The Health Insurance Portability and Accountability Act (HIPAA) of 1996 safeguards the privacy of PHI in a patient’s medical record. The Privacy Rule offers additional protections for mental health cases. Psychotherapy notes are considered to be personal notes of reflection by the therapist and are not used for treatment, payment or healthcare operations. Therefore, these notes remain separate from the medical record and cannot be disclosed unless there is consent by the patient or unless the therapist feels there is imminent harm.

Therapists can, however, release these notes to parents if an adolescent does not object (U.S. Department of Health and Human Services Office for Civil Rights, n.d.). If state laws have stricter privacy protections than the Privacy Rule, then state laws take precedence.

The Family Education Rights and Privacy Act (FERPA) of 1974 protects the privacy of personal health information that is contained in a student’s educational record. The law covers any “educational agencies or institutions” that act on behalf of the educational agency. FERPA does not allow the release of mental health records to other healthcare providers except when the minor is in imminent harm (Pacific Southwest Mental Health Technology Transfer Network, n.d.).

According to the California School-Based Health Alliance (2021), the information that minors ages 12 and over disclose to a school counselor as part of a counseling session is not considered part of the educational record and can be disclosed only if the student agrees to it or if there is threat of imminent harm. Likewise, schools cannot mandate that students receive permission before receiving mental health counseling services.

If the counseling session is part of the educational record, then parents do have a right to review the information upon request.

The 21st Century Cures Act is a crucial law that addresses issues related to access and confidentiality within the electronic health record (EHR), especially with regards to mental health. The law strikes a balance between transparency and patient autonomy.

The HIPAA Privacy Rule protections that govern PHI protection also apply here. Psychotherapy notes that do not result in billing or communications are exempt from the medical record .

According to the Academy of Child and Adolescent Psychiatry, where the law differs is in its mandate that adolescents in treatment receive access to their own medical records.

Since parents are allowed to review the minor’s medical record, AACP advises mental health providers to leave therapist notes out of the medical record to maintain the confidentiality of the minor’s treatment session (AACP Health Information Technology Committee, 2021).

California’s Confidentiality of Medical Information Act (CMIA) is a more stringent privacy law than HIPAA, specifying who can release confidential medical information and under what circumstances for California residents. It requires explicit consent from the patient before a health care provider, health plan or contractor can disclose PHI to a requestor (Consumer Federation of California, n.d.).

In 2022, Assembly Bill 2089 expanded the protections of CMIA to include medical mental health information that is collected through mobile health apps and on websites (Blank Rome, LLP, 2022). Essentially, any business that offers mental health digital services is now subject to the provisions in this law.

California Senate Bill 326 (SB 326), also known as the Behavioral Health Services Act, was approved by Governor Newsom in 2023 and passed by voters in March 2024. SB 326 replaces the Mental Health Services Act of 2004.

This bill introduces targeted funding for youth and young adults most at risk for mental health conditions. It also aims to promote equitable access to mental health resources. SB 326 also advocates for early interventions and prioritizes care for those with serious mental illnesses (Davalos & Ramos-Yamamoto, 2024).