Confidentiality and Electronic Medical Records for ... - PsycNET

Clinical Practice in Pediatric Psychology 2013, Vol. 1, No. 1, 18 –27

© 2013 American Psychological Association 2169-4826/13/$12.00 DOI: 10.1037/cpp0000009

This document is copyrighted by the American Psychological Association or one of its allied publishers. This article is intended solely for the personal use of the individual user and is not to be disseminated broadly.

Confidentiality and Electronic Medical Records for Behavioral Health Records: The Experience of Pediatric Psychologists at Four Children’s Hospitals Beverly H. Smolyansky and Lori J. Stark

Jennifer Shroff Pendley

Cincinnati Children’s Hospital Medical Center, Cincinnati, Ohio

A. I. duPont Hospital for Children/Nemours Children’s Clinic, Wilmington, Delaware

Paul M. Robins

Karin Price

The Children’s Hospital of Philadelphia, Philadelphia, Pennsylvania

Texas Children’s Hospital, Houston, Texas

With the advent of electronic medical records (EMR), pediatric psychologists working in medical centers must address how confidentiality of behavioral health records will be defined and integrated into the larger EMR. Pediatric psychologists at four children’s hospitals share their decision-making and outcomes as their home institutions transitioned to an EMR. All four formed committees of relevant stakeholders and legal advisors to define the legal and ethical issues and all four had mechanisms to communicate provider concerns to and share committee opinions with providers. Two of the four required patients to give consent for behavioral health records to be integrated into the larger EMR, one integrated behavioral health records completely without required specific consent, and the fourth differentiated integration based on the type of service provided, with those focused primarily on physical health concerns fully integrated and those focused on behavioral health limited access to only behavioral health providers. The EMR at each institution allowed psychologists discretion to keep individual notes or portions of notes at a heightened level of confidentiality even when integrated. At all four institutions, medical colleagues valued having the behavioral health records fully integrated within the EMR, both the psychologists and their medical colleagues appreciate the improved communication with an integrated EMR (whether by consent or default), and the broader confidentiality protections of each institution has ensured that records are not accessed by those not involved in a patient’s care. Most important, families appear to appreciate the benefits of an integrated EMR. Keywords: electronic medical record, behavioral health record, confidentiality

Psychologists are obligated to maintain privacy and confidentiality of behavioral health records based on the Ethical Principles of Psy-

chologists and Code of Conduct (American Psychological Association, 2010). They are therefore required to take reasonable steps to

Beverly H. Smolyansky, Division of Behavioral Medicine and Clinical Psychology, Department of Pediatrics, Cincinnati Children’s Hospital Medical Center, Cincinnati, Ohio; Lori J. Stark, Division of Behavioral Medicine and Clinical Psychology, Department of Pediatrics, Cincinnati Children’s Hospital Medical Center and University of Cincinnati College of Medicine; Jennifer Shroff Pendley, Division of Pediatric Behavioral Health, Department of Pediatrics Nemours/Alfred I. duPont Hospital for Children, Jefferson Medical College, Wilmington, Delaware; Paul M. Robins, Department of

Child and Adolescent Psychiatry and Behavioral Sciences, Perelman School of Medicine at the University of Pennsylvania, The Children’s Hospital of Philadelphia, Philadelphia, Pennsylvania; Karin Price, Section of Psychology, Department of Pediatrics, Texas Children’s Hospital, Baylor College of Medicine, Houston, Texas. Correspondence concerning this article should be addressed to Lori J. Stark, PhD, Division of Behavioral Medicine and Clinical Psychology, MLC 3015, Cincinnati Children’s Hospital Medical Center, Cincinnati, OH 45229. E-mail: [email protected] 18


BEHAVIORAL HEALTH RECORDS AND EMR

secure patient data and share information only with persons directly involved in the care of a child. In the age of paper records, this was a relatively simple task. Typically, records were maintained by the individual psychologists in their private offices, or, if practicing within a larger hospital system, records were often kept separate from the general medical record by being kept in locked filing cabinets in the behavioral health division or department. Sharing information only happened with direct written consent from the patient or guardians. Privacy was easy, but in a larger hospital system where pediatric psychologists are involved in the care of medical patients, this privacy came at the cost of collaborative care and patient safety. For example, emergency room physicians would typically have no record that a child was in therapy. Pediatric psychologists based in multidisciplinary clinics had to complete redundant records, in the form of reports and letters to the team, in order to share information. With the advent of electronic medical records (EMRs), many subspecialties moved to their use, streamlining documentation and billing. However, the first electronic record systems were most often implemented in isolated pockets of different subspeciality practices. Thus, early electronic record systems were unable to communicate with one another and resulted in isolated islands of data within hospitals. In April of 2003, the Health Insurance Portability and Accountability Act (1996; HIPAA) went into effect. This law sets criteria for providers to protect medical information, increases access of patients to these records, and mandates education of patients about their rights. HIPAA did not replace state laws or the need for consent, but it did put regulations in place for behavioral health and other subspecialties to consistently protect confidentiality of medical records and patient data. HIPAA also attempted to define “psychotherapy notes” as notes “documenting or analyzing the contents of conversations during a private counseling session.” The definition expressly excludes medication prescriptions and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date (HIPAA, 2003 sec. 164.501). Psychotherapy

19

notes, by design were notes that were never meant to be read, would never be sent forward for billing purposes, and would require a separate release of information to access them; under HIPAA, they were required to be kept separate from the medical record. The rapid expansion of the use of electronic medical records in hospitals followed a clear timeline. In 2004, the federal government policy makers set a rather lofty, long-term goal that electronic medical records should be in place for all providers by 2014 (Hing & Hsiao, 2010). By 2007, it was estimated that 34.8% of physicians had instituted an electronic medical record system (Hing & Hsiao, 2010). In 2009, the federal government offered stimulus money to assist hospitals in the development and adoption of health information technology. Although many hospitals, such as Cincinnati Children’s Hospital Medical Center, had already decided to make the move to an electronic medical record, this money added an additional incentive to accelerate this move. With this acceleration of electronic medical records within hospital systems, pediatric psychologists have had to make important decisions that balance confidentiality and patient safety as well as state and federal laws about confidentiality. The purpose of this article is to highlight the path taken by pediatric psychologists in four children’s Hospitals (Cincinnati Children’s Medical Center, A. I. duPont Hospital for Children, Children’s Hospital of Philadelphia, and Texas Children’s Hospital), to understand and balance these issues as an EMR was introduced. Of note, because all four hospitals chose Epic as the EMR system, capabilities across all hospitals were the same. Cincinnati Children’s Hospital Medical Center (CCHMC) The Division of Behavioral Medicine and Clinical Psychology (BMCP) is a freestanding pediatric psychology service within CCHMC. The majority of practicing pediatric psychologists are housed within the division, with the major exception being psychologists housed within the Division of Developmental and Behavioral Pediatrics (DDBP). Psychology provides care on an outpatient referral model, embedded within medical teams (e.g., headache clinic with neurology, pain clinic with anesthe-


20

SMOLYANSKY, STARK, PENDLEY, ROBINS, AND PRICE

siology), an inpatient consultation liaison service, and an outpatient child clinical service through four CCHMC satellite locations. Epic was introduced at CCHMC in March 2007 and gradually implemented across three to five divisions a year. BMCP was rolled out in October 2009. Prior to Epic, BMCP had been using a locally developed electronic system that allowed psychologists within the division to access each other’s patient records electronically but that did not have electronic signature capabilities. Therefore, all notes were printed and stored in paper charts that were kept within the division. Thus, we were comfortable with keeping all behavioral health records separate from the main medical record. In anticipation of moving to an enterprisewide EMR in which records could be accessed by other professionals within the institution, CCHMC convened a mental health task force about a year prior to going live to begin discussions around sharing of behavioral health information. This group consisted of a representative from BMCP, psychiatry, DDBP, social work, health information management (HIM), legal counsel, the Chief Medical Information Officer, and an Epic representative. Topics discussed included (among other things) documentation of abuse, use of sensitive notes designations, releasing diagnoses on “After Visit Summary” forms, public viewing of diagnoses and chief complaints, and level of access needed for various staff positions. We also sought guidance from the Ohio State Board of Psychology about the ethics and legality of this integration. The Ohio State Board advised us that, under Ohio Administrative Code 4732–17– 01 (G)(1)(a), when rendering psychological services as part of a team or when interacting with other appropriate professionals concerning the welfare of a client, a psychologist may share confidential information about the client, provided that reasonable steps are taken to ensure that all persons receiving the information are informed about the confidential nature of the information being shared and agree to abide by the rules of confidentiality. As a result of these discussions and consultations, the division and the institution reached a consensus that (a) all of the medical record is to be considered confidential, and (b) hiding things within medical records can be dangerous for patient safety. CCHMC staff also felt that, as an institution, they have taken steps

to ensure medical staff members are trained in confidentiality and access of records, and had steps in place to regularly monitor access of records. Therefore, therapy progress notes created by psychologists within BMCP would be accessible to medical providers within CCHMC, including all outpatient and inpatient MDs, PhDs, nurses, and social workers. As a division, it was also determined that our psychologists do not keep “psychotherapy notes,” as defined by HIPAA. Once it was established that we were not using classically defined psychotherapy notes, integrating behavioral health records into the main medical record was deemed appropriate. A final issue to be resolved was how to handle psychological test protocols because of copyright issues, the need to keep test protocols from public access to preserve the integrity of the tests, and the sensitive nature of raw test data. We resolved this by determining that psychological test protocols and raw test data are not part of the official medical record. To keep the test protocols separate from the medical record, yet move to be totally electronic, we utilized Chartmaxx. Chartmaxx is a separate electronic storage system from Epic that can be linked to Epic for documents such as school records, custody records, and so forth. This is also the system used to electronically store old paper medical records, as they are gradually being eliminated by being scanned into Chartmaxx. Chartmaxx has the capability of linking or not linking a document to Epic based on document type. HIM scans all testing protocols into Chartmaxx in a file that is not linked to Epic. Psychologists within the hospital are the only professionals allowed to access this confidential section of Chartmaxx. Thus, we have been able to become completely electronic and preserve the integrity of psychological testing protocols. In the context of these discussions and determinations, it was also noted that there are times when allowing access to psychology notes is not clinically indicated. In the EMR there is an option of marking a specific note as “sensitive” in order to limit accessibility to particularly sensitive information shared within the context of the confidential relationship between psychologist and patient or guardian. Marking a psychology encounter as sensitive limits the access to that particular note to only psychologists within the division (no other medical per-



sonnel, trainees, or support personnel). Other hospital personnel would still be able to view that an appointment had taken place, current medication and diagnoses lists, and any therapy notes not marked as sensitive. Psychologists were trained to use the designation of “sensitive” only for notes that contain information that could place the trust inherent in the therapeutic relationship in jeopardy, or when knowledge of the content could adversely affect how others in the institution treat the patient. Use of the sensitive note was left to the clinical judgment of the treating psychologist, with the caveat that consideration should be given to the fact that the designation of “sensitive” would also limit access of potentially relevant clinical information to other medical providers within the institution and so should be used with care. After “go live,” BMCP also took a few extra steps to ensure appropriate access to records. We asked for a monthly report from HIM on who was accessing behavioral health records through Chartmaxx (linked to Epic). The clinical director reviews this report monthly and HIM investigates any inappropriate access. Inappropriate access has been very rare. One challenge to an integrated EMR for behavioral health records was preconceived ideas about the laws around confidentiality of individual psychologists and psychiatrists. Change is hard, and when that involved changes in how we interpret ethical and legal guidelines for confidentiality, it required listening to and addressing concerns of the clinicians. We had many clinical discussions and updated psychologists throughout the Epic build for the division. In the end, it came down to trust. At the time of the “go live,” many psychologists were not totally comfortable with the integration but trusted that the institutional and divisional leadership had considered the issues and were willing to “see how it goes.” Four years into Epic, the hesitations initially voiced about an integrated EMR are gone, the majority of the psychologists use the “sensitive note” designation only on rare occasions, as it was designed, and the psychologists, as well as our medical colleagues, see the benefits of an integrated EMR. Because psychology and psychiatry are separate divisions at CCHMC, an integrated EMR has increased communication and care coordination for patients we share, as psychologists now have access to notes includ-

21

ing inpatient psychiatry and medication management. For the psychologists imbedded in medical subspecialty clinics, using one EMR improved communication within those clinics and satisfaction with the coordination of care of complex medical patients by our medical colleagues. Patient feedback has been neutral to positive. Many parents are familiar with EMR at other physician offices and typically had no concerns with behavioral records in Epic. Many parents gave spontaneous positive feedback about the advantages of the psychologist having knowledge of visits to other doctors. Many parents shared how grateful they were to not have to repeat medication lists, and so forth. One issue we had to address was how to manage the notes if the patient was the child of an employee. In this case, we decided to give employees the option of having notes marked as sensitive. Some parents are thankful for this option; most have chosen not to have notes marked this way so that their child’s care can be coordinated across other clinics and physicians who also treat their child. Nemours Children’s Health System/A. I. duPont Hospital for Children (DHC) The Division of Behavioral Health is part of the Department of Pediatrics within DHC. The majority of psychologists are housed within behavioral health, with the exceptions of neuropsychologists housed in rehabilitation and psychologists who have shared appointments in other medical specialties, for example, cardiology. In addition, the Nemours Children’s Health System also includes psychologists located in children’s clinics in Florida. Similar to CCHMC, Nemours psychologists provide care on an outpatient referral model, an inpatient consultation liaison service, and in outpatient services embedded within Nemours primary care satellite clinics. Nemours Children’s Health System began converting to EMR for outpatient services on a division by division “go live” process in 2000. At this time, a number of issues were considered. Similar to CCHMC, the issues of confidentiality and privacy were of utmost importance, and a well-qualified team of professionals participated in ongoing discussions, evaluations, and decision making to ensure this pro-


22


cess was both effective and well informed. This group included psychologists and psychiatrists from Delaware and Florida, legal counsel, the Medical Director of Health Informatics, other Epic representatives, and HIM representatives who handle releases of information to external agencies. In order to make the transition to EMR as smooth as possible for providers and families, several topics were discussed. These included the legal issues relating to HIPPA in both Florida and Delaware; the definition of therapy and progress notes; families’ rights to determine who has access to their records; the assurance that families are clearly informed about the issues of privacy and confidentiality related to their medical records; the effective use of “sensitive notes” designations; the appropriateness of various providers viewing diagnoses, problem lists, and medications; and the ability to monitor unauthorized access of records. Initially, both physicians and behavioral health staff had access to behavioral health notes. Similar to CCHMC, we believed that physicians were trained in confidentiality and access of records, and additional parental consent for these providers to access behavioral health notes was not required. However, because Nemours provides services in both Delaware and Florida, the laws of both states relating to HIPPA regulations were examined, and the more conservative law (Florida) took precedence. Subsequently, the decision was made for all behavioral health notes to be accessible to behavioral health staff only. Moreover, the additional level of protection for outpatient notes only applied to services scheduled within the Division of Behavioral Health. Although this applied to the vast majority of outpatient visits, behavioral health notes were not protected when patients were seen by psychologists who scheduled through other services (e.g., General Pediatrics), as, similar to CCHMC, these notes were not considered “psychotherapy notes.” Similarly, in 2009, when our inpatient records transitioned to Epic, inpatient psychological consultation notes were not protected because these services were considered to occur outside the Division of Behavioral Health. Due to psychologists’ role as consultants to inpatient services, legal counsel felt that expectations of privacy and confidentiality differed from those of the

outpatient clinic within the Division of Behavioral Health. Initial patient feedback was quite varied; some patients expressed appreciation for privacy, whereas others expressed frustration that other medical providers did not have access to their records. Physicians, particularly our primary care physician colleagues, initially made weekly complaints regarding their limited access to behavioral health records, as they felt this impeded their ability to provide optimal patient care. Subsequently, we developed a parent consent form that allowed parents to choose whether the behavioral health portion of their electronic medical record was accessible to other Nemours providers. Although initially all behavioral health notes were deemed confidential until the family gave consent, the default eventually changed to all notes being accessible unless a family specifically denied consent. This system seemed to resolve both patient and physician frustration. However, even if notes are accessible to other medical providers, psychologists do have some discretion in sharing information. Specifically, psychologists can utilize a “sensitive note” function that is available through the Epic system. If a patient has allowed access to notes but reveals highly sensitive information during a session, the psychologist can mark the note for that session only as “sensitive.” Alternatively, if the session contained both sensitive information and information pertinent to patient’s medical care with other Nemours providers, the psychologist can document sensitive information in a separate progress note. For example, if a psychologist and patient with diabetes are working on adherence concerns, information regarding goals and progress can be noted in the progress note and viewed by the endocrinologist, if the patient has granted consent for access. However, if the patient or parents discussed a highly sensitive issue, a second progress note can be written for the same encounter and marked “sensitive.” Sensitive notes can be viewed only by that psychologist and others whom the psychologist has designated a proxy. All behavioral health clinicians are proxies for each other in order to allow coverage when needed. Like CCHMC, psychological testing protocols are not considered part of the medical record. However, unlike CCHMC, we keep these protocols in paper charts.



We have experienced several benefits related to going to an EMR. It has increased collaborative care across behavioral health and medical providers. With parental consent, other medical providers involved in the child’s care have access to all records, helping to ensure integrative and collaborative care. Families do not have to repeat their history as often, and other providers are aware of mental health issues that could affect medical treatment. The EMR system allows for much flexibility in how notes are viewed. Importantly, it is a family-centered approach, such that families have the decisionmaking power, along with their therapist, regarding the accessibility of their notes by other medical staff. Most families have allowed access to their notes. Furthermore, the flexibility of the “sensitive note” function allows for some discretion on the part of the provider. There were a few challenges to implementation and to management in the face of continued growth of our medical center. Once we implemented a process whereby families could consent to the sharing of their behavioral health records as an integrated part of the EMR, the vast majority of medical staff members appeared satisfied with this consenting process and complaints have greatly decreased. However, there remains a small minority who feel that all behavioral health records should be accessible regardless of the family’s wishes. We continue to have discussions about this with both physicians and families. As behavioral health notes become part of electronic medical records, it is important that clinicians write in a way appropriate for a medical chart. We have found this writing style may be a very different style than many psychologists have used in the past and should be addressed within psychology graduate training programs to prepare graduate students for this new reality. Because of the confidential designation for behavioral health visits (i.e., for families who have denied access to other providers), the Epic team encountered challenges regarding scheduling of outpatient appointments. A different scheduling code must be used for families that decline to share their behavioral health visits with other medical providers than visits for families who have granted access. Therefore, schedulers must know in advance how a visit should be scheduled within Epic. In addition, processes to inform families, gain signed consent, and

23

document these procedures had to be designed and implemented. Additionally, behavioral health clinicians must approve any release of information request that comes through HIM. One potential upcoming challenge concerns access for school nurses. Nemours has launched a new program that allows school nurses to have access to Epic, contingent on families’ consent. However, although families may want school nurses to have access to diabetes regimens or asthma medications, they may be uncomfortable with school nurses having access to behavioral health therapy notes. At this initial stage of development, behavioral health notes, but not diagnoses, cannot be viewed by the school nurses. We are certain this will continue to be a topic of discussion. The Children’s Hospital of Philadelphia (CHOP) The Department of Child and Adolescent Psychiatry and Behavioral Sciences (DCAPBS) is one of six departments within CHOP. It is the discipline-specific home for all licensed psychologists, child and adolescent psychiatrists, licensed clinical social workers, and licensed behavioral health practitioners within CHOP. With over 90 licensed mental health providers across two states, psychologists provide services within medical inpatient, medical outpatient, mental health outpatient, integrated pediatric primary care, and satellite subspecialty care settings. Departmental policies and procedures, including use of the electronic medical record for behavioral health documentation, apply to all CHOP licensed behavioral health providers, regardless of their physical location or department/division affiliation. That is, the Epic security profile is determined by role, not physical location within the hospital system. Similar to CCHMC, the EMR rollout at CHOP was a multiyear process. Divisions “go live” as their build is complete, on a rolling basis. DCAPBS, the home for all licensed psychologists, psychiatrists, and clinical social workers, went live in October 2012. DCAPBS has many psychologists embedded in other departments/divisions. As a result, psychologists in those departments/divisions (e.g., feeding psychologists) went live with their respective divisions, and issues relevant to protecting men-


24


tal health privacy in medical records was previously addressed for these psychologists. As the DCAPBS approached the Epic build, the Epic team benchmarked with other hospitals regionally and nationally to learn about implementation of mental health privacy. What we learned was significant heterogeneity of practice, continuous changes in practice, and hybrid practices. DCAPBS formed a committee of major stakeholders within the department to work closely with the Epic team and build the platform for the department. This committee and subcommittees worked on a regular and ongoing basis through the build and implementation process. The recommendations from this committee flowed through the chair of DCAPBS. The department chair also met with other department heads to help learn what they needed to know with respect to behavioral health records. For example, the emergency department had specific needs with respect to the behavioral health records of patients seen acutely. Emerging from this early phase process, it was determined that the following information would be accessible to all clinical users within the EMR system on a “need to know” basis: diagnosis, psychotropic medications, safety screening and safety plan information, and appointments with mental health providers. It was determined that certain diagnosis data, not relevant or of limited value to the general provider community, would not be listed in the diagnosis section of the record. A critical decision was the handling of behavioral health progress note data. If the principal reason for the visit was a behavioral health concern, then the progress note documenting psychotherapy is not viewable to providers outside of DCAPBS as the default setting. The note is viewable to all licensed behavioral health providers, including psychiatrists, psychologists, clinical social workers, psychiatric nurse practitioners, and licensed professional counselors. On the other hand, if the principal reason for the visit was a primary physical health concern, then the progress note documenting psychotherapy is viewable to all providers on a “need to know” basis as the default setting. For example, our pediatric psychologists typically work within interdisciplinary teams, and their notes are viewable. In either case, the writer/provider can forward the note to other providers using the “in-basket” Epic function. In addition, a provider can

change the default setting (e.g., “mental health sensitive” to nonsensitive) on a case-by-case basis. This two-tiered Epic confidentiality approach was deemed necessary due to essential differences between the outpatient mental health and the outpatient and inpatient behavioral health practices within our department. In addition, it safeguarded the very rare, but realistic, concerns when children of very high profile parents are treated within the department. It was essential in the build process that the pediatric psychology practice strongly advocate for the ability of all providers to view progress notes on a “need to know” basis. As our practice differs in many essential ways from our outpatient mental health colleagues, the need for greater transparency and across discipline integration was necessary and took a number of planning sessions to accomplish. Nonetheless, all providers use a standard set of templated progress notes. These templates were developed and approved by the Department Quality Improvement and Epic build committees, and are compliant with current Joint Commission on the Accreditation of Healthcare Organizations and billing requirements. All records completed by any licensed behavioral health clinician are identified in Epic as a mental health record for purposes of HIM release to third parties. Every behavioral health progress note is electronically bordered by an exclusive behavioral health banner (color coded), with embedded language specific to the release of the note to any third party. In addition, all requests for release of any part of a mental health record goes through HIM, and the attending mental health provider needs to authorize the release. These processes/procedures protect the release of protected behavioral health information. Although it is too early to obtain systematic feedback from patients and other providers, anecdotal data suggests that having an integrated electronic medical record has clearly facilitated the sharing of information between behavioral health providers. As we practice across multiple locations, obtaining and sharing patient charts from other locations has been extremely challenging up to this note. The integrated electronic record allows improved treatment planning across previous “siloed” behavioral health practices.



Moving forward, the hospital is forming a Specially Protected Information (SPI) committee, consisting of representatives of HIM, Epic, legal, risk management, patient safety and quality, and the hospital Chief Medical Officer. This committee will review policies and processes for all specially protected health information, such as that generated by adolescent pediatricians, and so forth, and better determine the sharing of “sensitive” information within the EMR. Texas Children’s Hospital (TCH) The large majority of practicing pediatric psychologists at TCH practice within the Psychology Service, which is academically affiliated with the Section of Psychology within the Department of Pediatrics at Baylor College of Medicine. There are also small pockets of psychologists housed within other medical subspecialty services (e.g., adolescent medicine, psychiatry, developmental pediatrics). Assessment and intervention services are provided through outpatient behavioral health clinics, inpatient and outpatient care as members of collaborative medical teams (e.g., oncology, endocrine, bariatric surgery), and through large pediatric practices that are a part of the TCH Integrated Delivery System. TCH recently had the opportunity to rethink how behavioral health records would be managed within our EMR as we moved from a more outdated EMR (Logician) to a more updated one (Epic). In our setting, Epic was conceived as a shared medical record for TCH main campus, associated pediatrician offices in the community, centralized multispecialty health centers, a community-based auxiliary hospital setting, and a women’s health pavilion. Unlike the other settings referenced above, Epic at TCH went “live” in a series of large waves that were based on location of care (e.g., emergency department, inpatient, pediatric associates, ambulatory), over an approximately twoyear period. In making decisions about how to manage confidentiality issues, we consulted with Epic experts, HIM leaders, the Texas State Board of Examiners of Psychologists, and a TCH compliance/security officer. In addition, we had the benefit of working with colleagues who had used Epic in other settings (CCHMC, DuPont) where behavioral health documents

25

were treated in different ways. Finally, we convened a task force with psychology representation from all divisions (psychology, psychiatry, developmental pediatrics, adolescent medicine) to design templates, bring information to the wider faculty, and vote on decisions to be brought to the institutional Epic development team. As part of the larger institution, a decision was made to use a “break the glass” approach for employee records and records of employee’s family members. Partially because of not wanting to overuse this system, it was decided to not use this as a possible mechanism for protecting confidential documents. As such, we were left to ponder the use of “sensitive notes and “sensitive encounters.” Briefly, a note can be marked as “sensitive” and still viewed by any person with provider-level security access to Epic, but the provider is warned that the note they are accessing is sensitive. A “sensitive encounter” can only be viewed by individuals listed on a proxy list. We decided that both mechanisms would be used, though in limited ways. In making this decision, a large number of issues were discussed. First and foremost were conceptual issues around what information in a shared EMR should remain confidential. We then discussed limitations of the Epic system from a programming perspective and made compromises as needed. For example, diagnoses, problems lists, and medications are never considered protected information. Throughout this process, we discussed how session notes, reports, phone calls, and letters to families should be treated. We decided as a default, every note created by a psychologist in our setting would be marked as sensitive. In part, this creates a barrier for release of medical records without the attending psychologist’s permission (i.e., HIM professionals receive a flag when opening a sensitive note, which creates pause before an automatic release happens). Psychologists in this setting also have the option of making an encounter sensitive. Our proxy list includes all psychologists in the organization (regardless of home department) and psychiatrists in the Department of Psychiatry. This allows for better coordination of care among these providers. Administrative, billing, Epic, and HIM staff are also added to the list on an as-needed basis. The main issue we have discovered with the use of a proxy list is one of


26


maintenance as adding and removing trainees every cycle has become somewhat cumbersome. Of note, providers have the option of having their encounters made sensitive, and factors impacting the decision to use this option have evolved over time. Many providers initially used the sensitive encounter for all of their encounters. However, similar to DHC, we began to receive feedback from referral sources— particularly those located in our related pediatrician offices—that they were unable to get the information they needed about their patients in order to make informed treatment decisions. When the psychologist sent an “in basket” message to the child’s pediatrician, the messages were frequently buried. When we faxed our reports to the pediatrician’s office, they often were scanned into the EMR and therefore no longer protected as confidential. To solve this dilemma, we met with representatives of the pediatrics practices, who shared that they would like to see reports from diagnostic interviews and also receive information regarding treatment attendance and progress. These representatives expressed frustration that when an encounter was made sensitive, any record of that appointment having occurred disappeared (i.e., the appointment disappears from the schedule), whereas no-show and canceled appointments remained viewable. The effects of sensitive notes left referring pediatricians without any sense of whether a family was following through with treatment recommendations. The agreed-upon solution was that diagnostic interview encounters would not be made sensitive, and that although therapy notes would remain sensitive, providers would write brief treatment summaries at the end of treatment that would not be sensitive and therefore would be accessible to other providers. This involved a change in language on our consent form, as well as a change in procedure for verbally reviewing the release of information with parents and guardians. Our current practice is to keep all diagnostic and testing reports accessible unless the parents or guardians specifically object when this is reviewed during the initial appointment. Parents seem to be very satisfied with this approach, and the number of families requesting that their child’s records remain confidential from other medical professionals involved in their child’s care has been close to none.

Similar to the other hospitals, our biggest barrier to implementing these changes was our own providers’ initial discomfort with having notes more accessible in the EMR. As indicated, we used consensus building, education, and changes to our consent process to increase individual providers’ comfort level with the decisions that were made. Finally, giving families and psychologists some autonomy in deciding what portions of the behavioral health record should be kept confidential from other providers in the medical setting has been helpful, and no issues related to this have arisen thus far. Discussion EMR is the environment in which pediatric psychologists in medical settings will be providing and documenting care. It is our hope that by sharing the process and decision making of four institutions, our experiences will assist other pediatric psychologist as their settings “go live” with an EMR or continue to manage the ongoing concerns and issues that arise around confidentiality of behavioral health records. It is clear from the four descriptions that each institution approached the issues of confidentiality quite comprehensively. Each institution convened teams that consisted of behavioral health providers and legal experts. They also reviewed state and federal laws surrounding confidentiality. As is the case for all health care providers, pediatric psychologists must follow the most conservative laws around confidentiality. The impact of this was most clearly seen in how Nemours had to modify the integration of the behavioral health record because of the more strict law in Florida compared with Delaware. However, this difference in state laws is also reflected in the differences between CCHMC and the other institutions. Ohio law allowed CCHMC to set the default of having behavioral health records being fully integrated into the EMR. No matter how the legal aspects of confidentiality were resolved, it is also clear that the divisions or departments that housed pediatric psychologists (and other behavioral health providers) recognized the benefit of sharing the behavioral health record to integrated patient care and to patient safety. Despite this recognition, much work was done across the institutions to increase the comfort level of the pedi-



atric psychologists with having therapy notes part of an integrated EMR. Even at CCHMC, where integration was the default, psychologists could have overwritten this by marking every note as sensitive within Epic. For the other institutions, families would likely not consent if their psychologist did not present the option in a favorable light. To overcome reservations of the psychologists, each institution took care to listen to the concerns, to respond to them, and to allow for clinical discretion of when some progress notes should not be shared. It is also important to note that, under HIPAA, there are serious repercussions for viewing a medical record when the health professional is not involved in the care of the patient and tracking of unauthorized viewing is now possible with an EMR. In all four institutions, the ongoing experience of the psychologists with an integrated EMR has done the most to increase comfort with the system. Perhaps the important learning from the experience of the four institutions is the overwhelmingly positive response of our medical colleagues to the integration of the behavioral health record into the EMR, whether it was done by a consenting or default. Most of us went into pediatric psychology for the opportunity to work with our medical colleagues to improve the health of children. Finding ways to integrate our work into the EMR moves us closer to that goal by allowing our colleagues to learn, understand, and know specifically what we are doing and how the patient is responding to our treatments. EMR integration decreases the administrative burden of sharing this information. It is also notable that, across all four institutions, patients and their families see the advantages of integrating behavioral health records within the EMR, and even in the institutions requiring a consenting process, most families opt in. The psychologists also appreciate and find that being able to access the medical record for the patients and families referred results in better and more integrated care on our side as well. In closing, these learnings not only are important for pediatric psychologists already in the field but also have implications for how we train current and future graduate students. It will be important that graduate students

27

learn about the definitions of confidentiality beyond the American Psychological Association’s ethical guidelines, and understand the role of state and federal laws and how these differ and how to determine what takes precedent. As mentioned by Nemours, progress notes that will be integrated into an EMR may require a different style than when notes were kept within a behavioral health area only. As noted, CCHMC determined that none of the notes met the definition of psychotherapy notes and thus were not automatically subject to the stricter HIPAA protection clause. This is likely because, far in advance of an EMR, it was acknowledged that we should write every note from the perspective of the parent requesting and reading it. Therefore, our notes were already family friendly in documenting the treatment and how the child was responding, and did not include interpretation of behavior or actions. The purpose of an EMR is to allow fully integrated care to improve outcomes and protect patient safety. Clearly, the learnings from the four institutions support the benefits of working within the laws of confidentiality to share our behavioral health records. References American Psychological Association. (2010). Ethical principles of psychologists and code of conduct. Retrieved from http://www.apa.org/ethics/code/ index.aspx Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. § 1320d-9 (2010). Hing, E., & Hsiao, C. J. (2010). Electronic medical record use by office-based physicians and their practices: United States, 2007. National Health Statistics Reports, 23, 1–11. Ohio Administrative Code, chap. 4732–17, Rules of Professional Conduct, 4732–17– 01. General rules of professional conduct pursuant to section 4732.17 of the Revised Code. Retrieved from http://codes.ohio.gov/oac/4732–17 Summary of the HIPAA Privacy Rule. (2003). Retrieved from http://www.hhs.gov/ocr/privacy/ hipaa/understanding/summary/privacysummary .pdf Received December 29, 2012 Accepted January 2, 2013 䡲