228DISCLOSURE OF MENTAL HEALTH AND PSYCHOLOGICAL INFORMATION228.1Definitions.As used in this chapter:1“Administrative information” means an individual’s name, identifying number, age, sex, address, dates and character of professional services provided to the individual, fees for the professional services, third-party payor name and payor number of a patient, if known, name and location of the facility where treatment is received, the date of the individual’s admission to the facility, and the name of the individual’s attending physician or attending mental health professional.2“Data collector” means a person, other than a mental health professional or an employee of or agent for a mental health facility, who regularly assembles or evaluates mental health information.3“Diagnostic information” means a therapeutic characterization of the type found in the diagnostic and statistical manual of mental disorders of the American psychiatric association or in a comparable professionally recognized diagnostic manual.4“Law enforcement professional” means a law enforcement officer as defined in section 80B.3, county attorney as defined in section 331.101, probation or parole officer, or jailer. 5“Mental health facility” means a community mental health center, hospital, clinic, office, health care facility, infirmary, or similar place in which professional services are provided.6“Mental health information” means oral, written, or recorded information which indicates the identity of an individual receiving professional services and which relates to the diagnosis, course, or treatment of the individual’s mental or emotional condition.7“Mental health professional” means an individual who has either of the following qualifications:aThe individual meets all of the following requirements:1The individual holds at least a master’s degree in a mental health field, including but not limited to psychology, counseling and guidance, nursing, and social work, or is an advanced registered nurse practitioner, a physician assistant, or a physician and surgeon or an osteopathic physician and surgeon.2The individual holds a current Iowa license if practicing in a field covered by an Iowa licensure law.3The individual has at least two years of post-degree clinical experience, supervised by another mental health professional, in assessing mental health needs and problems and in providing appropriate mental health services.bThe individual holds a current Iowa license if practicing in a field covered by an Iowa licensure law and is a psychiatrist, an advanced registered nurse practitioner who holds a national certification in psychiatric mental health care and is licensed by the board of nursing, a physician assistant practicing under the supervision of or in collaboration with a psychiatrist, a qualified mental health professional physician assistant, a psychiatric advanced registered nurse practitioner as defined in section 125.2, or an individual who holds a doctorate degree in psychology and is licensed by the board of behavioral health professionals to practice psychology. For the purposes of this paragraph, “collaboration” means the same as defined in section 148C.1.8“Peer review organization” means a utilization and quality control peer review organization that has a contract with the federal secretary of health and human services pursuant to Tit. XI, part B, of the federal Social Security Act to review health care services paid for in whole or in part under the Medicare program established by Tit. XVIII of the federal Social Security Act, or another organization of licensed health care professionals performing utilization and quality control review functions.9“Professional services” means diagnostic or treatment services for a mental or emotional condition provided by a mental health professional.10“Self-insured employer” means a person which provides accident and health benefits or medical, surgical, or hospital benefits on a self-insured basis to its own employees or to employees of an affiliated company or companies and which does not otherwise provide accident and health benefits or medical, surgical, or hospital benefits.11“Third-party payor” means a person which provides accident and health benefits or medical, surgical, or hospital benefits, whether on an indemnity, reimbursement, service, or prepaid basis, including but not limited to, insurers, nonprofit health service corporations, health maintenance organizations, governmental agencies, and self-insured employers.86 Acts, ch 1082, §1; 88 Acts, ch 1226, §2, 3; 95 Acts, ch 120, §2; 2010 Acts, ch 1061, §180; 2012 Acts, ch 1079, §5; 2015 Acts, ch 56, §16; 2016 Acts, ch 1073, §77; 2018 Acts, ch 1056, §5; 2023 Acts, ch 73, §20; 2024 Acts, ch 1170, §506228.2Mental health information disclosure prohibited exceptions record of disclosure.1Except as specifically authorized in subsection 4, section 228.3, 228.5, 228.6, 228.7, or 228.8, or for the purposes of care coordination as defined in section 135D.2 if not otherwise restricted by federal law or regulation, a mental health professional, data collector, or employee or agent of a mental health professional, of a data collector, or of or for a mental health facility shall not disclose or permit the disclosure of mental health information.2aUpon disclosure of mental health information pursuant to subsection 4, section 228.3, 228.5, 228.6, 228.7, or 228.8, or for the purposes of care coordination as defined in section 135D.2 if not otherwise restricted by federal law or regulation, the person disclosing the mental health information shall enter a notation on and maintain the notation with the individual’s record of mental health information, stating the date of the disclosure and the name of the recipient of mental health information.bThe person disclosing the mental health information shall give the recipient of the information a statement which informs the recipient that disclosures may only be made pursuant to the written authorization of an individual or an individual’s legal representative, or as otherwise provided in this chapter, that the unauthorized disclosure of mental health information is unlawful, and that civil damages and criminal penalties may be applicable to the unauthorized disclosure of mental health information.3A recipient of mental health information shall not disclose the information received, except as specifically authorized for initial disclosure in subsection 4, section 228.3, 228.5, 228.6, 228.7, or 228.8, or for the purposes of care coordination as defined in section 135D.2 if not otherwise restricted by federal law or regulation.4Mental health information may be transferred at any time to another facility, physician, or mental health professional in cases of a medical emergency or if the individual or the individual’s legal representative requests the transfer in writing for the purposes of receipt of medical or mental health professional services, at which time the requirements of subsection 2 shall be followed.86 Acts, ch 1082, §2; 88 Acts, ch 1226, §4, 5; 90 Acts, ch 1079, §2; 2009 Acts, ch 41, §263; 2016 Acts, ch 1055, §2, 3, 5, 6228.3Voluntary disclosures.1An individual eighteen years of age or older or an individual’s legal representative may consent to the disclosure of mental health information relating to the individual by a mental health professional, data collector, or employee or agent of a mental health professional, of a data collector, or of or for a mental health facility, by signing a voluntary written authorization. The authorization shall:aSpecify the nature of the mental health information to be disclosed, the persons or type of persons authorized to disclose the information, and the purposes for which the information may be used both at the time of the disclosure and in the future.bAdvise the individual of the individual’s right to inspect the disclosed mental health information at any time.cState that the authorization is subject to revocation and state the conditions of revocation.dSpecify the length of time for which the authorization is valid.eContain the date on which the authorization was signed.2A copy of the authorization shall:aBe provided to the individual or to the legal representative of the individual authorizing the disclosure.bBe included in the individual’s record of mental health information.86 Acts, ch 1082, §3; 88 Acts, ch 1226, §6, 7, 9228.4Revocation of disclosure authorization.An individual or an individual’s legal representative may revoke a prior authorization by providing a written revocation to the recipient named in the authorization and to the mental health professional, data collector, or employee or agent of a mental health professional, of a data collector, or of or for a mental health facility previously authorized to disclose the mental health information. The revocation is effective upon receipt of the written revocation by the person previously authorized to disclose the mental health information. After the effective revocation date, mental health information shall not be disclosed pursuant to the revoked authorization. However, mental health information previously disclosed pursuant to the revoked authorization may be used for the purposes stated in the original written authorization.86 Acts, ch 1082, §4228.5Administrative disclosures.1An individual or an individual’s legal representative shall be informed that mental health information relating to the individual may be disclosed to employees or agents of or for the same mental health facility or to other providers of professional services or their employees or agents if and to the extent necessary to facilitate the provision of administrative and professional services to the individual.2aIf an individual eighteen years of age or older or an individual’s legal representative has received a written notification that a fee is due a mental health professional or a mental health facility and has failed to arrange for payment of the fee within a reasonable time after the notification, the mental health professional or mental health facility may disclose administrative information necessary for the collection of the fee to a person or agency providing collection services.bIf a civil action is filed for the collection of the fee, additional mental health information shall not be disclosed in the litigation, except to the extent necessary to respond to a motion of the individual or the individual’s legal representative for greater specificity or to dispute a defense or counterclaim.3A mental health professional or an employee of or agent for a mental health facility may disclose mental health information if necessary for the purpose of conducting scientific and data research, management audits, or program evaluations of the mental health professional or mental health facility, to persons who have demonstrated and provided written assurances of their ability to ensure compliance with the requirements of this chapter. The persons shall not identify, directly or indirectly, an individual in any report of the research, audits, or evaluations, or otherwise disclose individual identities in any manner. A disclosure under this section is not subject to the requirements of section 228.2, subsection 2, with the exception that a person receiving mental health information under this section shall be provided a statement prohibiting redisclosure of information unless otherwise authorized by this chapter.4Mental health information relating to an individual may be disclosed to other providers of professional services or their employees or agents if and to the extent necessary to facilitate the provision of administrative and professional services to the individual including to an employee of the department of corrections, if authorized by the director of the department of corrections, or to an employee of a judicial district department of correctional services, if authorized by the director of the judicial district department of correctional services.86 Acts, ch 1082, §5; 88 Acts, ch 1226, §8; 96 Acts, ch 1213, §33, 34; 2009 Acts, ch 41, §263; 2021 Acts, ch 11, §2228.6Compulsory disclosures.1A mental health professional or an employee of or agent for a mental health facility may disclose mental health information if and to the extent necessary, to meet the requirements of section 229.24, 229.25, 230A.108,* 232.74, or 232.147, or to meet the compulsory reporting or disclosure requirements of other state or federal law relating to the protection of human health and safety.2Mental health information acquired by a mental health professional pursuant to a court-ordered examination may be disclosed pursuant to court rules.3Mental health information may be disclosed by a mental health professional if and to the extent necessary, to initiate or complete civil commitment proceedings under chapter 229.4aMental health information may be disclosed in a civil or administrative proceeding in which an individual eighteen years of age or older or an individual’s legal representative or, in the case of a deceased individual, a party claiming or defending through a beneficiary of the individual, offers the individual’s mental or emotional condition as an element of a claim or a defense.bMental health information may be disclosed in a criminal proceeding pursuant to section 622.10, subsection 4.5An individual eighteen years of age or older or an individual’s legal representative or any other party in a civil, criminal, or administrative action, in which mental health information has been or will be disclosed, may move the court to denominate, style, or caption the names of all parties as “JOHN OR JANE DOE” or otherwise protect the anonymity of all of the parties.86 Acts, ch 1082, §6; 2011 Acts, ch 8, §1, 3; 2013 Acts, ch 90, §51; 2024 Acts, ch 1161, §71, 137228.7Disclosures for claims administration and peer review — safeguards — penalty.1Mental health information may be disclosed, in accordance with the prior written consent of the patient or the patient’s legal representative, by a mental health professional, data collector, or employee or agent of a mental health professional, a data collector, or a mental health facility to a third-party payor or to a peer review organization if the third-party payor or the peer review organization has filed a written statement with the commissioner of insurance in which the filer agrees to:aInstruct its employees and agents to maintain the confidentiality of mental health information and of the penalty for unauthorized disclosure.bComply with the limitations on use and disclosure of the information specified in subsection 2 of this section.cDestroy the information when it is no longer needed for the purposes specified in subsection 2 of this section.2aAn employee or agent of a third-party payor or of a peer review organization shall not use mental health information or disclose mental health information to any person, except to the extent necessary to administer claims submitted or to be submitted for payment to the third-party payor, to conduct a utilization and quality control review of mental health care services provided or proposed to be provided, to conduct an audit of claims paid, or as otherwise authorized by law.bEmployees of a self-insured employer, and agents of a self-insured employer which have not filed a statement with the commissioner of insurance pursuant to subsection 1, shall not be granted routine or ongoing access to mental health information unless the employees or agents have signed a statement indicating that they are aware that the information shall not be used or disclosed except as provided in this subsection and that they are aware of the penalty for unauthorized disclosure.3An employee or agent of a third-party payor or a peer review organization who willfully uses or discloses mental health information in violation of subsection 2 of this section is guilty of a serious misdemeanor, and, notwithstanding section 903.1, the sentence for a person convicted under this subsection is a fine not to exceed five hundred dollars in the case of a first offense, and not to exceed five thousand dollars in the case of each subsequent offense.88 Acts, ch 1226, §1; 2009 Acts, ch 41, §263228.7ADisclosures to law enforcement professionals.1Mental health information relating to an individual may be disclosed by a mental health professional, at the minimum consistent with applicable laws and standards of ethical conduct, to a law enforcement professional if all of the following apply:aThe disclosure is made in good faith.bThe disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of the individual or to a clearly identifiable victim or victims.cThe individual has the apparent intent and ability to carry out the threat.2A mental health professional shall not be held criminally or civilly liable for failure to disclose mental health information relating to an individual to a law enforcement professional except in circumstances where the individual has communicated to the mental health professional an imminent threat of physical violence against the individual’s self or against a clearly identifiable victim or victims. 3A mental health professional discharges the professional’s duty to disclose pursuant to subsection 1 by making reasonable efforts to communicate the threat to a law enforcement professional.2018 Acts, ch 1056, §6228.8Disclosures to family members.1A mental health professional or an employee of or agent for a mental health facility may disclose mental health information to the spouse, parent, adult child, or adult sibling of an individual who has chronic mental illness, if all of the following conditions are met:aThe disclosure is necessary to assist in the provision of care or monitoring of the individual’s treatment.bThe spouse, parent, adult child, or adult sibling is directly involved in providing care to or monitoring the treatment of the individual.cThe involvement of the spouse, parent, adult child, or adult sibling is verified by the individual’s attending physician, attending mental health professional, or a person other than the spouse, parent, adult child, or adult sibling who is responsible for providing treatment to the individual.2A request for mental health information by a person authorized to receive such information under this section shall be in writing, except in an emergency as determined by the mental health professional verifying the involvement of the spouse, parent, adult child, or adult sibling.3Unless the individual has been adjudged incompetent, the person verifying the involvement of the spouse, parent, adult child, or adult sibling shall notify the individual of the disclosure of the individual’s mental health information under this section.4Mental health information disclosed under this section is limited to the following:aA summary of the individual’s diagnosis and prognosis.bA listing of the medication which the individual has received and is receiving and the individual’s record of compliance in taking medication prescribed for the previous six months.cA description of the individual’s treatment plan.90 Acts, ch 1079, §1228.9Disclosure of psychological test material.Except as otherwise provided in this section, a person in possession of psychological test material shall not disclose the material to any other person, including the individual who is a subject of the test. In addition, the test material shall not be disclosed in any administrative, judicial, or legislative proceeding. However, upon the request of an individual who is the subject of a test, all records associated with a psychological test of that individual shall be disclosed to a psychologist licensed pursuant to chapter 154B designated by the individual. An individual’s request for the records shall be in writing and shall comply with the requirements of section 228.3, relating to voluntary disclosures of mental health information, except that the individual shall not have the right to inspect the test materials.94 Acts, ch 1159, §1