New HIPAA guidance clarifies data sharing for mental health and substance abuse patients

HIPAA document
New guidance from OCR fleshes out situations in which HIPAA collides with mental health and substance abuse. (Getty/designer491)

New guidance issued by the Department of Health and Human Services offers some pointed clarifications about when HIPAA allows providers to share information about patients with a mental health condition or a substance abuse disorder.

The anticipated guidance (PDF), required under the 21st Century Cures Act, offers a framework for providers faced with the decision to share information with family and friends. In a Q&A format, the Office for Civil Rights (OCR) takes on specific scenarios that might involve the federal privacy law, including patients that are incapacitated or have stopped taking their medication and minors with a mental health condition.

The guidance was accompanied by several other resources, including two new HIPAA webpages focused on mental and behavioral health (one for consumers and one for providers). OCR also announced that it is collaborating with other HHS agencies to develop model training programs and launching a workgroup to study the use of protected health information for research purposes, also required under the Cures Act.

RELATED: Feds relax HIPAA rules so doctors can share information with family members of a patient who overdoses

Although the law has several strict privacy requirements—particularly when it comes to psychotherapy notes—in many cases, OCR leaves room for providers to make their own determination about when sharing information with friends or family would benefit the patient.

Some situations are clear—when a patient is unconscious or incapacitated, for example. But more opaque circumstances arise when a patient is suffering from temporary psychosis or under the influence of drugs or alcohol. Taking into account the patient’s prior expressed preferences, providers are allowed to share information with a family member if they believe it is in the patient’s best interest.

“In all cases, the health care provider may share or discuss only the information that the person involved needs to know about the patient’s care or payment for care,” the guidance states.

OCR adds that HIPAA “permits, but does not require, provider to disclose information in these situations,” and notes that patients should be given the opportunity to agree or object to future information sharing once they regain the capacity to make decisions on their own.

Likewise, in situations in which a patient with a mental illness has stopped taking prescribed medication, a provider may share certain information with a family member if they believe the patient does not have the capacity to agree or object, or if the patient poses a safety risk to themselves or others. Generally, providers are also permitted to share information with the parents of a child suffering from mental illness or substance abuse, although there are specific exemptions that prohibit that disclosure. 

Suggested Articles

Nearly 10,000 patients involved in research studies were impacted by a third-party privacy breach that may have exposed their medical diagnoses.

Employers looking to continue investing in their wellness programs are eyeing services targeting mental health and women’s health, a new survey shows.

Payers have made strides digitizing and automating many core processes, yet prior authorization remains a largely manual, cumbersome process.