Feds give rules on HIPAA when sharing opioid patient data

The HHS Office for Civil Rights is offering guidance to physicians on preserving civil rights protections in cases of opioid abuse.

The intent is to enable clinicians to share data and information without an opioid patient’s permission.

“Persons getting help for an opioid use disorder are protected by our civil right laws throughout their treatment and recovery,” says Roger Severino, the director at OCR. “Discrimination, bias and stereotypical beliefs about persons recovering from an opioid addiction can lead to unnecessary and unlawful barriers to health and social services that are key to addressing the opioid crisis.”

At the same time, however, physicians need help understanding what health information they can share with a patient’s loved ones in emergencies, without violating HIPAA regulations.

For example, information can be shared to family and close friends by a provider involved in caring for an incapacitated or unconscious patient if information is shared with loved ones involved in the patient’s healthcare or payment of care, and the provider believes sharing information is in the best interests of the patient.



A physician also can talk to parents of a person incapacitated by an opioid overdose about the drug incident and related medical information, but generally may not share medical information unrelated to the overdose without patient permission.

Also See: EHR tool to assess patient risks for opioid abuse

In a more urgent example, according to HHS, a physician can inform loved ones that based on facts the patient poses an imminent threat to his or her health by continuing use of opioids following discharge from treatment.

When patients are able to make their own decisions, the physician must allow the patient to agree or disagree with sharing health information with loved ones. In general, the physician cannot share information about a patient who currently can make decisions and objects to sharing information unless there is a serious and imminent threat of harm.

Because patient decision making capability will change over time, HHS advises that decision-making incapacity may be temporary and situational, so it does not have to rise to a level where another decisionmaker has been or will be appointed by law. If the patient regains the capacity to make healthcare decisions, the provider must give the patient an opportunity to agree or disagree before the provider shares additional information.

However, even if the patient’s capacity returns and the patient rejects further sharing, a provider still could share information to prevent or lesson a serious and imminent threat to health or safety.

In general, HIPAA enables a patient’s person representative to request and get any information about the patient that the patient could obtain, including a complete medical record. Personal representatives have healthcare decision making authority for the patient under state law. More information is available here.