In response to President Trump’s call to action on opioids, acting Department of Health and Human Services (HHS) Secretary Eric D. Hargan declared the opioid crisis a national public health emergency on October 26, 2017.  The next day, HHS-Office for Civil Rights (OCR) released new guidance on when and how health care providers can share a patient’s health information with the patient’s family and close friends during certain crisis situations, such as opioid overdoses, without violating the Health Insurance Portability and Accountability Act (HIPAA) privacy regulations.

HIPAA prohibits health care providers from sharing protected health information about patients who have capacity to make their own health care decisions and object to information sharing, unless there is a serious and imminent threat of harm or safety.  However, health care professionals may disclose some health information without a patient’s permission under certain circumstances, including:

• Sharing health information with family, close friends, or any other person identified by the patient, and involved in caring for the patient if the provider determines that doing so is in the incapacitated or unconscious patient’s best interests and the information is directly related to the family or friend’s involvement in the patient’s health care or payment for care. The provider may use professional judgment and experience with common practice to make reasonable inferences of the patient’s best interest.
• Informing persons in a position to prevent or lessen a serious or imminent threat to the patient’s health or safety.

OCR’s guidance also highlights that a health care provider’s information sharing with others must adapt as circumstances surrounding the crisis change, such as when a patient regains his or her decision-making capacity.  If a patient regains capacity to make his or her own health care decisions, the health care provider must offer the patient the opportunity to agree or object before any additional sharing of the patient’s health information.  If the patient regains capacity to make health care decisions and the patient objects to future information sharing, the provider may still share information to prevent or mitigate a serious and imminent threat to patient health or safety.

Please note, state or other federal privacy laws may also apply in a situation where a patient experiences an opioid overdose – such as 42 CFR Part 2, commonly referred to as the Confidentiality of Substance Use Disorder Patient Records Act.  HIPAA does not interfere with laws or medical ethics rules that are more protective of patient privacy.

More information for individuals, family, and friends is available at: https://www.hhs.gov/hipaa/for-individuals/family-members-friends/index.html.

OCR offers health care professionals FAQs on Disclosures to Friends and Family Members at: https://www.hhs.gov/hipaa/for-professionals/faq/disclosures-to-family-and-friends.

If you have any questions about these uses and disclosures or HIPAA compliance more generally, please feel free to contact any member of Drinker Biddle’s Health Care Team or Information, Privacy, Security and Governance Team. 

The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.