New guidance issued by the Department of Health and Human Services offers some pointed clarifications about when HIPAA allows providers to share information about patients with a mental health condition or a substance abuse disorder.
The anticipated guidance (PDF), required under the 21st Century Cures Act, offers a framework for providers faced with the decision to share information with family and friends. In a Q&A format, the Office for Civil Rights (OCR) takes on specific scenarios that might involve the federal privacy law, including patients that are incapacitated or have stopped taking their medication and minors with a mental health condition.
The guidance was accompanied by several other resources, including two new HIPAA webpages focused on mental and behavioral health (one for consumers and one for providers). OCR also announced that it is collaborating with other HHS agencies to develop model training programs and launching a workgroup to study the use of protected health information for research purposes, also required under the Cures Act.
Although the law has several strict privacy requirements—particularly when it comes to psychotherapy notes—in many cases, OCR leaves room for providers to make their own determination about when sharing information with friends or family would benefit the patient.
Some situations are clear—when a patient is unconscious or incapacitated, for example. But more opaque circumstances arise when a patient is suffering from temporary psychosis or under the influence of drugs or alcohol. Taking into account the patient’s prior expressed preferences, providers are allowed to share information with a family member if they believe it is in the patient’s best interest.
“In all cases, the health care provider may share or discuss only the information that the person involved needs to know about the patient’s care or payment for care,” the guidance states.
Please share w/ ER docs, ER nurses, and all clinicians and facilities who treat persons with with mental illness. New guidance from OCR helps debunk persistent myths about what (and when) information can be shared with family members and others. https://t.co/JNV3x5Mqza
— Deven McGraw (@HealthPrivacy) December 19, 2017
OCR adds that HIPAA “permits, but does not require, provider to disclose information in these situations,” and notes that patients should be given the opportunity to agree or object to future information sharing once they regain the capacity to make decisions on their own.
Likewise, in situations in which a patient with a mental illness has stopped taking prescribed medication, a provider may share certain information with a family member if they believe the patient does not have the capacity to agree or object, or if the patient poses a safety risk to themselves or others. Generally, providers are also permitted to share information with the parents of a child suffering from mental illness or substance abuse, although there are specific exemptions that prohibit that disclosure.