When does HIPAA allow a doctor to notify an individual’s family, friends, or caregivers that a patient has overdosed?

Answer:

As explained more thoroughly below, when a patient has overdosed, a health care professional, such as a doctor, generally may notify the patient’s family, friends, or caregivers involved in the patient’s health care or payment for care if:

(1) the patient has the capacity to make health care decisions at the time of the disclosure, is given the opportunity to object, and does not object;

(2) the family, friends, or caregivers have been involved in the patient’s health care or payment for care and there has been no objection from the patient;

(3) the patient had the capacity to make health care decisions at the time the information is shared and the doctor can reasonably infer, based on the exercise of professional judgment, that the patient would not object;

(4) the patient is incapacitated and the health care professional determines, based on the exercise of professional judgment, that notification and disclosure of PHI is in the patient’s best interests;

(5) the patient is unavailable due to some emergency and the health care professional determines, based on the exercise of professional judgment, that notification and disclosure of PHI is in the patient’s best interests; or

(6) the notification is necessary to prevent a serious and imminent threat to the health or safety of the patient or others.

If the patient who has overdosed is incapacitated and unable to agree or object, a doctor may notify a family member, personal representative, or another person responsible for the individual’s care of the patient’s location, general condition, or death. See 45 CFR 164.510(b)(1)(ii). Similarly, HIPAA allows a doctor to share additional information with a patient’s family member, friend, or caregiver as long as the information shared is directly related to the person’s involvement in the patient's health care or payment for care. 45 CFR 164.510(b)(1)(i). Decision-making incapacity may be temporary or long-term. If a patient who has overdosed regains decision-making capacity, health providers must offer the patient the opportunity to agree or object to sharing their health information with involved family, friends, or caregivers before making any further disclosures. If a patient becomes unavailable due to some emergency, a health care professional may determine, based on the exercise of professional judgment, that notification and disclosure of PHI to someone previously involved in their care is in the patient’s best interests. For example, if a patient who is addicted to opioids misses important medical appointments without any explanation, a primary health care provider at a general practice may believe that there is an emergency related to the opioid addiction and under the circumstances, may use professional judgment to determine that it is in the patient’s best interests to reach out to emergency contacts, such as parents or family, and inform them of the situation. See 45 CFR 164.510(b)(3).

If the patient is deceased, a doctor may disclose information related to the family member’s, friend’s, or caregiver’s involvement with the patient’s care, unless doing so is inconsistent with any prior expressed preference of the patient that is known to the doctor. If the person who will receive notification is the patient's personal representative, that person has a right to request and obtain any information about the patient that the patient could obtain, including a complete medical record, under the HIPAA right of access. See 45 CFR 164.524.

When a patient poses a serious and imminent threat to his own or someone else’s health or safety, HIPAA permits a health care professional to share the necessary information about the patient with anyone who is in a position to prevent or lessen the threatened harm--including family, friends, and caregivers--without the patient’s permission. See 45 CFR 164.512(j). HIPAA expressly defers to the professional judgment of health care professionals when they make determinations about the nature and severity of the threat to health or safety. See 45 CFR 164.512(j)(4). Specifically, HIPAA presumes the health care professional is acting in good faith in making this determination, if the professional relies on his or her actual knowledge or on credible information from another person who has knowledge or authority. For example, a doctor whose patient has overdosed on opioids is presumed to have complied with HIPAA if, based on talking with or observing the patient, the doctor determines that the patient poses a serious and imminent threat to his or her own health. Even when HIPAA permits this disclosure, however, the disclosure must be consistent with applicable state law and standards of ethical conduct. HIPAA does not preempt any state law or professional ethics standards that would prevent a health care professional from sharing protected health information in the circumstances described here. For example, the doctor in this situation still may be subject to a state law that prohibits sharing information related to mental health or a substance use disorder without the patient’s consent in all circumstances, even if HIPAA would permit the disclosure.

For more information see OCR’s guidance, How HIPAA Allows Doctors to Respond to the Opioid Crisis, https://www.hhs.gov/sites/default/files/hipaa-opioid-crisis.pdf