Disclosure of Mental Health and Psychological Information
Iowa Mental Health Information Law
Health
Iowa bars mental health professionals, facilities, and data collectors from disclosing a person's mental health information except under written authorization or listed exceptions (emergencies, administrative needs, court orders, claims administration, limited family and law enforcement disclosures). Each disclosure must be logged, and recipients may not redisclose.
- Where
- Iowa
- Citation
- Iowa Code ch. 228 (228.1 to 228.9)
- Status
- In force
- Enforced by
- County attorneys (criminal, for payors and peer reviewers); Commissioner of Insurance receives payor filings
- People can sue
- No
- Penalties
- Willful misuse or disclosure by a third-party payor's or peer review organization's employee or agent is a serious misdemeanor with fines up to $500 for a first offense and higher for repeat offenses (228.7(3)). Disclosure statements warn recipients that civil damages and criminal penalties may apply (228.2(2)(b)).
- Applies to
- Mental health professionals, mental health facilities, and their employees and agents (228.2(1))
- Data collectors: persons other than mental health professionals who regularly assemble or evaluate mental health information (228.1)
- Recipients of mental health information, third-party payors, peer review organizations, and self-insured employers (228.2(3), 228.7)
What a privacy notice must say
- Voluntary disclosure authorizations must specify the information, who may disclose, purposes, duration, and revocation conditions, advise of the right to inspect, and be copied to the individual.Iowa Code 228.3
Practices it requires
- Do not disclose mental health information except as the chapter authorizes (written authorization, emergency transfers, administrative or compulsory disclosures, claims and peer review, family and law enforcement exceptions, or care coordination).Iowa Code 228.2(1)
- Recipients of mental health information may not redisclose it except as the chapter allows.Iowa Code 228.2(3)
Security duties
- Payors and peer review organizations may receive information only after filing a confidentiality statement with the Insurance Commissioner, and must limit use to claims, utilization and audit purposes and destroy it when no longer needed.Iowa Code 228.7(1)-(2) · Only if: Third-party payor or peer review organization
Other duties
- Log each disclosure in the individual's record (date and recipient) and give recipients a statement that redisclosure requires authorization and unauthorized disclosure is unlawful.Iowa Code 228.2(2)(a)-(b)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Original effective date (1986 Acts ch. 1082) and the date of the latest amendment (2024 Acts ch. 1170, s. 506, likely technical) were not confirmed. Whether a general civil damages action exists outside 228.7 was not determined; private_right_of_action is recorded as 'no' because no express civil action was found in the chapter.
Research reference, not legal advice.