Office of Civil Rights Issues Guidance on HIPAA in Light of Opioid Crisis

With an increased focus on opioid use and addiction, the Department of Health and Human Services Office of Civil Rights has issued guidance related to the Health Insurance Portability and Accountability Act of 1996 due to misunderstandings over when a health care provider can share an individual’s protected health information in situations of overdose or need for emergency medical treatment related to opioid use. Generally speaking, HIPAA restricts a health care provider’s ability to share PHI, but there are instances when a health care provider may disclose PHI even if the patient has not authorized the disclosure.

Many health care providers mistakenly think they must have an authorization or the patient’s permission to release PHI. However, there are circumstances in which the patient’s permission is not required. HIPAA allows a health care provider to share information with a patient’s family or caregivers in certain emergency or dangerous situations. As outlined in the guidance, a provider may share information with family and close friends who are involved in the care of the patient if the provider determines that doing so in the best interest of an incapacitated or unconscious patient and the information shared is directly related to the family or friends involved in the patient’s health care or payment of care. OCR’s guidance states that a provider may use his/her professional judgment to talk to the parents of someone incapacitated by an opioid overdose about the overdose and related medical information, but the provider could not share general information not related to the overdose without the patient’s permission.

Another situation in which information may be shared without the patient’s permission is if the provider informs a person who is in a position to prevent or lessen a serious or imminent threat to the patient’s health or safety. OCR states “a doctor whose patient has overdosed on opioids is presumed to have complied with HIPAA if the doctor informs family, friends or caregivers of the opioid abuse after determining that the patient poses a serious and imminent threat to his or her health through continued abuse upon discharge.”

If a patient is not incapacitated and has decision-making capacity, a health care provider must give the patient an opportunity to agree or object to disclosure of health information with family, friends or others even if they are involved in that individual’s care or payment for care. The health care provider is not permitted to disclose health information about a patient who has the capacity to make his/her own health care decisions unless, as mentioned above, there is a serious or imminent threat of harm to the health of the individual.

The difference between capacity or incapacity can be a difficult determination for providers and may change during the course of treatment. OCR points out that decision-making incapacity may be temporary or situational and does not have to rise to the level where someone has been or must be appointed to act by law, i.e. power of attorney or guardianship. If during the course of treatment, the patient regains the ability to make decisions, the provider must give the patient the opportunity to object or agree to providing or sharing health information.

As has always been the case, HIPAA allows a health care provider to release or disclose information to a patient’s “Personal Representative.” HIPAA defines personal representative as a person who has health care decision-making authority under state law. In Alabama, a person holding general Durable Power of Attorney executed after 2012 is presumed to be the Personal Representative for purposes of HIPAA. Additionally, a parent of an unemancipated minor or someone holding a guardianship or conservatorship would also qualify.

To read OCR’s guidance, visit https://www.hhs.gov/sites/default/files/hipaa-opioid-crisis.pdf

Article contributed by Angie Cameron Smith, a partner at Burr & Forman LLP. Burr & Forman LLP is a partner with the Medical Association.