Mark Stafford
General Counsel
Kansas Board of Healing Arts
235 S. Topeka Blvd.
Topeka, Kansas 66603-3068
Dear Mr. Stafford:
As General Counsel for the Kansas Board of Healing Arts you request that we re-visit the conclusion reached in Part 3 of Attorney General Opinion No. 2001-36. You suggest that the conclusion reached therein was more restrictive in relation to the ability of state licensing agencies to obtain health information records than intended by federal privacy regulations. For the reasons stated herein, we agree and thus expand that conclusion.
Initially, for the benefit of those readers who are not familiar with Attorney General Opinion No. 2001-36, we reiterate Part 3 of that opinion. That part addressed the applicability of the federal Standards for Privacy of Individually Identifiable Health Information(1) to the Behavioral Sciences Regulatory Board's authority to issue an investigative subpoena for records maintained by a covered health care provider.(2)
"Pursuant to the authority granted by the Health Insurance Portability and Accountability Act of 1996, the Health Care Financing Administration, a division of the Department of Health and Human Services, issued final regulations related to the security and privacy of health care information.48 Although the regulations became effective April 16, 2001, the Department of Health and Human Services has given health care providers two years to achieve compliance.
"The obligations of these broad regulations apply to covered entities: 'health plans, health care clearinghouses, and health care providers'49 who 'transmit health information in electronic form in connection with certain transactions.'50 Health care includes 'preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment or procedure with respect to the physical or mental condition or functional status of an individual or that affects the structure or function of the body.'51 A psychologist is clearly considered a covered health care provider.
"The general privacy rule established by these regulations provides that a covered entity may not use or disclose protected health information, except as permitted or required by the regulations.52 Six general categories of permitted uses and disclosures are specified: (1) to the individual, (2) with a consent that complies with specified requirements, (3) without consent under certain conditions, except with respect to psychotherapy notes, (4) with an authorization that complies with specified requirements, (5) pursuant to an agreement as specified by the regulations and (6) as permitted by and in compliance with the section titled 'Uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required.'53 It is this last disclosure category with which we are concerned.
"In a number of situations a health provider may use and/or disclose health information without consent, without authorization and without opportunity for the individual to agree or object. One of those situations pertains to disclosures for judicial and administrative proceedings, either in response to a court or administrative tribunal order or in response to a subpoena, discovery request or other lawful process.54 Disclosure pursuant to a subpoena is authorized only if the subpoena is accompanied by satisfactory assurance that reasonable efforts have been made (1) to provide notice to the individual whose records are sought or (2) to secure a qualified protective order. The regulation specifies in detail what those reasonable efforts are required to entail.55
"Psychotherapy notes fall within the category of records that generally may be used or disclosed only if an authorization containing specified core elements has been obtained. However, there are exceptions to this general rule, including a use or disclosure that is permitted if required by law.56 In that event, a health care provider may disclose protected health information to the extent that such disclosure complies with and is limited to the relevant requirements of such law.57
"'Required by law means a mandate contained in law that compels a covered entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to . . . subpoenas . . . issued by . . . an administrative body authorized to require the production of information; . . . or an authorized investigative demand . . . .'58
"Assuming, therefore, that the Board complies with requirements of 45 C.F.R. 164.512(e) regarding notice or attempt to secure a qualified protective order and a Board-issued subpoena complies with statutory requirements regarding grounds for disciplinary action, relevancy and particularity, the Board would be able to access health information records, including psychotherapy notes, concerning an individual that are maintained by a health care provider, such as a psychologist.
"48 45 C.F.R. § 160 et seq. and 45 C.F.R. § 164 et seq.
"49 'Health care provider' includes any person or organization who furnishes, bills, or is paid for health care in the normal course of business. 45 C.F.R. § 160.103.
"50 45 C.F.R. § 164.104.
"51 45 C.F.R. § 160.103.
"52 45 C.F.R. § 164.502.
"5345 C.F.R. § 164.502.
"54 45 C.F.R. § 164.512(e). The other circumstances for which uses and/or disclosure is authorized under this subsection are as required by law, for public health activities, about victims of abuse, neglect or domestic violence, for health oversight activities, for law enforcement purposes, about decedents, for cadaveric organ, eye or tissue donation purposes, for research purposes, to avert a serious threat to health or safety, for specialized government functions, and for workers' compensation. 45 C.F.R. § 160.512(a) through (l).
"55 45 C.F.R. § 164.512 [reference omitted].
"56 45 C.F.R. § 164.508(a).
"5745 C.F.R. § 164.512(a).
"5845 C.F.R. § 164.501."
As seen, Attorney General Opinion No. 2001-36 focused on subsection (e) of 45 C.F.R. § 164.512 as a permissible mechanism by which the Board could subpoena health care records maintained by a licensed psychologist. You now ask that we consider the applicability of subsection (d) of 45 C.F.R. § 164.512 as an alternative mechanism by which the Board may subpoena such records. That section addresses the uses and disclosures of health care records for health oversight activities, and provides in pertinent part:
"A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including . . . administrative . . . investigations; . . . licensure or disciplinary actions; . . . or other activities necessary for appropriate oversight of: (i) the health care system; . . ."(3)
A "health oversight agency" is defined in pertinent part as "an agency or authority of . . . a State . . . that is authorized by law to oversee the health care system. . . ." At first glance one might not consider professional licensing boards, such as the Behavioral Sciences Regulatory Board or the Board of Healing Arts, as being included in this definition. However, as you point out, further guidance is found in the Department of Health and Human Service's explanatory comments to the regulation:
"The preamble to the proposed rule listed the following as examples of health oversight agencies that conduct oversight activities relating to the health care system: . . . state health professional licensure agencies, . . ."(4)
Additionally, according to the Department of Health and Human Services, "overseeing the health care system" includes "oversight of health care providers."(5) In our opinion the Behavioral Sciences Regulatory Board and the Board of Healing Arts would be considered health oversight agencies.
As discussed in our earlier opinion, under subsection (e) of 45 C.F.R. § 164.512, a professional licensing board must provide prior notice to the client or patient, or attempt to secure a qualified protective order, before a health care provider may disclose health information records pursuant to a board-issued investigative subpoena. Under subsection (d) of 45 C.F.R. § 164.512 these preliminary steps are not required prior to the issuance of a subpoena for investigative purposes by the Behavioral Sciences Regulatory Board or the Board of Healing Arts. As long as a licensing board-issued subpoena complies with statutory requirements regarding grounds for disciplinary action, relevancy and particularity, either Board, without taking the preliminary steps, would be able to access health information records, including psychotherapy notes,(6) concerning an individual that are maintained by a health care provider.
CJS:JLM:CN:jm
1. 45 C.F.R. Parts 160 through 164.
2. We note that the Board of Healing Arts investigative subpoena authority found at K.S.A. 65-2839a is nearly identical to that of the Behavioral Sciences Regulatory Board's authority found at K.S.A. 74-7508, as amended by L. 2001, Ch. 154, § 1(b)(1).
3. 45 C.F.R. § 164.501.
4. 65 Federal Register 82492 (Dec. 28, 2000), Section-by-Section Description of Rule Provisions, "Health Oversight Agency."
5. Id.
6. "[A] covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: . . . (ii) A use or disclosure that is . . . permitted by § 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; . . ." 45 C.F.R. 164.508(a)(2).