OCR Issues Guidance on How Providers May Share Information under HIPAA in Response to the National Opioid Crisis

On October 27, 2017 the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) issued a guidance titled "How HIPAA Allows Doctors to Respond to the Opioid Crisis," following President Trump's declaration of the opioid crisis as a national public health emergency. The guidance contains information on how the HIPAA Privacy Rule allows covered entities—which include health care providers and insurers—to share patient information without patient consent in connection with the nation's opioid-related health crisis.

Generally, HIPAA prohibits health care providers and insurers from sharing protected health information about patients who have the capacity to make their own health care decisions, and who have not authorized information sharing with family or legal representatives. The OCR Guidance clarifies that the HIPAA Privacy Rule allows the sharing of such information in certain circumstances, including:

  • During an Emergency or Crisis Situation. Sharing health information with family, close friends, or any other person identified by the patient, and involved in caring for the patient IF the provider determines that doing so is in the incapacitated or unconscious patient's best interests and the information is directly related to the family or friend's involvement in the patient's health care or payment for care.
  • Threat to Patient Health or Safety. Informing persons in a position to prevent or lessen a serious or imminent threat to the patient's health or safety (e.g. continued used of opioids, overdose, or other incapacitation).

In the case of patients with decision-making capacity, a health care provider must give the patient the opportunity to agree or object to sharing health information with family, friends, and others involved in the individual's care or payment for care. The provider is not permitted to share health information about patients who currently have the capacity to make their own health care decisions, and object to sharing the information, UNLESS there is a serious and imminent threat of harm to health as described above.

The OCR Guidance notes that a patient's decision-making capacity may change during the course of treatment, and that covered entities and their employees must respect the patient's wishes if decision-making capacity is regained during treatment, despite any previous disclosure to family members. In addition, the OCR Guidance discusses the Privacy Rule provision for disclosures to a patient's personal representative under state law. Generally, HIPAA provides a patient's personal representative the right to request and obtain any information about the patient that the patient could obtain, including a complete medical record.

Finally, the OCR guidance notes that certain disclosures authorized under HIPAA may be prohibited by more stringent privacy protections under other state and federal laws, including but not limited to laws governing the privacy of patient records in substance abuse treatment programs.

Read the OCR Guidance (PDF)

Subscribe via Email