The Office for Civil Rights Issues New HIPAA Opioid Guidance Document

In the wake of the presidential declaration of the opioid crisis as a national public health emergency, the Department of Health & Human Services (HHS) Office for Civil Rights (OCR) released a new guidance document on October 27, 2017, to clarify to health care providers when patient health information can be shared with a patient’s family members and friends during a crisis situation, such as an opioid overdose, within the confines of HIPAA. The guidance document, entitled How HIPAA Allows Doctors to Respond to the Opioid Crisis, reiterates that HIPAA regulations have always allowed health professionals to share certain health information with patients’ families and friends in emergency or dangerous situations, and provides much needed guidance on situations that are a source of confusion for many providers working with patients dealing with drug addiction.

The guidance document clarifies that HIPAA allows a provider to use professional judgment when talking to the family member or close friend of a patient who may be severely incapacitated or unconscious due to an opioid overdose or in danger of continued opioid abuse upon discharge. The discussion of the patient’s health information must be limited to the information that is directly applicable to the family member or close friend’s involvement in the patient’s health care or payment of health care. HIPAA still prohibits the sharing of medical information that is not related to the specific circumstances without the patient’s permission. The guidance document also clarifies that a provider may also share certain health information with loved ones to prevent or lessen a serious and imminent threat to a patient’s health or safety. The example provided notes that, if the physician determines that a patient poses a serious and imminent threat to his or her health due to continued opioid abuse upon discharge, the physician may inform the patient’s family, friends, or caregiver if sharing such information would prevent or lessen the potential threat of harm to the patient.

Professionals who work with patients struggling with opioid addiction must also navigate complex situations where the patient’s decision-making capacity may change during the course of treatment. In acknowledgement of these issues, the guidance document notes that, if a patient has decision-making capacity, a health care provider must give the patient the opportunity to decide if he or she would like to share his or her health information with family or friends — absent circumstances under which there is a serious and imminent threat of harm to the patient’s health. The guidance document also clarifies that patient decision-making incapacity may be only temporary or situational in nature, but there is no requirement that the patient has reached a level (of incapacity) where a decision maker has to be appointed by law for a professional determination to be made that the patient is not capable of making health care decisions. OCR provides the following example:

[A] patient who arrives at an emergency room severely intoxicated or unconscious will be unable to meaningfully agree or object to information-sharing upon admission but may have sufficient capacity several hours later. Nurses and doctors may decide whether sharing information is in the patient’s best interest, and how much and what type of health information is appropriate to share with the patient’s family or close personal friends, while the patient is incapacitated so long as the information shared is related to the person’s involvement with the patient’s health care or payment for such care. If a patient’s capacity returns and the patient objects to future information sharing, the provider may still share information to prevent or lessen a serious and imminent threat to health or safety[].

While providers may rely on the guidance to comply with HIPAA requirements and standards, OCR clearly notes that the guidance document does not address other privacy rules and regulations that may exist under state and federal laws. For instance, providers should continue to consider and adhere to any state or federal regulations that are more restrictive, such as regulations that limit the disclosure of substance abuse patient records barring certain circumstances or specific state Medicaid privacy requirements that may apply.