The Office for Civil Rights at the Department of Health and Human Services (HHS) released new HIPAA guidance explaining how healthcare providers have broad ability to share health information with a patient’s family members without the patient’s permission during certain crisis situations, without violating HIPAA privacy regulations. Permissible scenarios include:
- Sharing health information with family and close friends who are involved in the patient’s care if the provider determines that doing so is in the best interests of an incapacitated or unconscious patient and the information shared is directly related to the family or friend’s involvement in the patient’s health care or payment of care. [See 45 CFR §§ 164.510(b)(1)(i) and 164.510(b)(3)]
- Informing persons in a position to prevent or lessen a serious and imminent threat to a patient’s health or safety. [See 45 CFR § 164.512(j)(1)(i)]
The guidance states that these are limited exceptions to the HIPAA requirement for patient authorization and do not apply to protected health information that is unrelated to the overdose, or when the patient has decision-making capacity.
Lastly, HHS notes that if the provider’s state law is more restrictive on the communication of health information, the provider must abide by the more restrictive law.