This story was co-published with The New York Times

•  •  •

When a New Jersey lawyer named Philip received legal papers last year informing him that his former psychologist's practice was suing him over an unpaid bill, he was initially upset they could not work out a payment arrangement outside of court.

It was only later, Philip said in an interview, that he scanned the papers again and realized something else: The psychology group to which he'd confided his innermost feelings had included his mental health diagnosis and treatments he received in publicly filed court documents.

The greatest fear of many patients receiving therapy services is that somehow the details of their private struggles will be revealed publicly. Philip, who requested his last name not be used to protect his privacy, said he felt "betrayed" by his psychologist. He worried that his legal adversaries would find the information and try to use it against him in court.

"It turned my life upside down," he said.

Short Hills Associates in Clinical Psychology, the group based in New Jersey that treated Philip, has filed dozens of collections lawsuits against patients and included in them their names, diagnoses and listings of their treatments.

"That's just horrendous. I have never heard of anything that bad and I've been practicing for like 40 years." – ," Deborah Peel, Texas psychiatrist and founder of Patient Privacy Rights, an advocacy group

In cases in which the patients were minors, the practice sued their parents and included the children's names and diagnoses.

The Health Insurance Portability and Accountability Act, the federal patient privacy law known as HIPAA, allows health providers to sue patients over unpaid debts, but requires that they disclose only the minimum information necessary to pursue them.

Still, the law has many loopholes, which ProPublica has been exploring in a series of articles this year. One is that HIPAA covers only providers who submit data electronically – and apparently Short Hills Associates does not.

Between 2010 and 2014, Short Hills Associates filed 24 collections cases in which patients' diagnoses were listed, New Jersey court records show. The defendants included lawyers, business people and a nonprofit official.

The suits identified diagnoses by unique codes listed in the Diagnostic and Statistical Manual of Mental Disorders, the reference work on mental illness published by the American Psychiatric Association. An online search of the codes quickly provides their meaning.

Short Hills Associates' managing partner, Barry Helfmann, has been a leader in New Jersey psychology circles. He is a past president of the New Jersey Psychological Association and serves as its director of professional affairs. He has also served on the board of the American Group Psychotherapy Association.

In other contexts, Helfmann has been a champion of patient privacy. In 2010, he was a plaintiff in a lawsuit against two insurance companies and a New Jersey state commission, accusing them of requiring psychologists to turn over their treatment notes in order to get paid.

Philip is now countersuing Helfmann and his partners, the psychology group and the practice's debt collection lawyers for invasion of privacy, breach of the psychologist-patient privilege, fraud and misrepresentation and other claims. He is seeking the court's permission to represent other patients as part of a class action.

Jon, another person being sued by Short Hills Associates for unpaid bills, said he was surprised to learn from a reporter last week that his son's name and diagnosis was included in court papers. He hadn't noticed at the time.

"Our kids learn in school and we're tasked to drive home to them that everything they do online will remain online forever. And don't do stupid stuff online," said Jon, who requested his last name not be published to protect his family's privacy. "And now to find out that adults aren't following that practice on their behalf is borderline devastating."

In a deposition taken in November, Audrey Muratore, billing manager for Short Hills Associates, maintained that "it is within my right" to send a bill for debt collection and that once a suit was filed, she did not see the legal papers. "Once they file a suit, it's out of my hands," she said.

She added that the firm had not filed any additional debt lawsuits since Philip filed his countersuit against them and currently did not have a collection agency working on its behalf.

ProPublica reviewed the billing lawsuits filed by another psychology group against patients in New Jersey and found that they redacted diagnosis and treatment codes.

John Mullahy, a lawyer for Helfmann and Short Hills Associates, issued a statement in response to questions for this article: "My clients deny and will be vigorously defending against all allegations of wrongdoing here. We cannot and will not comment further given that litigation is pending."

Jeffrey Rothbard, a partner at Rothbard, Rothbard, Kohn & Kellar, the firm that filed the collections lawsuits on behalf of Short Hills Associates, also declined to comment. "I don't want to start trying this case in the press," Rothbard said.

Some mental health practitioners expressed outrage that Short Hills Associates had revealed patients' private information as part of suing them for payment.

"That's just horrendous," said Deborah Peel, a Texas psychiatrist who is founder and chair of Patient Privacy Rights, a group that advocates for patient privacy. "I have never heard of anything that bad and I've been practicing for like 40 years."

Alan Nessman, the senior special counsel of the American Psychological Association, said in a statement that he could not comment on the legal fight in New Jersey. But he said the organization would typically recommend against including patients' diagnoses and a list of procedures as part of collection suits because it "may be more than the minimum disclosure necessary to obtain payment" under HIPAA and the group's ethics code.

The inclusion of patients' diagnoses in lawsuits is rare, experts say, but not unheard-of. An Indiana man won a $1.25 million jury verdict in 2010 against his physician group for including his H.I.V. status in a collections lawsuit. Another Indiana resident secured a settlement in 2013 after his HIV status was included in a billing suit filed by his dentist. (In bold, capital letters, his record said, "MEDICAL ALERTS: H.I.V. AIDS.")

The man, who asked that he be identified only by his first name, Fred, to protect his privacy, said in an interview that the dentist's disclosure upended his life. He was given a diagnosis of major depression and takes medications to treat it. "It affects the very essence of who I am," he said. "It would be tantamount to walking down the street with a sign pointing at me saying, 'Here it is.' "

When Short Hills Associates filed suit against Philip in September 2014, it said he owed $4,400 for meetings from 2012 to February 2014.

Philip asserted in legal documents that he confronted Helfmann in a phone call the following month and the psychologist told him it was his fault his information was disclosed because he had not paid his bill.

In November 2014, Philip's lawyer obtained a judge's order directing that the bill detailing his diagnosis and treatment codes be replaced with a document in which that information was redacted.

Several months later, Andrew Thomasson, Philip's lawyer, sent an email to Mullahy, his counterpart representing Short Hills Associates, listing all the collection cases in which the practice had disclosed patients' diagnoses. As of Monday, though, the records were still publicly available.

Thomasson said he was particularly concerned about minors whose patient information was exposed.

"When they're grown up, want to get a job with the FBI or the U.S. attorney's office, they conduct very thorough background checks and they may come across it," he said in an interview. "It could be used to prevent someone from getting a job one day."

Nevertheless, a spokesman for the New Jersey Division of Consumer Affairs said the inclusion of diagnostic codes in lawsuits did not violate any regulations or statutes for the State Board of Psychological Examiners.

Philip filed a complaint in March with the Office for Civil Rights of the federal Department of Health and Human Services, the agency that enforces HIPAA. It included details on his case and others. In August, the agency wrote back to say it was "closing this complaint with no further action."

In an email, Rachel Seeger, a spokeswoman for the office, said the agency "closed this case because we determined that Short Hills Associates in Clinical Psychology is not a HIPAA-covered entity, and therefore we have no jurisdiction to investigate or take any action on the complaint."

The privacy law's language specifies that it covers only health providers who "electronically transmit any health information in connection with transactions for which HHS has adopted standards." Doctors who still rely on paper records and paper bills – or clients who pay cash – are not subject to the law.

In legal papers, Short Hills Associates has not argued that it falls outside privacy law's reach. In fact, on its website it offers patients forms and information that specifically mentions their rights under the law.

•  •  •

This story is part of a yearlong examination into how secure medical privacy is. Has your medical privacy been compromised? Help ProPublica investigate by filling out a short questionnaire. You can also read other stories in our Policing Patient Privacy series.

ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter.