The guidance illustrates how PHI may be shared without the patient's consent in an opioid crisis, but the prevailing HIPAA rules permit disclosure of PHI any time the criteria noted below are satisfied. Specifically, providers may share PHI:

• with a patient's family and close friends when doing so is in the best interests of an incapacitated or unconscious patient; and
• when doing so would prevent or diminish a serious and imminent threat to the patient's health and safety.

Thus, for example, a provider can share information related to a patient's opioid overdose if the patient is incapacitated or unconscious as result of such overdose, or if sharing the information would mitigate a pending threat to the patient. OCR cautions that only medical information related to the patient's opioid overdose may be shared and any other information unrelated to the overdose should not be communicated with the patient's family or close friends. The health care provider also can inform a patient's family or caregiver of an overdose if the provider makes a reasonable assessment that a patient will continue to harm him- or herself through continued opioid use upon release from the hospital or facility. If a patient with capacity can object to his or her PHI being shared with family members, close friends or legal representative, providers may nevertheless disclose the information if they believe the patient's health or safety is at risk with continued opioid abuse.

OCR recognizes and HIPAA anticipates that a patient's decision-making capacity during an opioid intoxication may be temporary or change during the course of treatment. OCR provides an example of a patient who, admitted to the ER while unconscious, may be unable to articulate his or her desire for the course of treatment. It is at the discretion of the patient's health care providers to determine the type of PHI and how much should be shared with that patient's family or close friends who are involved with the patient's treatment or payment for care. If and when the patient regains capacity, the patient has the right to object to PHI being further shared. However, as mentioned previously, a provider can nonetheless share PHI if there is an assessment that the patient poses an imminent health and safety risk for future opioid abuse.

The guidance does not address any state or other federal laws that may apply to disclosures of health information, including rules governing confidentiality of substance use disorder records located at 42 CFR Part 2 ("Part 2"). Part 2 applies to all patient substance use records in a Part 2 program regulated or assisted by the federal government. This means any provider or facility providing or holding itself out as providing substance use disorder services must adhere to Part 2 confidentiality record requirements. Part 2 does not apply to ER personnel who refer a patient to the intensive care unit for an apparent overdose, unless the primary function of such personnel is the provision of substance use disorder diagnosis, treatment or referral for treatment and they are identified as providing such services or the ER has promoted itself to the community as a provider of such services.

Part 2 regulations are more stringent in many respects than HIPAA. As a general rule, disclosure of substance use records is prohibited unless the patient has consented in writing or the disclosure falls within a Part 2 exception. The requirement for authorization applies even for treatment, payment and health care operations disclosures, which are permissible without patient authorization under HIPAA. That being said, it is permissible under Part 2 for providers to disclose information without patient consent during an emergency situation. If a provider subject to the Part 2 regulations believes there is an immediate threat to the health and safety of any individual (i.e., patient or general public), the rule allows:

• notifications to medical personnel addressing a medical emergency (i.e., a situation that poses an immediate threat to the health of any individual and requires immediate medical intervention);
• notifications to law enforcement for a crime on program premises or against program personnel;
• reports of child abuse and neglect;
• court-ordered disclosures; and
• notification to law enforcement of immediate threats to health or safety that do not involve medical emergencies or crimes so long as patient-identifying information is not disclosed.

The rule does not permit disclosures to family, close friends or legal representatives in an emergency situation. Disclosures can be made only according to the examples provided above. If disclosure is made due to a medical emergency, then the Part 2 program must document the disclosure by recording:

• patient's name;
• recipient of information;
• name of individual making the disclosure;
• date and time of disclosure; and
• nature of emergency.

Health care providers operating within a Part 2 program need to be mindful of these disclosure requirements when working with patients affected by the opioid crisis. In addition, applicable state laws should also be considered as some may impose more stringent privacy regulations than HIPAA or Part 2.

Reviewed by: Tracy E. Weir