Health Information Compliance Alert

Update offers clarity on PHI disclosures in crisis situations.

Since the pandemic began, the feds have primarily focused on addressing COVID-19-related matters. In fresh HIPAA guidance, the HHS Office for Civil Rights (OCR) targets another critical concern: sharing the protected health information (PHI) of a patient in crisis.

Backtrack: On June 7, 2021, the Department of Justice (DOJ) issued model legislation on extreme risk protection orders (ERPOs), reminding states that court-ordered ERPOs stop people in crisis from buying firearms. “This model legislation provides a framework for states to consider as they determine whether and how to craft laws allowing law enforcement, concerned family members, or others to seek these orders and to intervene before warning signs turn into tragedy,” a DOJ release says.

Review the DOJ’s model legislation at www.justice.gov/doj/page/file/1401941/download.

Now: On Dec. 20, 2021, OCR issued HIPAA Privacy Rule guidance for covered healthcare providers that follows up on the DOJ release and offers insight on disclosing PHI “to support applications for extreme risk protection orders that temporarily prevent a person in crisis, who poses a danger to themselves or others, from accessing firearms,” notes a Department of Health and Human Services (HHS) release. Additionally, OCR’s latest update dispels previous confusion on PHI disclosures while offering ERPO-related implementation guidance that aligns with the DOJ policies.

“Too often, communities bear the weight of heartbreaking tragedies caused by the epidemic of gun violence in our country,” laments HHS Secretary Xavier Becerra in a release. “Today’s guidance on HIPAA and Extreme Risk Protection Orders is an important step the Biden-Harris Administration is taking towards protecting communities from gun violence by allowing law enforcement, concerned family members, or others to prevent a person in crisis from accessing firearms.”

Register This Breakdown of the New Guidance

OCR’s guidance looks specifically at the intersection of the HIPAA Privacy Rule, ERPOs, and the disclosure of patients’ PHI. Additionally, OCR asks and answers in detail whether a covered healthcare provider is authorized to share PHI after receiving an ERPO application for a patient. And the HIPAA Privacy Rule answer is, yes, but with stipulations.

Here’s a short list of the facts that covered healthcare providers need to know:

Required by law: When you are subpoenaed, ordered by the court, or mandated under a statute to release that patient’s files, then you may disclose the PHI to support the ERPO application.

Response to judicial proceedings: This is similar to the law requirement, but OCR’s wording is a little tricky. You may release PHI “when the disclosure is in response to an order of a court or administrative tribunal, subpoena, discovery request, or other lawful process in the course of a judicial or administrative proceeding,” the OCR says. But, “the Privacy Rule places conditions on disclosures for these purposes, including when such disclosures are required by other laws,” the agency adds.

OCR offers specific examples, which take into account important foundational elements of the HIPAA Privacy Rule. Topics covered and that must be considered in reference to the ERPO application include: the minimum necessary standard; sharing of psychotherapy notes; rules on imminent threats to human life; good faith disclosures; and other federal privacy laws like the Family Educational Rights and Privacy Act (FERPA).

Remember: OCR does remind covered healthcare providers that ERPO laws vary by state, too. So, before implementing any HIPAA compliance changes, you should first address your particular state’s regulations.

“HIPAA should not be a barrier to communication for law enforcement, concerned family members, health care providers, and others when they see an individual in crisis,” says OCR Director Lisa J. Pino in a release. “Today’s guidance helps clarify legal requirements and to better support individuals in crisis.”

Resources: Find the HHS release at www.hhs.gov/about/news/2021/12/20/hhs-issues-guidance-on-hipaa-disclosures-protected-health-information-extreme-risk-protection-orders.html, read the DOJ release at www.justice.gov/doj/reducing-gun-violence/commentary-extreme-risk-protection-order-model-legislation, and review the HIPAA Privacy Rule guidance at www.hhs.gov/hipaa/for-professionals/privacy/guidance/extreme-risk-protection-orders/index.html.