual is part of the DRS that individuals that a right to, even if it ultimately ends up in a litigation file.”



October 8, 2016




People v. Johnson, Supreme Court Case No. 16SA96 (Colo. Oct. 3, 2016).


This is a Colorado Supreme Court case, so it might have substantial influence in other states. 


In this case, the juvenile criminal defendant had been charged with conspiracy to commit murder, and was being tried in adult court. The juvenile petitioned the court to get the case sent back to juvenile, and the state wanted get a copy of her mental health records, as part of a court ordered mental health evaluation. 


In order to pierce privilege, the state argued that the defendant relied on her mental condition as a defense (e.g., that she was not mentally impaired). The Appeals court based its decision on the plain language of the privilege and transfer statutes. It noted that the trial court was required to "consider relevant mental health or psychological assessments or screenings", but only those that are "made available". The Court observed that this language does not include either an express or implied waiver of privilege. Thus, privilege is not waived in such circumstances. 


Interestingly, the Court used that same logic to defeat the state's request for a court ordered mental health evaluation. The reasoning, apparently, is that the statute only requires that the trial court consider the mental health information proffered by the parties - it does not give authority for the court to order a mental health evaluation, nor does it require the juvenile to submit to an evaluation. 


This may have been poor wording on the part of the legislature, because all courts consider all the evidence presented by parties. Why would the legislature need to specifically mention mental health? However, the chosen wording does not permit the trial court to act.


This might be considered to be more a 'limits of the authority of a judge' case than it is a psychotherapy privilege case. The reason is that privilege cases are typically construed in a manner that limits privilege as much as possible. IOW, this case might have been framed from the perspective of 'is there any way we can limit privilege here'? Instead, it seemed to have been viewed from the perspective of 'the legal system is not permitted to do this unless we have clear permission to do so.'


In recognizing the importance of the psychotherapist-patient privilege, the Court cited People v. Sisneros, 55 P.3d 797 (Colo. 2002).  Sisneros had observed that "The mere threat of disclosure destroys the sanctity of the psychologist-patient relationship." (at 802).

October 1, 2016




As I (and my attorney coauthors) have previously described in 3 separate articles, HIPAA does not exclude forensic evaluations from those services that it regulates. If the evaluator is a HIPAA covered entity, then the evaluator must comply with HIPAA, even regarding those evalations.


Now comes confirmation from Donna Vanderpool, who is an attorney for the American Psychiatric Association's professional liability insurance program, PRMS ( As one of the primary attorneys for PRMS, the advice provided should be considered official (or at least semi-official) guidance for all psychiatrists. Ms. Vanderpool states,


"For providers that are covered providers under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Privacy Rule’s requirements apply to all disclosures of protected health information, regardless of the purpose for which the protected health information was created. The type of service rendered and the existence of a provider-patient relationship are irrelevant in determining if the requirements of the Privacy Rule apply. Once a provider meets the regulatory definition of a healthcare provider subject to HIPAA’s regulations, then that provider must comply with the Privacy Rule’s requirements for all uses and disclosures of protected health information."


Vanderpool, D. (2016). Professional Liability for Forensic Activities: Liability Without a Treatment Relationship. Innovations in Clinical Neuroscience13(7-8), 41.


Based on past experience, it may be unlikely that psychologists who practice forensics, neuropsychology, police, and other similar subspecialties will be persuaded to change their opinions or practices. To date, given the preponderance (if not overwhelming) evidence that evaluators are required to disclose records pursuant to evaluee request, many of these evaluators remain unconvinced and refuse to change their practices. For example, Randy Otto is expected to assert (in his upcoming book) that evaluators can refuse to permit evaluee-access to their records under most circumstances (personal communication).


Goldstein, A. M., Otto, R. K., & Heilbrun, K. (2017) Ethics in Forensic Psychology Practice. Wiley. 978-1118712047. expected 5/8/17





September 20, 2016




MERIDIAN HEALTH SVCS CORP. v. Bell, No. 71A04-1511-DR-2005 (Ind. Ct. App. Sept. 14, 2016).


my comments in dark blue font




  • Parents in ongoing custody dispute, minor child in psychotherapy
  • 3/2015, father’s attorney requests minor child’s records (method not stated)
  • 5/2015, Psychotherapist refuses, sends letter from atty
  • 7/2015, father attempts deposition of psychotherapist and subpoena’s records
  • 7/2015, psychotherapist files motion to quash
  • 7/2015, father files motion to show cause why psychotherapist should not be held in contempt
  • 9/2015, hearing held, trial court denied motion to quash and motion for protective order, and prohibited the parents from sharing the record-contents as well as even acknowledging their receipt and possession of the records.
  • 10/2015, father attempted 2nd deposition and subpoena for records.
  • 10/2015, instead of complying with the court order, psychotherapist sent records to the trial court, as well as a motion to seal the records.
  • 10/2015, trial court performed an in camera review of the records
  • 10/2015, father moved for attorney fees, trial court granted, and psychotherapist appealed.



Father entitled to direct access to minor child’s psychotherapy records, and is not required to seek a court order, because HIPAA permits, and state law requires, psychotherapists to release minor child's records to both parents. Psychotherapist was found in contempt and ordered to pay Father's attorney fees for failing to obey trial court’s order to disclose records.



"HIPAA defers to state law with respect to the ability of the parent to obtain health information about the minor child: the health care provider may disclose to a parent the minor's protected health information to the extent it is permitted or required by state law; conversely, the health care provider may not disclose the information when and to the extent state law prohibits such disclosure. 45 C.F.R. § 164.502(g)(3)(ii)(A), (B)." (as I have stated several times, HIPAA does not restrict disclosures to the legal system)


“Indiana law regarding the mental health information of minors begins with the premise that records can be disclosed with the consent of the patient, Ind. Code § 16-39-2-3, and a parent is entitled to exercise the minor patient's rights on the patient's behalf, Ind. Code § 16-39-2-9(a)(1)” (apparently, there is no law restricting disclosure of a minor child’s records to parents – as there is in some states).


“Indiana law … [does restrict access] where … disclosure … would be detrimental to the physical and mental health of the patient. See Ind. Code § 16-39-2-4.” Psychotherapist “asserted that … if the provider may withhold the records from the child pursuant to section 16-39-2-4, it may withhold the records from the parents, as well.” 


Although Section 45 C.F.R. § 164.502(g)(5) permits withholding access due to several types of harm, because the disclosure changed from parental access to a disclosure to the legal system, “… the matter of disclosure became a judicial determination rather than a therapeutic judgment. See 45 C.F.R. § 164.512(e)(1) (permitting disclosure of protected health information in response to a court order).” (see note #8, where the judges misinterpret the HIPAA phrase “more stringent”.)


How HIPAA / state law preemption works is this:

– for disclosures to third parties, if state law restricts disclosure, state law is not preempted by HIPAA (regarding disclosures to 3rd parties, HIPAA is so permissive that it is nigh impossible for HIPAA to preempt state law).

– for patient access, whichever law permits/requires more access is the ruling law. IOW, state laws that restrict access are preempted by HIPAA and, if there are any state laws that require access where HIPAA does not permit, state law is not preempted.


Medical doctor was faulted for using a standard policy (citing the field of pediatrics), prohibiting all parental access to psychotherapy records. MD was apparently voicing a generalized concern for the welfare of children, and was unable to provide any testimony specific to the minor child or parents, regarding why the current situation might be harmful to the child. What this means for providers is that you need to have specific reasons why you think that the disclosure could be harmful to the patient. You need to be able to justify your decision with hard facts.


Psychotherapist not faulted “for taking steps it thought necessary to preserve patient confidentiality and serve its patient's best interest, especially considering [minor child] is unable to advocate for herself… ”. Further, psychotherapist was not sanctioned “for objecting to release of the records in the first instance.” The appellate court observed that “[s]tate and federal law in this area is complex and very few cases have interpreted the relevant statutes to offer guidance; in addition, once the records have been released, they cannot be protected—so it was important for [psychotherapist] to exercise its therapeutic judgment until a court could hear and decide the matter.

It is difficult to harmonize this section with the ruling that parents are not required to obtain a court order. Perhaps the court was saying that future Indiana psychotherapists COULD be faulted for taking similar steps? 




1. other courts might find the ruling persuasive, but they are not required to follow it.


2. if you get a court order telling you to disclose records, obey it, or you might find yourself having to pay atty fees.


3. if you get a valid subpoena to disclose records to the legal system, then laws regarding disclosures to third parties (e.g., HIPAA) don't apply - instead, comply with the legal system rules (e.g., privilege).


4. some states might have rules that restrict disclosure of a minor's records to the legal system. e.g., in FL it is called 'mature minor' (in such cases, the minor 'owns' the privilege). Also, in some states, the parents might not have the right to assert or waive privilege during a custody case.


5. States vary considerably regarding the privilege of psychotherapy records in custody cases, so you should be familiar with your state laws. 


6. However, IMO it never hurts to assert the patient's privilege on behalf of the patient, and obtain a court ruling on the matter (if you think it is in your patient's best interest) - just as Meridian did here (which the Court approved of).


7. IMO child custody evaluators always request all psychotherapy records, and always fail to consider the patient's privacy and privilege rights. They will tell you they need the records, even if they might not.


8. IMO, state laws that restrict patient access are all preempted by HIPAA. e.g., Indiana's law permitted refusal of access based on a provider's opinion that disclosure would be "detrimental to the physical and mental health of the patient". HIPAA does have some similar provisions, but almost always require a more severe harm (e.g., "endanger the life or physical safety"). Further, HIPAA requires that a third person review those records to which you don't permit access. 


9. There are state laws that do restrict access to parents, or disclosures to third parties, for minor's records. You should become aware of those laws, because they are not preempted by HIPAA.


10. Your state may have laws (unfortunately, buried in many sections of your state statutes) regarding when teens can consent to treatment (and, likely, disclosure of records). For example, in FL, teens consent to STD, when the are homeless, and many other conditions.





Dr. Bruce Borkosky, Psy.D.. PA

305 Pine Tree Dr,

Dothan AL 36303


Phone: (863) 386-0276

toll free (800) 919-9008

Fax: (863) 204-4679

Email: drborkosky at gmail dot com

Dr. Borkosky's practice is limited to telehealth at the present time.


please download my vita
updated 9/5/16
Print | Sitemap
© 2013, Bruce Borkosky, Psy.D.