News
Aesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data BreachAesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data Breach
Beginnerprovider

HIPAA and Mental Health: Extra Sensitivity

Mental health information is still PHI, and some parts get additional protections.

TL;DR

Treat mental health records with extra care. Psychotherapy notes and certain disclosures can have special rules. Ask your privacy officer before sharing.

Updated 2026-04-21

Patients rightly expect more sensitivity around mental health and substance use information. HIPAA still applies, and some categories have additional protections or state overlays.

Psychotherapy notes

These are not always handled like the rest of the chart. Do not assume they can be released with a routine records request. Escalate to your privacy officer.

Substance use disorder records (42 CFR Part 2)

Some programs face extra federal rules beyond HIPAA. If your organization treats SUD, specialized training is essential.

Conversation discipline

Use private rooms for intake and discharge. Never discuss diagnoses within earshot of other patients or families without clear permission.

Keep reading

Next in your reading path → What should I do if I think something went wrong?

Not legal advice. Educational overview only; consult qualified counsel for your situation.