HHS Issues New Guidance on HIPAA and Information Sharing to Address Opioid Crisis

PUBLISHED: Oct 30, 2017
Relevant to: Ambulatory Care, Behavioral Health, Clinical Lab, Community Mental Health Centers, Critical Access Hospitals, Dialysis Facilities, Home Health, Hospice, Hospitals, Long Term Care, Medical Office/Clinic, Pharmacies

The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has released new guidance on when and how healthcare providers can share a patient’s health information with his or her family members, friends, and legal personal representatives when that patient may be in crisis and incapacitated, such as during an opioid overdose.

According to OCR, misunderstandings about HIPAA can create obstacles to family support that is crucial to the proper care and treatment of people experiencing a crisis situation, such as an opioid overdose. It is critical for healthcare providers to understand when and how they can share information with patients’ family members and friends without violating the HIPAA Privacy Rule. Providers should note that state or other federal privacy laws may also apply. HIPAA does not interfere with state laws or medical ethics rules that are more protective of patient privacy.

HIPAA allows health care professionals to disclose some health information without a patient’s permission under certain circumstances, including:

  • Sharing health information with family and close friends who are involved in care of the patient if the provider determines that doing so is in the best interests of an incapacitated or unconscious patient and the information shared is directly related to the family or friend’s involvement in the patient’s health care or payment of care.
  • Informing persons in a position to prevent or lessen a serious and imminent threat to a patient’s health or safety.

HIPAA respects individual autonomy by placing certain limitations on sharing health information with family members, friends, and others without the patient’s agreement.

  • For patients with decision-making capacity: A health care provider must give a patient the opportunity to agree or object to sharing health information with family, friends, and others involved in the individual’s care or payment for care.The provider is not permitted to share health information about patients who currently have the capacity to make their own health care decisions, and object to sharing the information (generally or with respect to specific people), unless there is a serious and imminent threat of harm to health as described above.

HIPAA anticipates that a patient’s decision-making capacity may change during the course of treatment.

  • Decision-making incapacity may be temporary and situational, and does not have to rise to the level where another decision maker has been or will be appointed by law.If a patient regains the capacity to make health care decisions, the provider must offer the patient the opportunity to agree or object before any additional sharing of health information.

HIPAA recognizes patient’s personal representatives according to state law.

  • Generally, HIPAA provides a patient’s personal representative the right to request and obtain any information about the patient that the patient could obtain, including a complete medical record.

For additional information follow the link below. Included with today’s notice are example policies related to this new HIPAA guidance.

Want to read the full alert and receive alert emails?

Browse Additional Alerts