New HIPAA Guidance for Substance Abuse and Mental Health Information

By: Dave Davidson

In December 2016, the US Congress passed the 21st Century Cures Act, which, among other things, provided for increased funding for treatment and research of mental health and substance abuse disorders.  That law also required the HHS Office of Civil Rights (OCR) to provide guidance in regards to HIPAA compliance in regards to those types of treatment.  In October 2017, President Donald Trump declared the opioid addiction epidemic to be a public health emergency, which will also result in additional resources being allocated to addressing the crisis.

In connection with both the new law and the President’s declaration, OCR published its HIPAA guidance in December 2017.  The guidance is intended to clarify how and when protected health information (PHI) can be shared in regards to patients in substance abuse and mental health treatment.  According to OCR Director Roger Severino, “HHS is using every tool at its disposal to help communities devastated by opioids, including educating families and doctors on how they can share information to help save the lives of loved ones.”

There are several key provisions to the guidance.  The first is OCR’s development of two webpages, one for consumers and one for providers, where treatment-related HIPAA guidance can be found.  The consumer site is located at https://www.hhs.gov/hipaa/for-individuals/mental-health/index.html; and the provider site at https://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html.  According to HHS, these sites are intended to be a “one-stop resource” for HIPAA-related guidance and materials.

OCR also released a summary document entitled “How HIPAA Allows Doctors to respond to the Opioid Crisis.”  This summary provides guidance to providers under several common scenarios.  These are detailed as follows:

1. Patients without Capacity If a patient is incapacitated or unconscious, a provider can share PHI with the patient’s family and close friends if: those individuals are involved in the care of the patient; the provider determines the release of the PHI to those individuals is in the best interests of the patient; and the PHI is directly related to the role those individuals play in regards to the patient (or for payment for the services).  OCR gives the example of a provider sharing PHI concerning an opioid overdose with the parents of an incapacitated patient, noting that medical information not related to the overdose cannot be shared.
2. Patients with Capacity The summary recognizes the right of patients who have capacity to control who receives their PHI.  However, OCR has created a narrow exception to this right.  If a health care provider determines that there is a serious and imminent threat to a patient’s health or safety and the provider has a good faith belief that a specific individual is in a position to prevent or lessen that threat, the provider may share PHI with that individual.  According to OCR, the policy behind this guidance is to allow PHI to be shared with individuals who can prevent harm during times when the patient is not in a hospital or under fully-supervised treatment.
3. Patients Regaining Capacity OCR recognizes that a patient may initially present to a provider in an incapacitated state, but subsequently regain capacity.  In that case, OCR states that disclosure of PHI to family and close friends of the patient may be disclosed as outlined in paragraph 1, above, while the patient is incapacitated.  However, once the patient regains capacity, he or she has the right to prohibit disclosure of PHI, absent the presence of a serious and imminent threat of harm, as identified in paragraph 2, above.

OCR notes that none of the guidance is intended to remove the right of individual autonomy from any patient.  Providers must still give patients the opportunity to direct how PHI is shared, and absent a serious and imminent threat, a patient has the absolute right to deny the release of PHI outside the team of healthcare professionals.

The December 2017 guidance, the development of the webpages, and the on-going collaborative efforts within HHS and OCR will hopefully assist providers in protecting the confidentiality of a patient’s PHI, while allowing limited disclosure to family and friends who are in a position to help patients through the recovery process.  Additional guidance and programs can be expected to come as a result of the new law and presidential declaration.  Hopefully future efforts will remain as clear.