Amidst exigent concerns and challenges resulting out of the opioid epidemic, physicians may ask: Under what circumstance can they disclose an individual’s protected health information (PHI) to family, loved ones, or others, without the patient’s authorization, according to HIPAA’s Privacy Rule?
The Office for Civil Rights for the Department of Health and Human Services, which is charged with enforcing HIPAA’s Privacy Rule, issued a bulletin to answer these questions as to what a physician can and cannot disclose under varying circumstances.
Specifically, according to the bulletin, a physician may share (disclose and receive for use) PHI with an individual’s family, personal representative, or close friends involved in that individual’s care, if the physician determines that doing so is in the best medical interests of the individual who is unconscious or incapacitated because of opioid overdose. A physician, for example, may inquire about related medical information regarding the overdosed individual, who usually (but not necessarily) is seen in the Emergency Department.
Joseph J. Feltes, JD
HIPAA recognizes the general right of an individual, with capacity, to control the use and disclosure of his or her PHI by authorizing to whom the physician may or may not share PHI. The Privacy Rule, however, recognizes situations in which an individual is legally or otherwise incapable of exercising his or her right to control disclosure of PHI. When the individual lacks capacity, because he or she is an un-emancipated minor, is unconscious, or has impaired decision-making capacity, HIPAA permits parents, family members, or other “personal representatives,” who include guardians, those named under a power of attorney, and even friends involved in assisting the individual with treatment and payment decisions, to step into the individual’s shoes, allowing them to share medical information with the physician and make treatment decisions related to the overdose.
The Office for Civil Rights further recognizes the ability of a physician to share an individual’s PHI with persons, who are in a position to prevent or lessen a serious and imminent threat to that individual’s health and safety, without the individual’s authorization. For example, a physician who treats an individual that has overdosed on opioids may inform the individual’s family and personal representatives of the overdose, after determining that the individual poses a serious and imminent threat to his or her health and safety through continued opioid abuse, and that informing such persons may alleviate that threat.
But, there are limits. If the individual, in fact, has decision-making capacity, a physician must offer that individual the opportunity to agree or object to sharing his or her PHI with family or personal representatives. The physician, under such circumstances, must honor the individual’s decision by not sharing PHI, unless the physician reasonably determines that not sharing information would result in a serious and imminent threat of harm to that individual.
The bulletin recognizes situations in which an individual’s decision-making capacity is temporary and situational, such as when an individual initially presents at the Emergency Department intoxicated, unconscious, or otherwise unable to make meaningful decisions. Under such circumstances, a physician may decide to disclose the patient’s PHI with family or personal representatives, if indicated, or wait until the patient regains decision-making capacity before sharing information.
The bulletin helps establish boundaries, but is not all-inclusive and cannot address every situation in which a physician may find himself or herself. Physicians, however, may take comfort in knowing that it is highly unlikely that they would be found to violate HIPAA’s Privacy Rule for sharing information of an individual who is unconscious because of opioid overdose with that patient’s family or personal representative in order to treat the overdose or reduce the likelihood of serious and imminent harm to that individual’s health or safety.
Joe Feltes is an attorney with Buckingham, Doolittle & Burroughs in Canton OH and a member of its Health & Medicine Practice Group. He is also the managing partner of Buckingham Canton. For more information about the law firm, go to www.BDBLAW.com or email Mr. Feltes at Jfeltes@BDBLAW.com.