Mental health care increasingly involves teams: the therapist providing psychotherapy, the psychiatrist managing medications, the primary care physician monitoring overall health, the care coordinator making sure nothing falls through the cracks. When all team members see the same assessment data, treatment approaches align, contradictory recommendations are avoided, and care gaps become visible.
The evidence supports this approach. More than 90 randomized controlled trials have shown that collaborative care models improve access to mental health care while being more effective and cost-efficient than standard care. Patients treated with collaborative interventions reach diagnosis and initiate treatment within 6 months 75% of the time, compared to less than 25% receiving appropriate care under treatment as usual.
But sharing assessment data requires doing it securely and appropriately.
The HIPAA framework for sharing
HIPAA allows sharing PHI for treatment without patient authorization through what's called the treatment exception. This covers sharing between providers involved in a patient's care, including assessment results with consulting providers, coordination among care team members, and referral information including clinical data.
The minimum necessary standard requires limiting PHI disclosure to what's needed for the intended purpose. For care teams, share what's needed for treatment, not more, not less.
Assessment scores like the PHQ-9 and GAD-7 are explicitly not psychotherapy notes under HIPAA. The Privacy Rule defines psychotherapy notes narrowly as the therapist's personal notes documenting or analyzing conversation content during counseling sessions. Assessment scores fall under "results of clinical tests," which are specifically excluded from psychotherapy notes protections. This means they can be shared under the treatment exception without the special authorization requirements that apply to true psychotherapy notes.
Psychotherapy notes, the detailed process notes containing session content, do require patient authorization before sharing, even with other treating providers. Keep these separate from your standard medical record.
While HIPAA permits treatment-related sharing, best practice involves informing patients about care team coordination and explaining who will have access. Some states have additional consent requirements beyond HIPAA.
Technical approaches
When all care team members use the same EHR, you get a single source of truth with real-time access and built-in audit trails. This is the simplest approach when feasible. For cross-organizational teams, health information exchanges can move data between different systems, though they may not support behavioral health data particularly well.
Purpose-built platforms for behavioral health integration provide shared access to assessment data with outcome tracking features. These work well when designed for mental health workflows but add another system to manage.
For point-to-point sharing when systems don't integrate, secure messaging and portals work but require manual discipline to maintain. Whatever approach you use, avoid informal channels. Personal email, text, or unencrypted methods create HIPAA exposure.
Access control principles
Not everyone needs to see everything. Configure role-based access: treating clinicians get full clinical access, care coordinators get summary access to monitor progress without detailed notes, administrative staff get appointment and demographic information only. For consultants or temporary team members, provide time-limited access that expires when the engagement ends.
Every access to patient data should be logged with who accessed, when, and what they viewed. Regular audit trail review identifies inappropriate access patterns.
Ask for each role: what do they actually need to do their job? Does the care coordinator need every progress note, or just assessment scores? Does the consulting psychiatrist need full therapy notes, or a clinical summary with assessments? Configure access accordingly.
Care team coordination workflows
When multiple providers are involved, establish the team explicitly. Document who is involved, clarify each provider's function, decide what information flows to whom, and explain the coordination approach to the patient.
For routine sharing, assessment data should be automatically visible to care team members, or actively shared if systems don't integrate. Significant changes warrant proactive notification: when scores change meaningfully, concerning responses occur, or treatment plans shift. For urgent situations like safety concerns, use direct communication and confirm receipt. Don't rely on passive systems.
The collaborative care model emphasizes measurement-guided care plans with particular attention to patients not meeting clinical goals. A shared patient registry makes sure no one falls through the cracks. When implementing integrated care, establish infrastructure for health information exchange to support communication among all providers involved in a patient's care.
Specific sharing scenarios
Therapist plus psychiatrist: The most common model has patients seeing a therapist weekly and psychiatrist monthly. Share assessment scores before psychiatrist appointments, significant symptom changes between appointments, therapy progress relevant to medication decisions, and safety concerns immediately. Ideally through shared access to an assessment platform; alternatively through secure summary messages before appointments.
Primary care plus behavioral health: For integrated or collaborative care, share screening results from primary care (like the PHQ-2 for depression screening), assessment scores from behavioral health, treatment recommendations and adjustments, and coordination around prescriptions. EHR integration when possible; structured consultation notes otherwise.
Inpatient to outpatient: Discharge transitions require sharing discharge assessment results, treatment provided during hospitalization, discharge recommendations, and follow-up care plans. Direct provider-to-provider handoff communication prevents gaps.
Group practice internal sharing: Multiple providers in the same practice share assessment data across patients for coverage and supervision, aggregate outcome data for quality improvement, and clinical information for patients with multiple providers. A shared EHR with appropriate access controls, combined with team meetings and case conferences, makes this work.
Common pitfalls
Sharing more than necessary "to be safe" actually creates risk: more data exposed, more potential for inappropriate access. Share what's needed for treatment coordination, not everything.
Conversely, fear of privacy violations leading to inadequate coordination compromises care. Understand HIPAA treatment exceptions. Share appropriately for care purposes.
The biggest mistake is assuming access equals action. Sharing data doesn't mean it's been seen and acted upon. For critical information, verify receipt. A PCL-5 showing severe PTSD symptoms or elevated suicidal ideation on a depression screen needs confirmation that the right person saw it and is responding.