OCR HIPAA Guidance for Opioid National Emergency

The opioid crisis has been declared a national emergency. This crisis presents a variety of legal issues and questions, including the extent to which health care providers can disclose a patient’s protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). When a patient is incapacitated due to an opioid addiction or related issue and has not designated a friend or family member as a personal representative with whom health care providers may share PHI, health care providers struggle with determining when and how much information can be shared. To clarify this issue, the HHS Office for Civil Rights has released a guidance for health care providers detailing the sharing of PHI (“Guidance”) specific to the opioid crisis.

Sharing PHI without Patient Consent

The Guidance details scenarios when a health care provider may share PHI in situations that may arise related to the opioid crisis.

Incapacity or Emergency

The first type of disclosure that is implicated by opioid-related issues is disclosures to individuals who are involved in the patient’s care. If the patient is incapacitated or there is an emergency where the patient is unable to agree or object to a health care provider sharing PHI with the patient’s friends or family members, a provider may determine, in the provider’s professional judgment, that it is in the patient’s best interest to disclose PHI to a friend or family member involved in the patient’s care. The provider may disclose only information directly related to the friend or family member’s involvement in the patient’s care or payment for the patient’s care. This means information related to the opioid overdose could be shared with a friend who brought the patient to the hospital for treatment for an overdose, but the entire medical history of the patient could not be shared with that friend. The Guidance notes that a patient’s incapacity does not necessarily have to be formalized such that a legal decision maker has been appointed.

However, if the patient has capacity, the health care provider must give the patient the opportunity to agree or object to sharing information. The health care provider can orally inform the patient and obtain agreement or objection from the patient to share information with the patient’s family member or friend. Even if the patient objects, the Guidance states that the provider may still disclose limited information if it relates to a threat to the patient’s health or safety, as detailed below.

Threat to Patient Health or Safety

Under a threat to a patient’s health or safety, the Guidance states that as long as a disclosure is consistent with applicable law and ethical standards and is necessary to prevent or lessen a serious and imminent threat to a patient’s health or safety, the health care provider may disclose PHI to a person who could prevent or lessen the harm. Per the Guidance, if a doctor concludes, based on the facts and circumstances, that a patient who has overdosed on opioids poses a serious and imminent threat to the patient’s own health, it would not be a violation of HIPAA to disclose information about the opioid abuse to the patient’s family or friends. Under HIPAA, the individual to whom a health care provider may disclose patient information when the provider has identified a threat to health or safety of the patient must be a person reasonably able to prevent or lessen the threat. This Guidance indicates that a patient’s continued use of opioids could be considered an imminent threat to health or safety such that a provider could inform a patient’s friend or family member of the threat of a patient’s use of opioids, even if the health care provider does not have the patient’s consent to do so. Health care providers should carefully evaluate on a case-by-case basis each situation that could give rise to using this HIPAA provision to disclose PHI without patient consent. Health care providers should diligently document the decision, including the “serious and imminent threat to health or safety” as well as how the person they are disclosing information to could “lessen or prevent” the harm to avoid violations of patient privacy.

Changes in Capacity

In an opioid overdose, a patient’s incapacity may be temporary. The Guidance provides the example of a patient in the emergency room who is intoxicated and unconscious, where the treatment team may determine that sharing limited information relevant to friends or family members’ involvement in the patient’s care is in the best interest of the patient. If the patient then regains consciousness or is otherwise determined by the provider to have capacity, the patient has the right to object to further disclosures of information. The provider may still share information with the patient’s friends or family under the “threat to health or safety” circumstances described above.

Personal Representatives

Finally, the Guidance notes that personal representatives have, pursuant to applicable state law, the authority to make decisions for patients. A personal representative is able to stand in the shoes of the patient and have the same right to access a patient’s medical records as the patient. The decision-making authority of the personal representative stems from applicable state law.

In light of the Guidance from OCR, health care providers should:

Consult with legal counsel to determine whether the health care provider is complying with other applicable state laws and medical ethics in their evaluation of facts and circumstances surrounding disclosures of PHI related to opioid use;
Review HIPAA policies and procedures related to sharing information with family members and friends to ensure they are consistent with the Guidance; and
Provide training and reminders to the health care provider’s workforce so members of the workforce are able to navigate the disclosure of PHI related to opioid use, balancing both the patient’s privacy and health and safety.

Note that for health care providers who are considered “Part 2 programs” under 42 C.F.R. Part 2, Part 2 requirements still apply. Additionally, more stringent state laws will also apply.

For specific questions about the Guidance, please contact: