Clinicians get more leeway in sharing PHI of opioid patients
Physicians and other clinicians dealing with the nation’s opioid crisis are getting updated guidance from the HHS Office for Civil Rights on when they can disclose health information to family or close friends of an addicted patient without the patient’s approval while still adhering to HIPAA privacy regulations.
The guidance also is intended to help providers comply with HIPAA rules as they work to implement behavioral health provisions of the 21st Century Cures Act.
“HHS is using every tool at its disposal to help communities devastated by opioids, including educating families and doctors on how they can share information to help save the lives of loved ones,” says Roger Severino, director of OCR.
The law enables health professionals to share information in an emergency or otherwise dangerous situation. For example, information can be shared with loved ones involved in the care of a patient if a provider believes that disclosure is in the best interest of an incapacitated or unconscious patient. The provider can discuss the overdose and relevant medical information, but cannot share medical information unrelated to the overdose without patient permission. Physicians also can inform loved ones that based on facts, a patient likely will continue opioid abuse after discharge.
However, if a patient can make decisions, HIPAA imposes limitations on the ability of clinicians to share information with loved ones, but there is a large caveat. “The provider is not permitted to share health information about patients who currently have the capacity to make their own healthcare decisions and object to sharing the information, unless there is a serious and imminent threat of harm to health.”
In the case of an incapacitated patient arriving in the emergency department and unable to participate in decision making, clinicians can decide if sharing information with loved ones is appropriate and the degree to which they will share the information. If the patient later is able to participate in decision making, the provider still can share information with others to prevent or lessen a believed serious threat to the patient.
HIPAA also has provisions to enable a patient’s personal representative, who has healthcare decision-making authority for the patient, to obtain information that the patient could obtain, including a complete medical record.
“This authority may be established through the parental relationship between the parent or guardian of an un-emancipated minor, or through a written directive, healthcare power of attorney, appointment of a guardian, a determination of incompetency or other recognition consistent with state laws to act on behalf of the individual in making healthcare-related decisions,” OCR advises.