Skip to main content

Guide on the disclosure of confidential information: Health care information

Information on the disclosure of confidential information in regards to health care
Skip table of contents

Table of Contents

You skipped the table of contents section.

Overview

All doctors and other health care providers are subject to state and federal law requiring them to maintain the confidentiality of their patients’ health and medical information. The most well-known of such laws is the Privacy Rule of the federal Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 160 and 164.   

Numerous state and other federal laws impose more stringent limitations on the disclosure of health information than HIPAA. In cases where state or federal law is more stringent than HIPAA, any disclosure of information must comply with both HIPAA and the more stringent law. 45 C.F.R. §§160.202 and 160.203(b).

Health care providers

Federal Confidentiality Law: HIPAA

HIPAA applies to physicians and other individual and institutional health care providers (e.g., dentists, psychologists, hospitals, clinics, pharmacies, etc.). It limits the circumstances under which these providers can disclose “protected health information” or “PHI.” PHI is essentially any individually identifiable health information that relates to a patient’s physical or mental health condition or treatment. PHI does not include health information contained in student records that are subject to FERPA. 45 C.F.R. §160.103.

HIPAA permits providers to disclose PHI with the patient’s written consent, provided that the Rule’s particular content and other requirements are met. When the patient is a minor, ordinarily the parent, guardian, or custodian is authorized to give written consent to disclosure of the child’s health information. However, there are certain situations where only the minor can consent to the disclosure of health information. See Authorized Representatives and Special Considerations for Minor Patients, below and Appendix C and Appendix D.

Disclosures of PHI without the patient’s written consent are allowed under certain circumstances, most importantly:

  • To prevent or lessen a serious and imminent threat to the health or safety of a person or to the public, if the disclosure is made to a person or entity able to prevent or lessen the threat;
  • To report suspected victims of abuse to appropriate agencies;
  • In response to a court or administrative order; and
  • In response to a subpoena or other lawful process in a judicial or administrative proceeding if appropriate steps are taken to notify the individual or obtain a protective order with respect to the information.

                45 C.F.R. §§164. 502(a), 506, and 512. 

State Confidentiality Laws

Massachusetts laws applicable to institutional health care providers (hospitals and clinics) are, in general, not as stringent as HIPAA. G.L. c. 111, §70. Those that apply to hospitals and clinics operated by the Department of Mental Health (DMH), however, permit disclosure of a patient’s health information without a patient’s written consent only in very limited circumstances, including: at DMH’s request, pursuant to a court order, or where the disclosure is determined to be in the patient’s best interests and it is not possible or practicable to obtain the patient’s written consent. G.L. c. 123, §36; 104 CMR 27.17.

There is no state confidentiality law that applies to physicians. However, Massachusetts courts have recognized a duty of confidentiality that all doctors in the Commonwealth owe to their patients.  Physicians generally must not disclose a patient’s health information without the patient’s written consent, subject to limited exceptions (such as to meet a serious danger to the patient or to others or pursuant to a court order).  Alberts v. Devine, 395 Mass. 59, 68 (1985).

Heightened duty of confidentiality

Mental Health Treatment Information: Confidentiality Rules

Information obtained by mental health providers (e.g., psychologists, psychiatrists, social workers, mental health counselors and other mental health professionals) in connection with providing professional services to a patient is subject to a higher standard of confidentiality than is other types of health information.

These laws tend to fall into two categories – confidentiality laws, which impose an affirmative duty on the provider to maintain the confidentiality of protected information, and privilege laws, which establish an evidentiary privilege for such information that may be exercised by the patient.

Most confidentiality laws apply to information acquired by a mental health provider in connection with counseling or otherwise providing services to a patient. This includes the type of services provided, the dates and/or frequency of services, the results of clinical tests, and the patient’s symptoms, diagnosis, and treatment plan, as well as confidential communications between the patient and the provider. Mental health providers are permitted to disclose such information with the patient’s written consent and in limited other circumstances, including consulting with another provider about the patient’s treatment or pursuant to a court order.

Additionally, most confidentiality laws contain a so-called “safety” or similar exception, which allows (and in some instances, requires) a mental health provider to disclose confidential information to protect the patient or another person from serious harm. This includes disclosures made to seek the involuntary hospitalization of a patient or to otherwise prevent the patient from causing serious injury or death to himself or to another person, and mandated reports of suspected abuse or neglect of a child, elderly or disabled person. G.L. c. 112, §§129A, 135A, 172, Commonwealth v. Vega, 449 Mass. 227 (2007), 251 CMR 1.11, 258 CMR 22.00, and 262 CMR 8.02.

Mental Health Treatment Information: Evidentiary Privileges

Mental health privilege laws, on the other hand, apply in more limited circumstances and to a narrower scope of information. Specifically, most privilege laws apply to court and administrative proceedings in which confidential communications between a patient and a mental health provider may be introduced as evidence. Under these circumstances, the patient has the privilege of refusing to disclose, and of preventing the provider from disclosing, any such communication, subject to limited exceptions.

Under most mental health privilege laws, the patient’s privilege does not apply to communications made during a court-ordered examination (if the patient was warned that the communication was not privileged) or to cases where the patient has introduced his mental condition as an element of a claim or defense. In addition, most privilege laws permit a judge in child custody cases (including Care and Protection, CRA, guardianship cases, and termination of parental rights cases) to order the disclosure of communications between a provider and a patient (other than the child) if the judge determines that the information bears significantly on the patient’s ability to provide suitable care and custody and it is more important to the welfare of the child to permit the disclosure than it is to protect the patient-provider relationship. In termination of parental rights cases the patient must also have been warned that the communication is not privileged. G.L. c. 112, §§135B, 172, 172A; G.L. c. 233, §20B; Commonwealth v. Vega, 449 Mass. 227 (2007). 

In the context of a legal proceeding in which a minor has the privilege to prevent the disclosure of confidential mental health information, the minor’s parent or guardian generally has the right to decide whether to exercise or waive such privilege. However, in cases involving child custody (e.g., Care and Protection, termination of parental rights, guardianship of minor, and CRA cases), where the child and parent or guardian may have conflicting interests, a parent or guardian may not waive the child’s privilege. Instead, the court may appoint a guardian ad litem to decide whether the privilege should be waived. See Adoption of Diane, 400 Mass. 196 at 201–02. Legal authority for this practice is found in the statutes governing the psychotherapist and social worker privileges. See G.L. c. 112, §135B; G.L. c. 233, §20B. They provide that if the client is not competent to exercise or waive the privilege a guardian shall be appointed to act in the client’s behalf. See G.L. c. 233, §20B. Any party may file a motion for appointment of a guardian ad litem.

Substance Use Disorder Treatment Information

Providers that treat substance use disorders are also subject to a “heightened” duty of confidentiality under both federal and state law. 42 C.F.R. Part 2). See also 42 U.S.C. 290dd-2 and G.L. c. 111B, §11. Federal law limits the circumstances under which a provider in a federally assisted program can disclose information obtained in connection with treating a patient with a substance use disorder (or providing a diagnosis or referral for such treatment) if the information identifies, or could be used to identify, the patient as having a substance use disorder. Providers may disclose such information with the patient’s written consent, which must meet the detailed requirements of federal law. 42 C.F.R. §2.31 details the elements that must be in a release. See Appendix D: 42 CFR Part 2. Providers may disclose information without a patient’s consent, in certain limited circumstances, such as pursuant to a court order, 42 C.F.R. §2.61, in a medical emergency, 42 C.F.R. §2.51, or to report incidents of child abuse and neglect. 42 C.F.R. §2.12(c)(6). Those who receive information from a substance use disorder treatment program are prohibited from re-disclosing that information. 42 C.F.R. §2.32.

A minor's parent or guardian may never consent to the disclosure of the minor's substance use disorder treatment information. A covered substance use disorder treatment provider must obtain the minor's consent to disclose such information to the parent or guardian or to a third party. 42 C.F.R. §2.14, see also Authorized Representatives and Special Considerations Regarding Consent for Minor Patients, below. Disclosure is subject to 42 C.F.R. §§2.61, 2.63 and 2.67.

Other information subject to “heightened” protections

Other Information Subject to “Heightened” Protections: Genetic information, HIV and Venereal Test results.

Other types of health information subject to heightened restrictions under state law include genetic information and reports (G.L. c. 111, §70G), the fact and results of an HIV test (G.L. c. 111, §70F) and records pertaining to venereal disease (G.L. c. 111, §119). Providers subject to these laws are generally prohibited from disclosing such information without the patient’s “informed” written consent. A written consent is considered “informed” under these circumstances if it relates solely to the disclosure of the “extra sensitive” information (for example, an informed written consent to disclose genetic information cannot also authorize the disclosure of a patient’s entire medical history).

Authorized representatives and special considerations regarding consent for minor patients

Under HIPAA, a patient’s authorized representative is anyone who is authorized under state law to act on the patient’s behalf in making health care related decisions. See 45 C.F.R. §164.502(g)(1). Where the patient is a minor, the minor’s parent, guardian, custodian or someone designated under a caregiver authorization affidavit (hereafter, “parent or guardian”) would typically be considered the minor’s authorized representative. (See Appendix E for a sample Caregiver Authorization Affidavit.) Accordingly, a minor’s parent or guardian can generally obtain, or consent to the disclosure of, the minor’s protected health information without the minor’s knowledge or consent. There are exceptions to this general rule. As discussed above, a minor’s parent or guardian is never treated as the minor’s authorized representative with respect to the minor’s substance use disorder treatment information. A covered substance use disorder treatment provider must obtain the minor’s consent to disclose such information to the parent or guardian or to a third party. 42 C.F.R. §2.14.  

HIPAA uses the term “personal representative” to refer to what is commonly referred to as an authorized representative.

In addition, if under state law a minor can consent to their own medical treatment, then the minor alone has the right to consent to release of information concerning that treatment. 45 C.F.R. §164.502(g)(3). Under Massachusetts law, a minor can consent to their own medical treatment and therefore holds the authority to consent to release of information regarding medical treatment under the following circumstances:

  • Treatment for substance use disorder. A child 12 or older may consent to treatment for substance use disorder (other than methadone maintenance therapy).  See G.L.  c.112, §12E; 110 CMR 11.08(1). 
  • Inpatient mental health treatment. Youths 16 or older may commit themselves to a mental health facility. See G.L. c. 123, §10; 104 CMR 27.06(1); 110 CMR 11.16(2). 
  • Diseases dangerous to the public health and sexually transmitted diseases. Children who believe they have contracted a dangerous, contagious disease, may consent to their own treatment. See G.L. c. 112, §12F; 110 CMR 11.09. Similarly, a child may consent to treatment for sexually transmitted diseases. See 110 CMR 11.10.
  • Pregnant teens. A minor who is pregnant or believes she is pregnant may consent to her own medical and dental treatment, except abortion which can be obtained with judicial approval. See G.L. c. 112, §12F; 110 CMR 11.06. This provision is not limited to pregnancy-related treatment but covers all medical and dental treatment during pregnancy.
  • Parenting teens. Minor parents may consent to their own medical and dental treatment. See G.L. c. 112, §12F.  Minor parents may also consent to medical and dental treatment for their children. See G.L. c. 112, §12F.

Under each of these circumstances, the minor’s parent or guardian is not treated as the minor’s authorized representative. Accordingly, the parent or guardian cannot authorize the disclosure of information related to the service on the minor’s behalf. See 45 C.F.R. §164.502(g)(3)(i). Instead, the provider must obtain the minor’s consent to disclose information to a third party.

When can a health care provider disclose information to DCF?

When can a health care provider disclose information to DYS?

When can a health care provider disclose information to school personnel?

When can a health care provider disclose information to the court or probation? 

When can a health care provider disclose information to attorneys for parents or children?

  • General providers: 
    • With the written consent of the parent, guardian, custodian or other authorized representative (except where the minor has the right to consent). 45 C.F.R. §164.508.
    • When the patient is an adult, with their written consent. 45 C.F.R. §164.508.
    • Pursuant to a subpoena or other lawful discovery request, with prior notice to the patient or the entry of a qualified protective order. 45 C.F.R. §164.512(e).
    • Pursuant to a valid court or administrative order. 45 C.F.R. §164.512(e).
  • Mental health providers: 
  • Substance use disorder treatment providers: 

When can a health care provider disclose information to court investigators?

When can a health care provider disclose information to police or prosecutors?

  • General providers: 
    • With the written consent of the patient or the parent, guardian, custodian or other authorized representative (except where the minor has the right to consent). 45 C.F.R. §164.508.
    • When the patient is an adult, with the adult patient's written consent. 45 C.F.R. §164.508.
    • Pursuant to a subpoena or other lawful discovery request, with prior notice to the patient or the entry of a qualified protective order. 45 C.F.R. §164.512(e).
    • Pursuant to a valid court or administrative order. 45 C.F.R. §164.512(e).
  • Mental health providers: 
    • With the written consent of the patient or the parent, guardian, custodian or other authorized representative (except where the minor has the right to consent). G.L. c. 112, §§129A(1), 135A(b).
    • When the patient is an adult, with the adult patient's written consent. G.L. c. 112, §§129A(1), 135A(b).
    • Pursuant to a valid court or administrative order. 42 U.S.C. §290(d)(d)-2.
    • To police when the patient has made an explicit threat to kill or inflict serious bodily injury on an identifiable person and the patient has the intent and means to carry out the threat. G.L.  c. 112,             
  • Substance use disorder treatment providers: 

Help Us Improve Mass.gov  with your feedback

Please do not include personal or contact information.
Feedback