HIPAA & “TO WHOM IT MAY CONCERN”

Posted by DKelley on Aug. 20, 2024

CASE: Mother of minor request doctor to write a letter detailing psych symptoms, medications, diagnosis., test results, etc. Psychiatrist writes a letter starting with “ To Whom It May Concern…” letter . Mother of minor, age 15, provides authorization.

HIPAA violation?

1. Yes, HIPAA violation
2. No, Not a HIPAA violation
3. Yes, a HIPAA violation because the 15 year old patient did not authorize the release of PHI.
4. Depends on the receiving person or organization

Answer:  Yes, HIPAA violation

Why:  All disclosures must have the name of the entity receiving the protected health information (PHI). Never provide PHI to an entity stating ….”To Whom It May Concern.”

HIPAA's 45 CFR § 164.508 sets forth the requirements for a Protected Health Information (PHI) disclosure letter, ensuring that the process of sharing sensitive health information is conducted in a secure and compliant manner. The letter should clearly identify the recipient  of  PHI.

PHI is protected health information.  This means any  "individually identifiable health information.” Examples of PHI include symptoms, diagnosis, medication, placed on an involuntary hold or not, tests, treatment plan, combined with name, age, birthdate, and health insurance membership numbers. etc.

Parents are the personal representatives of minors, according to HIPAA.  Therefore, parents hold the right to provide authorization for the release of protected health information.  Furthermore, the United Supreme Court has consistently ruled that parents have a fundamental right to direct the care, custody, and control of their children. Yes, parents can provide authorization to release PHI.

When a mental health professional submits a letter, the following components must be included to meet HIPAA compliance:

1. Purpose of Disclosure
2. Description of Information
3. Recipient Information
4. Patient Authorization
5. Purpose of the Disclosure –

The letter must clearly articulate the reason for the disclosure of the protected health information (PHI), thus providing transparency to the patient about the reason the information is being shared.

1. Description of Information

The letter must briefly informed the patient the specific PHI that is disclosed, outlining the type of information (ie tests, labs, prognosis) and the relevant dates of service covered by the disclosure as requested in the Release of Medical Information.

2. Recipient Information

The letter must identify the Recipient of the PHI, identifying the authorized individual receiving the information.

3. Patient Authorization

If the disclosure requires the patient’s authorization, the letter should contain a statement confirming that patient provided consent for release of medical information.