In a mental health practice, privacy is part of the care. Many patients don’t want anyone to know they are in therapy. Every person on the admin team protects that.
What counts as PHI
Protected health information is any information that identifies a patient and relates to their health, care or payment for care. In practice, almost everything you touch:
- Name, address, phone, email, date of birth, member ID
- The fact that someone is a patient of the practice
- Appointment dates, the clinician they see, diagnosis and CPT codes
- Balances, statements, EOBs and payment history
Psychotherapy notes have even stronger protection. Billing and front office staff should never need to read them.
Verify before you share
Before discussing any account, verify identity with at least two identifiers, for example full name plus date of birth, plus address or the last four digits of the member ID. If the caller can’t verify, you share nothing.
- Adult patients: family members need a signed release on file.
- Minors: parents or guardians usually have access, but state rules vary and some services (often including mental health for older minors) may be protected. Follow the practice’s policy.
- Insurance companies and other providers: share only what is needed for payment or treatment, through the right channel.
Minimum necessary
Use and share only what the task needs. Looking up a patient you aren’t working on, out of curiosity, is a violation even if you never tell anyone.
Safe habits every day
- Work only in the systems and channels the practice approves. No personal email, personal phone, WhatsApp or screenshots.
- Lock your screen when you step away. Work where others can’t see your screen or hear your calls.
- Voicemail: your name, the practice name and a callback number. Not the reason, the amount or the clinician’s name.
- Email: aggregate numbers are fine (“14 claims denied this week”). Anything with patient details goes through the secure channel.
- Double-check the recipient before sending any statement or document.
Spotting a risk early
Report it to your lead or the practice’s privacy officer the same day if:
- A document went to the wrong person
- Someone asks for information in an unusual or pushy way
- You see a login, device or file shared where it shouldn’t be
- A laptop or phone with access is lost or stolen
Reporting quickly is never the mistake. Hiding it is.