What constitutes a “serious and imminent” threat that would permit a health care provider to disclose PHI to prevent harm to the patient, another person, or the public without the patient’s authorization or permission?

Answer:

HIPAA expressly defers to the professional judgment of health professionals in making determinations about the nature and severity of the threat to health or safety posed by a patient. OCR would not second guess a health professional’s good faith belief that a patient poses a serious and imminent threat to the health or safety of the patient or others and that the situation requires the disclosure of patient information to prevent or lessen the threat. Health care providers may disclose the necessary protected health information to anyone who is in a position to prevent or lessen the threatened harm, including family, friends, caregivers, and law enforcement, without a patient’s permission.

See Guidance on Sharing Information Related to Mental Health, https://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html