Home Health & Hospice Week

'Crisis situations' can preclude HIPAA violations, HHS suggests.

Not sure what your agency needs to do regarding information-sharing when opioid abuse is impacting one of your patients? A new update from HHS can help guide you.

Background: About 140 individuals die daily of drug overdoses in the United States, and of that large amount, around 91 are attributed to opioid abuse, according to a Department of Health and Human Services release on statistics from the Centers for Disease Control and Prevention. In the wake of the mounting opioid-induced death toll, President Trump declared the opioid epidemic a Public Health Emergency (PHE), "mobilizing his entire administration to address drug addiction and opioid abuse," a White House release stated.

Interesting: The crisis and research on the epidemic link the subsequent problems to a significant rise in the prescription and sale of opioids despite no "overall change in the amount of pain Americans report[ed]" between 1999 and 2014, said a CDC report.

How Does The PHE Impact HIPAA?

After the presidential declaration, the HHS Office for Civil Rights joined with other federal agencies, offering up new guidance on "how healthcare providers can share a patient's health information with his or her family members, friends, and legal personal representatives when that patient may be in crisis and incapacitated, such as during an opioid overdose," said an OCR release on the PHE.

What's new: In response to the declaration, OCR didn't change HIPAA but merely clarified the language, reminding providers that they have the "broad ability to share health information with patients' family members during certain crisis situations without violating HIPAA privacy regulations," suggested a new OCR fact sheet on how opioid addiction influences HIPAA compliance.

"Actually, the rules on information-sharing with family and friends have not changed, and OCR's announcement is only a notice that the rules are in place and can help in the opioid crisis," explains Jim Sheldon-Dean, principal and director of compliance services at Lewis Creek Systems in Charlotte, Vermont. "It should clarify things for providers a little, but in many cases the limiting factor with substance abuse treatment is the rules under 42 CFR Part 2, which are much more restrictive than HIPAA."

Sheldon-Dean adds, "I think OCR's announcement is an effort to defuse the 'let's blame HIPAA' attitude that goes along with any information exchange issues, when HIPAAis not the issue at all in this case, for the most part."

Some providers confused about information-sharing think that HIPAA inhibits the special care needed to treat patients suffering from addiction, but the new federal dialogue reminds clinicians that there are avenues available to ensure families are involved and can be part of the recovery.

"We know that support from family members and friends is key to helping people struggling with opioid addiction, but their loved ones can't help if they aren't informed of the problem," said OCR Director Roger Severino in a statement on HIPAA and the PHE. "Our clarifying guidance will give medical professionals increased confidence in their ability to cooperate with friends and family members to help save lives."

Some Providers Must Follow SAMHSA

"The current HIPAArules, in place for years, clearly allow communication with family and friends so long as the individual does not object, and that has not changed," maintains Sheldon-Dean. "The rules are designed to allow just this kind of common sense sharing of information for purposes of helping others care for an individual in need of help."

Warning: But before you share protected health information (PHI) about your patient's opioid-abuse treatment, check the facts to ensure you're not breaking more serious federal mandates.

"At facilities that provide substance abuse and mental health treatment under SAMHSA [Substance Abuse and Mental Health Service Administration], there should be no change in the rules on sharing information with family and friends," says Sheldon-Dean. "This may be an issue if those facilities rely only on the HIPAA guidance and neglect to follow the stricter SAMHSA rules."

He adds, "At facilities that are not under SAMHSA, this will help providers understand how they can involve family and friends with treatment, and that is clearly helpful."

Reminder: More stringent federal restrictions fall under the Confidentiality of Substance Use Disorder Patient Records, 42 Code of Federal Regulation (CFR) Part 2 and concern specifically patients' privacy when they seek help for substance abuse from a federally funded organization, suggested the SAMHSA website. In a final rule out last March, the government "modernized" the language and updated the regulation to include "new healthcare models" and "reduce unnecessary burden," SAMHSA said.

Read the updated SAMHSA guidance at: www.samhsa.gov/health-information-technology/laws-regulations-guidelines.

As the government continues to roll back restrictions and decrease administrative burdens, the jury is out on whether the reduction of regulations will lead to a less secure healthcare system.

"If there's a loosening of standards, it could reduce breaches related to a standard, even though privacy may have been eroded," Sheldon-Dean says. "We have a lot to learn about where we are going in terms of societal acceptance of reduced privacy."

Note: For a closer look at the OCR's take on information-sharing under the opioid crisis Public Health Emergency declaration, visit www.hhs.gov/sites/default/files/hipaa-opioid-crisis.pdf.