This article originally appeared in the August 2018 issue of the Employee Relations Law Journal.
The opioid crisis in our country has left parents and other family members frantically seeking health information about loved ones in the grips of addiction and health care providers searching for ways to improve the outcomes for treatment of addicted patients.
To address the crisis, the Department of Health and Human Services (HHS) has provided information to help health care providers, families and friends of individuals suffering from opioid addiction understand the extent to which protected health information (PHI) can be shared without violating the Health Insurance Portability and Accountability Act (HIPAA).
The following are seven facts regarding HIPAA and opioid addiction that may help employers and employees cope with this crisis.
1. A parent’s right to receive PHI regarding his or her child’s opioid addiction changes over time.
The extent to which a health provider can share PHI about opioid addiction depends on a number of factors, including the age of the child and whether the parent is involved with the child’s health care treatment or payment for such care.
Generally, if a parent is the personal representative of a child, health care providers must share PHI regarding the child’s treatment for opioid addiction. HIPAA defines a personal representative as an individual that is permitted under applicable law to act on behalf of a patient in making decisions relating to heath care. [45 CFR §164.502(g)(1)] The determination of whether a parent is a child’s personal representative changes once the child reaches the age of majority.
Minor child
In most cases, a parent is considered the “personal representative” of a minor child and a health care provider must share PHI with respect to the minor child’s opioid addiction. A minor child is defined under state law. However, a health care provider can decide not to treat a parent as a personal representative if the provider has concerns that doing so might put a minor child’s safety at risk. [45 CFR §164.502(g)(5)] For example, if a provider has a reasonable belief that a child has been subjected to domestic violence, abuse or neglect, it may determine that it is not in the best interest of the child to treat the parent as the child’s personal representative.
In addition, a parent will not be a minor child’s personal representative in the following situations:
- The child consented to a health care service, no other consent is required by law and the child has not requested that the parent be treated as his or her personal representative;
- State law allows a minor to obtain a health care service without the consent of a parent; or
- A parent has agreed that the child’s information will be kept confidential from the parent. [45 CFR §164.502(g)(3)]
Based on the above, a parent should check state law to determine the age of majority , types of health care that a minor child can receive without parental consent, and the extent to which state law permits or requires parents to have access to health information about their minor children.
Adult child
Once a child has attained the age of majority under applicable state law, the child exercises his or her own rights with respect to the disclosure of PHI. A parent will serve as an adult child’s personal representative only if, under applicable law, the parent has authority to act on behalf of the adult child. For example, a parent may be named by the child in a health care power of attorney.
If a parent is not an adult child’s personal representative, a health care provider may share PHI to the extent the parent is involved in the adult child’s health care or payment for care and one of three circumstances applies:
- The adult child agrees to such disclosure
- The health care provider provides the adult child with the opportunity to object to the disclosure and the child does not object;
- The health care provider reasonably infers, based on his or her professional judgement, that the adult child does not object to the disclosure, e.g., the patient invites a parent into a treatment room. [45 CFR §164.510(b)(2)]
2. HIPAA permits health care providers to disclose PHI relating to opioid addiction to family and friends in certain emergency or dangerous situations without a patient’s permission.
Even if HIPAA rules and regulations do not otherwise permit disclosure of a patient’s PHI, there are two scenarios in which a health care provider can disclose PHI regarding opioid addiction without the permission of a patient.
First, a health care provider can disclose PHI to family and friends if they are involved in the health care of the patient or payment for such care, the patient is incapacitated or unconscious, and the provider determines that it is in the best interests of the patient to do so. [45 CRF §164.510(b)(3)] The PHI that is disclosed must be directly related to the family or friend’s involvement with the patient’s health care or payment of care.
Second, a health care provider is permitted to disclose PHI without the permission of the patient if necessary to prevent or lessen a serious and imminent threat to a patient’s health or safety or that of the public. For example, if a patient has overdosed on opioids and the doctor determines that the patient poses a serious and imminent threat to his or her health through continued opioid abuse, disclosure might be warranted.
3. Health care providers must also comply with state law privacy requirements and professional ethical standards before disclosing PHI to prevent or lessen a serious and imminent threat of safety.
The HIPAA regulations require that a disclosure to prevent or lessen a serious and imminent threat to the health or safety of a patient or the public must also be consistent with other applicable laws and ethical standards. If a state’s privacy law or medical ethics rules are more restrictive regarding disclosure of health information, then HIPAA requires compliance with the more restrictive state law or ethics rules. [45 CFR §164.512(j)(1)] Therefore, it is important to take into account state and other applicable privacy laws and rules to understand fully the rights of family and friends to obtain PHI.
4. The HHS website describes when a health care provider may notify family or friends that a patient has overdosed due to opioid abuse.
Based on the HIPAA regulations, HHS has identified the following circumstances in which a health care provider may notify family or friends involved in the patient’s health care or payment for care that a patient has overdosed:
- At the time of the disclosure, the patient is given the opportunity to object and does not object;
- The family or friends have been involved with the patient’s health care or payment for care and there has been no objection from the patient;
- At the time of the disclosure, the patient has the capacity to make health care decisions and the health care provider can reasonably infer, based on professional judgment, that the patient would not object;
- The patient is incapacitated, or unavailable due to some emergency, and the health care profession determines, based on professional judgment, that disclosure is in the patient’s best interests; or
- Notification is necessary to prevent a serious and imminent threat to the health or safety of the patient or others.
A patient’s personal representative always has the right to such information.
5. The HHS website describes when a health care provider may notify family or friends if a patient has died from an opioid overdose.
Based on the HIPAA regulations, HHS has stated that a health care provider may disclose a patient’s death to family or friends involved with the patient’s care unless such disclosure is inconsistent with prior instructions of the patient.
A patient’s personal representative always has the right to such information.
6. Psychotherapy notes cannot be disclosed to family or friends without a patient’s consent.
Generally, HIPAA requires a patient’s consent before a mental health profession can share psychotherapy notes with family or friends. [45 CFR §164.508(a)(2)] There are exceptions for disclosures required by law or mandatory “duty to warn” situations regarding threats of serious and imminent harm made by a patient.
Psychotherapy notes are notes recorded by a mental health professional in the course of a counseling session, whether individual or joint, and that are separate from a patient’s medical record. [45 CFR §164.501] Psychotherapy notes do not include information about prescriptions, frequency and modalities of treatment, results of clinical tests or information that is included in a patient’s medical record.
7. HHS has made available helpful information about the extent to which HIPAA allows PHI to be shared in the case of opioid addiction.
HHS has posted information for health care providers, family and friends regarding the application of the HIPAA rules and regulations to individuals suffering from opioid addiction: Information Related to Mental and Behavioral Health, including Opioid Overdose.
Conclusion
In many cases, parents, other family members, and friends will not be personal representatives with the right to all PHI of the loved one suffering from opioid addiction. However, family and friends may be granted limited and timely access to the health information to the extent they (i) are able to be involved in the health care or payment for care of the person suffering from opioid addiction, and (ii) communicate to health care providers their status as persons involved with the person’s health care or payment for care before an urgent situation arises.
Lori Jones is the chair of Thompson Coburn’s Employee Benefits practice.