A patient’s suicide is a difficult time for the patient’s family as well as for the psychiatrist involved. One of the situations that may arise following a patient suicide is a request for the patient’s medical records. The patient’s confidentiality protections extend beyond their death and the psychiatrist should be prepared to respond to questions such as: who can lawfully obtain the records, and what verifications does the psychiatrist need to ensure compliance with federal and state law? The answers to these questions are made even more complex by the fact that each state has their own laws that must be followed – in addition to adherence to the HIPAA regulations. This article provides some guidance regarding these issues as well as proactive strategies to minimize the angst that may occur when such requests are made.

Are there special considerations related to the release of mental health records?

Generally, HIPAA does not differentiate between behavioral health records and other types of protected health information (PHI). An exception exists with regard to psychotherapy notes which require specific authorization for disclosure. Psychotherapy notes are understood to be “process notes” or documentation of the therapist’s impressions or personal notes about the patient – details of the psychotherapy conversation that are considered inappropriate for the medical record and are used by the provider for future sessions. Process notes must be kept separate from the official medical record in order to receive the heightened protection from disclosure and require that the personal representative/authorized person specifically permit disclosure of this information. Otherwise, HIPAA defers to state law with regard to the category of persons entitled to obtain behavioral health records. When there are discrepancies between federal and state law, follow this rule of thumb: the more restrictive law applies. For example, if the federal provisions are more restrictive than your state’s law, follow federal law. If your state’s law is more restrictive than federal law, follow state law.

Who can obtain a deceased patient’s records?

Strictly speaking, under federal law, i.e., HIPAA, the patient’s personal representative can access the records. HIPAA was also amended to permit access by a person who was involved in the patient’s care or payment for care. Specifically, HIPAA also permits disclosure to those “who were involved in the individual’s care or payment for health care prior to the individual’s death…unless doing so is inconsistent with any prior expressed preference of the individual that is known to the Covered Entity (CE).”¹

In some cases, the records requestor might be law enforcement or a coroner investigating the patient’s death. Generally, HIPAA allows disclosure of protected health information to a law enforcement official, without an authorization, provided that certain conditions are met.² Similarly, HIPAA allows access to coroners and medical examiners for the purpose of identifying the decedent, determining a cause of death, or other duties as authorized by law.³ A CE can also disclose protected health information to funeral directors, without an authorization, as necessary to carry out their duties with respect to the decedent.⁴ Note that this disclosure is a bit more limited and requires a determination of what information is “necessary to carry out their duties” and this could be interpreted as something less than the entirety of the patient’s record.

In contrast, the requirements of some state’s laws are not always straightforward. For example, in some states, the category of persons authorized to obtain records/information might be voluminous and may include the patient’s spouse, or an executor (if different than the spouse), as well as the patient’s children. Other states have more restrictive laws that limit disclosure to a smaller circle of people. Following a patient’s suicide, the psychiatrist may receive a call or request from several family members requesting information about treatment. The responsibility is on the psychiatrist to be familiar with any state exceptions or specific provisions related to the release of behavioral health records/information concerning treatment and should consult with their local attorney or risk management professional with any questions that may arise.

What verifications are needed to lawfully release mental health records?

The overriding principle is that reasonable steps must be taken to verify the identity of the person requesting the records as well as their authority to obtain the records. This might mean requiring production of a marriage certificate or other reliable indicia of that person’s role in the patient’s estate, such as a Fiduciary’s Probate Certificate reflecting who has been appointed as executor or administrator.

If you feel uncomfortable with releasing the records or you are not confident that the materials presented are adequate, the onus is on the requestor to provide you with sufficient information so that you can confidently fulfill the federal and state requirements. This might mean that the requestor has to obtain additional documentation or an order from a court, law enforcement, or administrative body that proves their status. A clear office policy that outlines the federal and state requirements can be a helpful reference to any requestor confused about their obligations. Some providers keep a copy of the state’s regulations to show the requestor exactly what is required under the applicable law. Other providers may give examples of the types of documentation or authorization that is required. This will provide helpful guidance to the requestor or without making it seem like you are obstructing their ability to obtain the records.

Under some circumstances, CEs are also required to give the patient an opportunity to restrict the uses or disclosure of their PHI. The patient should be aware of their privacy rights and the potential exposure of their personal health information after death. This might include giving patients a form outlining your privacy policies with an opportunity for the patient to identify their personal representative or the person(s) to whom the records should not be released. Ideally, this conversation would occur when a new patient begins their relationship with you, but existing patients should also be educated about their rights.

Prevention is the Best Medicine

One of the best ways to handle requests for records is to ensure that the psychiatrist, office, and/or healthcare institution maintain strong documentation and record keeping practices. Anytime there is a concern about suicidality, there must be documentation of a suicide risk assessment. Notes of office visits should be contemporaneously entered into the medical record and must contain the pertinent elements of the communication. It is essential to document telephone communications. Some calls, such as those related to the scheduling of appointments, might not seem to be critical, however, calls with questions and concerns from the patient or loved ones, or telephone sessions must be treated in the same manner as an in-person visit. In one reported case, the patient’s family alleged that she called her psychiatrist complaining of depression, suicidality, and insomnia. The psychiatrist referred the patient to a gastroenterologist for stomach issues. There was no documentation of the phone call and what symptoms the patient actually reported to the psychiatrist. The psychiatrist was less able to defend his care at the time of trial because of the lack of evidence to support his treatment decisions. The best defense if there is ever a question about your care is a note that demonstrates thoughtful consideration of the patient’s risk factors and a plan to address those concerns.

Medication management is another area that requires careful attention. There are countless cases where a provider’s care is criticized because a medication was prescribed without an awareness of the other medications the patient was taking, by whom they were being prescribed, and for what purpose. The efficacy of any prescribed medications should be assessed on a regular basis to ensure that the patient is receiving the intended benefits. Refill requests, particularly for controlled substances, should not be given without reflection on the patient’s mental status and consideration of the possibility of contraindications with other prescribed medications. Suicidal ideation is a known side effect of many antidepressants and this risk is often compounded when mixed with other medications. Most states also have prescription drug monitoring programs (PDMPs) that are useful tools to evaluate the patient’s prescription history and the possibility of abuse or diversion. Some states mandate their use and, thus, documentation confirming that the database was consulted is imperative. There are also guidelines published by the Substance Abuse and Mental Health Services Administration (SAMHSA) regarding opioid treatment programs; these resources are free and available online.

A patient’s suicide is devastating and often unpredictable. However, psychiatrists can have some measure of comfort in these situations if they know their records reflect thorough assessment and treatment of the patient’s condition. Although state and federal rules may appear daunting, a clear and informed office policy about how the records can be lawfully released will allow you to handle any disclosure with less apprehension about your legal obligations. Keep in mind that you do not have to go through this process alone. If you have concerns about whether or how to disclose the patient’s medical records, consult with your local attorney or risk management professional.