New Risks to Confidentiality in the Modern Era: Page 2 of 4

New Risks to Confidentiality in the Modern Era: Page 2 of 4


A psychiatrist treats a 25-year-old man for anxiety, depression, and polysubstance abuse. Part of the treatment involves prescribing medication for withdrawal. During the course of treatment, the psychiatrist receives a signed release of information from the patient’s primary care physician (PCP), who is requesting a copy of the medical record. The release does not specify substance abuse records, and regulations in the psychiatrist’s state require a specific authorization for their release. The psychiatrist inadvertently releases the patient’s record to the PCP, including the substance abuse treatment information, which the patient did not authorize him to release.

In this case, it appears that the psychiatrist violated a state law in releasing the substance abuse information without the patient’s consent. If the patient opposes the release of this information to the PCP, the reasonable course of action could have been to negotiate a compromise with the patient regarding releasing a subset of the most pertinent elements of the substance abuse history and treatment in relation to the patient’s medical care. Once a compromise is reached, the EMR needs to be able to generate a custom document with a compilation of the agreed-on elements of the psychiatric treatment record. If the patient refused to compromise, then the psychiatrist would be obligated to keep the PCP in the “dark”—a potentially untenable situation for both the psychiatrist and the PCP.

There may be general agreement on sharing some benign aspects of the record, such as dates on which the patient was seen; vital signs; diagnoses; and medications prescribed, with dates, doses, and response. However, deciding what information to share beyond this—and with whom—can be more challenging. Some have advocated for bringing the patient into the decision. While it may seem perfectly reasonable for patients to have the right to decide on release of their confidential information, it may be legally permissible under HIPAA to override the patient’s preference in disclosing health information between concurrently treating health professionals for the purpose of coordination of care.


A 35-year-old woman is a patient of both a PCP and a psychiatrist. The PCP is part of a group that uses an EMR system. The psychiatrist uses a paper and dictation system and does not have access to the same EMR system as the PCP. The psychiatrist prescribes a medication for the patient for treatment of bipolar disorder. The patient discloses that she is also taking a drug prescribed by her PCP that is known to interact with the agent being prescribed by the psychiatrist.

The psychiatrist informs the patient that he will need to advise the PCP of the potential for medication interaction. To provide comprehensive, collaborative treatment, the psychiatrist also indicates that he wishes to discuss the patient’s psychotherapy treatment with the PCP. The patient refuses to allow the psychiatrist to communicate with the PCP. After a thorough discussion with the patient, the psychiatrist documents the patient’s informed refusal and indicates to the patient that he cannot continue to prescribe medications unless he coordinates with the PCP. However, on the basis of the patient’s express wishes, he will not forward any information about the psychotherapy treatment. The patient is agreeable to this. The psychiatrist then obtains written informed consent specifying that he can discuss with the PCP medications prescribed and provide information.

This is an example of successful negotiation resulting in a reasonable decision regarding elements of psychiatric records that are acceptable to the patient to be shared “internally” with a PCP. Many systems have an “all or none” approach regarding access to psychiatric information among providers in different clinical programs. Ideally, systems allow providers to make nuanced decisions about which elements to include in shared record systems, after considering individual patient preferences, safety concerns, and clinical quality. Psychiatrists may advocate for this EMR characteristic as purchasers of systems for their private practice or if employed in an administrative role within an organization.

Psychiatric records commonly include references to other family members. Some of this may not be complimentary to those family members. However, the information is an important element of a psychiatric evaluation, especially for children and adolescents. Access to this type of information within EMR systems should ideally be limited to those who are providing the psychiatric treatment. This is another example of the utility of a feature that allows control of access privileges for specific, selected elements of the psychiatric record—“granular control.” This may be a particularly important consideration in treating a minor, since many EMR systems allow a patient access to his or her records and, by extension, usually to a minor’s parent(s)/guardian(s) with legal authority.


Loading comments...

By clicking Accept, you agree to become a member of the UBM Medica Community.