Reprinted with Permission from the Medical Association of the State of Alabama

With an increased focus on opioid use and addiction, the Department of Health and Human Services ("HHS") Office of Civil Rights ("OCR") has issued guidance related to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") due to misunderstandings over when a healthcare provider can share an individual's protected health information ("PHI") in situations of overdose or need for emergency medical treatment related to opioid use. Generally speaking, HIPAA restricts a healthcare provider's ability to share PHI, but there are instances when a healthcare provider may disclose PHI even if the patient has not authorized the disclosure.

Many healthcare providers mistakenly think they must have an authorization or the patient's permission to release PHI. However, there are circumstances in which the patient's permission is not required. HIPAA allows a health care provider to share information with a patient's family or caregivers in certain emergency or dangerous situations. As outlined in the guidance, a provider may share information with family and close friends who are involved in the care of the patient if the provider determines that doing so in the best interest of an incapacitated or unconscious patient and the information shared is directly related to the family or friends involvement in the patient's healthcare or payment of care. OCR's guidance states that a provider may use his/her professional judgment to talk to the parents of someone incapacitated by an opioid overdose about the overdose and related medical information, but the provider could not share general information not related to the overdose without the patient's permission.

Another situation in which information may be shared without the patient's permission is if the provider informs a person who is in a position to prevent or lessen a serious or eminent threat to the patient's health or safety. OCR states "a doctor whose patient has overdosed on opioids is presumed to have complied with HIPAA if the doctor informs family, friends or caregivers of the opioid abuse after determining that the patient poses a serious and imminent threat to his or her health though continued abuse upon discharge."

Download the full article, "Office of Civil Rights Issues Guidance on HIPAA in Light of Opioid Crisis" written by Angie Cameron Smith.