@Zaku If the person is being treated by a team who all work in the same organization, all notes can be viewed by anyone on the team at any time. If a person is being treated by a private therapist, then nothing gets shared without written consent. The important factor is team. They must be linked within an organization.
I can think of a scenario where a patient might say to a therapist they want to say something but they don’t want it to go in the notes. That will be something for the therapist to consider on a case-by-case basis. If the information is about harm to self or others, the therapist would usually include it in the notes and then inform other team members.
It’s a bit of further information that PHI is very broadly defined by the law. A person’s initials are PHI. A person’s family member’s name is PHI. If I write a patient’s name and phone number on a post-it note, that by itself is not PHI, but if that post-it note is on my desk, it becomes PHI, because I’m a healthcare provider. There are a total of 18 signifiers that are PHI. I don’t have them memorized.
I work in a secure building with 2 security guards at the front door. Further, my office that I have my desk in has another lock on the door, because we view PHI on our computers, and we have to keep people from seeing things over our shoulders. When I leave my desk, I have to lock my computer.
HIPAA is a big deal.
I get phone calls from family members about loved ones weekly. Many will say “my family member is being treated at your clinic”, and then they want information. I’m not even allowed to acknowledge that the person is indeed being treated. I can only say “I can neither confirm nor deny that he/she is being treated here.”