APA's guidelines help psychologists steer through the sometimes murky waters of how best to document and protect patient information.
By Dr. Cynthia Sturm
February 2012, Vol 43, No. 2
Print version: page 70
Sturm, C. (2012, February 1). Record keeping for practitioners. Monitor on Psychology, 43(2). https://www.apa.org/monitor/2012/02/ce-corner
"CE Corner" is a quarterly continuing education article offered by the APA Office of CE in Psychology. This feature will provide you with updates on critical developments in psychology, drawn from peer-reviewed literature and written by leading psychology experts. "CE Corner" appears in the February, April, July/August and November issues of the Monitor.
To earn CE credit, after you read this article, purchase the online test. Upon successful completion of the test (a score of 75 percent or higher), you can print your CE certificate immediately. APA will immediately send you a "Documentation of CE" certificate. The test fee is $25 for members; $35 for nonmembers. The APA Office of CE in Psychology retains responsibility for the program. For more information, call (800) 374-2721, ext. 5991.
CE credits: 1
Exam items: 10
Learning objectives:
Have your record-keeping practices changed along with advances in technology? Do you exchange protected health information via fax, email, or text messaging? Are you collaborating with other professionals from different disciplines?
If you answered yes to any of these questions, it may be time to seek advice from APA's Record Keeping Guidelines.
A clear, well-organized record-keeping system is essential for psychologists who provide treatment, psychotherapy, assessment and consultation services. But setting up such systems can be challenging. For one, psychologists need to strike the fine balance between the need to maintain client privacy and confidentiality and the need to communicate with insurers, other treating professionals and larger health systems. Psychologists' records must also adhere to state and federal laws. In addition, psychologists must plan for retirement and the eventual disposal of their records.
APA revised its Record Keeping Guidelines in 2007 in response to evolving technologies, the advent of electronic health records, the impact of the Health Insurance Portability and Accountability Act and the complexities of record keeping in various organizational settings. As APA practice guidelines, the guidelines are aspirational and complement the mandatory APA Ethical Standards (APA, 2010) that relate to documentation. The APA guidelines are designed to "educate psychologists and provide a framework for making decisions regarding professional record keeping."
There are 13 guidelines in all, each followed by a rationale and examples that illustrate how the guideline may be applied in practice. The guidelines appear online. This article offers an overview of the guidelines and the key points psychologists should consider as they develop their own record-keeping systems.
Practicing psychologists can tailor their record-keeping practices to their setting, type of practice and the characteristics of their treatment or assessment population. Psychological records document the nature, delivery, progress and outcomes of services. Records facilitate the coordination of care, as well as the process of transition to other levels of care, and referral or termination. Accurate records can support the clinician in resolving disputes on such issues as the quality of the services provided, fee agreements or treatment progress. Others who handle records—such as the psychologist's employees—should be trained to handle confidential client information with the same level of care.
The organizational structure and content of records may be influenced by a variety of factors. Recognizing that psychologists work in diverse settings, APA's Record Keeping Guidelines list basic components of the psychological record—general file information, documentation of service and specific information related to the individual characteristics of the treatment. Various factors may influence the amount of detail kept in records. These can include the client's wishes for more limited records; the service context or setting; legal and regulatory mandates; and contractual requirements of third-party payers.
APA's Record Keeping Guidelines delineate three types of content:
Psychotherapy notes, which may include more detailed or sensitive client information, must be kept separately from the general record in order to be afforded heightened protection under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. For example, health insurers cannot obtain them without a completely voluntary patient authorization. The extent to which psychotherapy notes are protected from patient requests for access varies because state laws that give patients greater access to their records can preempt the Privacy Rule provision providing no access to psychotherapy notes. APA's Legal and Regulatory department provides guidance and current updates on HIPAA-related issues.
Protecting clients' privacy and ensuring their trust is a key principle of documentation. Whether or not a practitioner can release client information requires the psychologist to be aware of several legal and regulatory requirements, including mandated reporting requirements. The Record Keeping Guidelines encourage psychologists to be familiar with ethical standards regarding confidentiality, specifically APA Ethics Code 4.01 and 6.02, and relevant legal, regulatory and statutory requirements. Psychologists also need to follow any applicable institutional policies. Special attention is warranted in decisions related to the access or disclosure of records of minor children, especially in situations of divorce where information may be used in adversarial proceedings such as custody conflicts.
The guidelines consider disclosure of "the nature and extent of record keeping procedures" part of the broader process of informed consent to psychological services (Ethics Code 3.10); Ethics Code 3.10d specifically requires documentation of informed consent. Psychologists are ethically mandated to discuss the "relevant limitations of confidentiality" and the "foreseeable uses of the information" (APA Ethics Code 4.02) at the outset of services. This discussion helps clients understand that their information may be shared with others and that there are potential limits to confidentiality, such as in a litigation context or mandated treatment.
APA's record-keeping guidelines also recognize the importance of multidisciplinary collaboration in providing patient care. Accurate records facilitate adjunctive treatment, such as medication management, coordinated care for chronic illness or family therapy intervention. Should an unforeseen illness befall the psychologist, an up-to-date record facilitates the successful transfer of care. Records may also be requested by the client, or his or her attorney, for other uses, such as divorce or other legal proceedings, applications for disability or life insurance, or requirements for certain types of employment.
Practitioners need to have a security plan that provides adequate protection for either paper or electronic records from loss or damage, and ensures only appropriate access by trained professionals or others with a legitimate need to see them. With expanding wireless and computer technologies, client data may be kept in various electronic formats, such as emails, text messages and online scheduling calendars. Practitioners should be particularly cautious when exchanging protected health information via fax, email, text messaging and electronic claims submission.
Many psychologists store patients' electronic records on their office computers, laptops and tablets. However, psychologists must be vigilant in preventing unauthorized access to the data and protecting the actual equipment from theft. Data breaches reported under the HIPAA Breach Notification are frequently the result of theft, particularly of laptops and other portable electronic devices (retrieved 9/30/11). Psychologists should store backup media as carefully as they do their original electronic files.
Perhaps the most welcomed change in the guidelines' revision is a shorter requirement to keep records. The guidelines state: "In the absence of a superseding requirement, psychologists may consider retaining full records until seven years after the last date of service delivery for adults or until three years after a minor reaches the age of majority, whichever is later."
As previously mentioned, psychologists must also consider any applicable state laws and other regulatory or institutional requirements in determining specific records retention policies. This guideline may be useful as psychologists prepare for retirement and plan for how records will be stored and later disposed of.
The original rationale for disposing of records was to prevent "obsolete" clinical data from being misused in other contexts. Today, with electronic health records and the ability to store data in larger electronic systems, clinical information can be kept indefinitely. The Record Keeping Guidelines suggest that psychologists document the context in which the record is created, such as the reason for referral or evaluation, and specific circumstances impacting the client at the time of service. Professionals who review records at a later date also have the responsibility to recognize when clinical documents or testing results are obsolete or unduly prejudicial to current decision-making. In most cases, this is of greatest concern when the record creates a negative impression of the client.
The advent of electronic health records has radically altered the documentation landscape. At a minimum, electronic records are subject to similar concerns and requirements as paper records. Because of the rapid expansion of data technologies, the guidelines primarily offer general suggestions for managing information and electronic health records, such as using appropriate levels of encryption and passwords to protect digital information.
The 2005 HIPAA Security Rule provides specific guidance on managing electronic protected health information. It applies to practitioners who must comply with HIPAA and who store or transmit such information. The rule requires that psychologists take special care in maintaining electronic records, and that they conduct a documented risk analysis of specified issues, and select security measures that are reasonable and appropriate for those risks and for the practice. Practitioners who do not have in-house IT departments should maintain adequate technological competence and consider using IT consultants for more complex security questions.
The 2009 Health Information Technology for Economic and Clinical Health Act (HITECH) encourages psychologists to adopt integrated electronic health records by 2014. States are now actively engaged in defining these new processes under HITECH. The law's initial goal is to promote health professionals' adoption of electronic health records. The next stage of the law's implementation involves integrating medical records through interfacing with large, centralized data systems such as Health Information Exchanges or through systems of transactional, interoperable exchanges with other providers or organizations.
Psychologists are encouraged to actively participate in developing state-level policies regarding the implementation of HITECH. Psychologists are uniquely qualified to advocate for enhanced security measures in handling sensitive mental health information, and to provide thoughtful insights on consent policies for health information exchange that allow clients to make informed choices about the sharing of their mental health information.
In multidisciplinary settings—such as community health centers, the VA or hospitals—records may be created or accessed by many health-care providers. Health-care reform is focused on transforming delivery systems into collaborative or integrated care models, such as accountable-care organizations, that will share records through state or regional health information exchanges. As psychological services become integrated into larger systems of care, protecting the confidentiality of patients' psychological records will become more complex (Richardson, 2009). In many settings, record-keeping policies are already defined by applicable laws as well as institutional policy. Psychologists who work in these settings may not have full control over the record. However, they can advocate for record-keeping practices that meet psychological guidelines and also address the needs of other disciplines to coordinate care. For psychologists who work as independent consultants for organizations, it is important to clarify at the outset who owns and has access to psychological records.
Guideline 10 addresses conflicts between organizational requirements, professional guidelines, ethics and legal standards. It is important to note that the 2010 Amendment to the Language of the 2002 Ethics Code, effective June 1, 2010, occurred after the guidelines revision and publication of the 2010 article this article is based on anguage of the 2002 Ethics Code with Changes Marked can be found at the end of the online 2010 Ethics Code. Psychologists will find it useful to familiarize themselves with the amendments to Ethics Codes 1.02 and 1.03 when interpreting aspects of Record Keeping Guideline No. 1 Responsibility for Records and No. 10 Record Keeping in Organizational Settings.
Documentation for couples, families and groups is one of the most complex and challenging areas of record keeping. Experienced psychologists usually develop a philosophy of documentation for couple and family therapy that fits their theoretical orientation, treatment model and practice setting. Therapists treating families or couples may document clinical information specific to individual clients, as well as describing the therapeutic process and relational data. Some psychologists suggest it is important to record the interactional essence of such treatment modalities (Gottlieb et al., 2008). Risk management considerations, such as anticipation of individual requests for release of information, the potential needs of high-conflict families, and the potential for litigation, may encourage practitioners to consider maintaining separate records on each service recipient (Moline et al., 1998).
When treating multiple clients, it is important to inform each party at the outset of treatment how the record will be maintained, who will have access to the information and when the record could be disclosed to others (Ethics Code 10.02, 10.03). For example, couples should be informed that releasing any records may require written permission from both parties (Gottlieb et al., 2008). In family therapy, psychologists may identify one individual (such as a minor child) as the client, but the treatment or evaluation record may also contain information provided by or about parents, guardians or other family members. Collateral information should be identified as such and these contacts informed if they are not "clients," and therefore do not have the same rights regarding control over or access to the record. Group therapy records that summarize group themes, process patterns and general information about all group members may be preserved in individual files, as long as other members of the group are not identified (Moline et al., 1998).
Psychologists are ethically required to clarify financial arrangements and payment responsibilities at the beginning of treatment or service (Ethics Code 6.04). Giving clients a written policy at the outset of treatment facilitates client understanding of professional fees, their responsibility for payment, issues relevant to third-party billing and any limits to coverage. The fee agreement should be included in the treatment record to show that the psychologist provided this information to the client as a part of the informed consent process. Accurate and detailed billing records are an important aspect of risk management, considering that client dissatisfaction about payment and collection issues may precipitate an ethical complaint (Bennett et al., 2007).
Psychologists should also be sure they clarify who is responsible for payment when more than one client is being treated in a session, particularly since third-party payers may differ in their coverage for these types of services. Clients often assume their insurance will cover marital or group therapy, though these services are not consistently covered. It is wise for psychologists to remember that third-party payers can audit the psychologist's financial records for accuracy, and encourage their subscribers to review billing statements with a critical eye to potential fraud.
It is important for all psychology practitioners to establish a record disposition plan as part of their office policies, due to the potential for unanticipated circumstances to disrupt the continuity of treatment and access to records if the psychologist becomes unavailable. Professional transitions may include leaving an employment setting; closing a practice due to moving or retirement, or sudden illness, disability or death.
Psychologists may designate a records custodian who understands the unique ethical issues involved in maintaining, transferring and disposing of psychological records. The custodian will need to continue to protect client confidentiality and security, while at the same time providing appropriate records access to clients and their own designees for the full period of record retention. Some state licensing laws specify that clients must be notified how to contact psychologists after retirement for the purpose of obtaining records.
APA has provided a comprehensive checklist for closing a professional practice that includes suggestions about management of client records (APA, 2005). Various models of "professional wills" include instructions for designating professional executors who are available to respond to immediate client needs for transfer or referral, and assume other professional responsibilities involved in closing a practice (Halloway, 2003; Pope & Vasquez, 2005).
When planning for the eventual disposal or destruction of paper and electronic records, the psychologist must be sure that clients' confidentiality is protected. In the case of electronic records, psychologists may want to consult with technical experts to prevent the unwanted recovery of client data.
This article is based on the Professional Psychology: Research and Practice article "The American Psychological Association's Revised Record Keeping Guidelines: Implications for the Practitioner" by Drogin, E.Y., Connell, M., Foote, W.E. & Sturm, C.A. (2010).
The perspectives in this and the journal article do not represent those of APA's Board of Professional Affairs, Committee for the Advancement of Professional Practice and Standards or Ethics Committee.
Cynthia Sturm, PhD, is a clinical psychologist in independent practice in Portland, Ore., and a member of APA's Ethics Committee. In her practice, she treats adults and couples, and she teaches and consults in areas of ethics and professional issues. Sturm was involved in the Record Keeping Guidelines revision while serving on APA's Committee on Professional Practice and Standards (2002–04), and later served on the Board of Professional Affairs (2007–09).
