Nowhere is privacy more important than in the mental health field. We psychotherapists have always insisted on the highest standard of confidentiality for our patients. We want to be more protective than HIPPA and outdo the CIA in insisting on need-to-know. Even without the absolute protection the law gives attorney-client relationships, we resist whenever possible any intrusions from courts and from government investigators.
This effort has become even more important as privacy has disappeared from our society. People seem increasingly willing, even eager, to open their lives to public scrutiny through social media and other manifestations of the digital revolution. Texting, sexting, tweeting, personal blogging, online forums, and other displays of private, personal information are all too common, even when the consequences are employment problems, public shaming and legal jeopardy. Whether it’s loss of a job or a promotion, or revenge porn, or evidence in a criminal trial, the lesson never seems to be learned. If people want to be foolish in their personal lives, however, it’s their right to do so.
But nowadays many of us lose our privacy even when we want to protect it. Involuntary loss of privacy is increasingly prevalent as massive examples of hacking and the theft of personal information and identities destroys the attempt to keep private data private. Already, tens of millions of online medical records have fallen prey to malicious hackings. In our field, patients are routinely forced by third party payers to surrender their personal health data or lose their insurance coverage.
And now, a new and growing threat to the privacy of mental health information is the Electronic Health Record (EHR). With the government making the EHR a legal requirement, imposing fines for non-compliance and threatening to withhold reimbursement, the EHR is no longer a choice for many and soon might be universal. Even apparently benign uses of this data can lead to unauthorized disclosure when the EHR is shared with other providers, whether they be for medical, legal or justifiable mental health purposes. Once the information is out of our hands, we can no longer apply our standards to its release. The EHR represents a clear and present danger, but, unfortunately, it is also a legal document and cannot be entirely avoided.
The only remedy to this growing menace is to limit what we put into the EHR to the absolute necessary minimum. Examples are legally required data, such as the date of service, the next scheduled meeting, and any specific advice or prescribed treatment. We should also include any perceived risks, such as suicidal intent, and, most important, what steps we plan to take to mitigate them. Add perhaps any communications from other providers or significant sources of external information. In short, we are legally required to preserve any data that forms the basis for patient care.
We may also need to include the diagnosis, although that piece of data is the most problematic. Psychiatric diagnoses are simply observations that have been codified to facilitate communication and allow research comparisons. Nothing, however, embodies the stigma attached to mental illness more than a diagnostic label. In the EHR, available to all providers within the system and, through third party records, to anyone who ever provides care to that individual, it is likely to prejudice others against our patients and clients. Because it can bias the attitude of other caretakers, it may result in skewed, limited or even injurious treatment in the future. Where possible, we might use a brief description rather than a formal diagnosis. If that’s not feasible, then at least we can choose the least negative label available.
All the rest of what we’d like to memorialize—process notes, observations, plans, speculations and other insights—should be kept in a separate, non-digital record. Here is where paper is the best option. Paper can’t be hacked, won’t leave our control unless we want it to, and can be thoroughly and completely destroyed. No computer technician can retrieve the data from paper the way deleted material can be retrieved from a digital source. Paper can’t be squirreled away forever in a “cloud” server.
In our paper-based patient file—that only we ourselves will ever see—we can record anything that does not directly relate to patient care and that we would never want to release. After treatment ends, we can shred (or burn) the patient’s paper file and be confident we have protected both the patient’s privacy and our own standard of care.
File under: Law & Ethics