Under HIPAA, does having a health care power of attorney generally allow access to the patient's medical records, including mental health records?

• A. No, POA cannot access medical records without patient consent.
• B. Yes, generally, but psychotherapy notes stored separately may be restricted, and a therapist may withhold access if the representative is abusive or could be endangered by treatment.
• C. Yes, but only for billing or financial records.
• D. Access is only allowed if a court orders it.

Answer: (B)

Under HIPAA, a health care power of attorney is treated as a personal representative who can access the patient’s PHI to help make healthcare decisions. This generally means the POA has access to medical records, including mental health information, to inform treatment and decisions. However, psychotherapy notes are given special protection and are stored separately; they typically require separate authorization to disclose. In addition, a therapist may withhold access if the representative is abusive or if disclosure could endanger the patient or others. So, the general rule is yes, with these important caveats. The other options don’t fit because HIPAA allows access by a personal representative, not just billing records, court orders aren’t normally required, and consent is not always needed for a POA to access PHI.