The information contained in this post is based on my personal experience since August 2017 and discussions with the VA, VA Privacy Officers, VA Patient Advocate, Health and Human Services (HHS) and CS employees from the CSC to the regional director.
First, let’s define medical record, mental health record and psychotherapy notes.
- Medical Record. A record of a patient’s medical information (as medical history, care or treatments received, test results, diagnoses, and medications taken).
- Mental Health Record. A record of a patient’s mental health information (as mental health history, care or treatments received, test results, diagnoses, and medications taken). It does not contain the psychotherapy notes.
- Psychotherapy Notes. The Privacy Rule defines psychotherapy notes as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record. Psychotherapy notes are treated differently from other mental health information both because they contain particularly sensitive information and because they are the personal notes of the therapist that typically are not required or useful for treatment, payment, or health care operations purposes, other than by the mental health professional who created the notes. Therefore, with few exceptions, the Privacy Rule requires a covered entity to obtain a patient’s authorization prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes.
The VA currently has integrated a Veteran’s medical record, mental health record and psychotherapy notes into one (1) integrated electronic medical record. Veterans are not informed.
A Veteran’s integrated electronic medical record is classified ‘open’. The open classification allows all VA employees nationwide, Department of Defense (DoD) and other entities access. The access is unmonitored, untracked, unprotected and doesn’t require them to have a medical need to know, a password/pin or a written authorization from you to access. It also doesn’t meet certain requirements of HHS such as minimum necessary. Veterans are not informed.
The VA automatically marks every VA employees integrated electronic medical record as ‘sensitive’. The sensitive marking only allows VA to track who accessed the integrated electronic medical record. Veterans are not informed or informed they can have the ‘sensitive’ mark put on their integrated electronic medical record by submitting a written request to their local VA medical center (VAMC) Privacy Officer. Once a Veterans integrated electronic medical record is marked sensitive, the Veteran can provide a written request for a Sensitive Patient Access Report (SPAR) to their local VAMC Privacy Officer to see who has accessed their integrated electronic medical record. The SPAR can only show the accesses from the date the integrated electronic medical record was marked sensitive. A Veteran can submit a SPAR request at any time once it’s marked sensitive.
VA employees are accessing Veterans psychotherapy notes without obtaining a written authorization.
I have received several confirmed violations against the VA and my VAMC from HHS regarding these matters. HHS stated they handed this informally through technical assistance. (I don’t know what this means nor did HHS state what VA is going to do to fix it.) My MyHealtheVet account is still showing I have an integrated electronic medical record.
In a later post, I will discuss my personal experiences and the issues I’ve had with my VAMC.