With the ever-growing opioid crisis and the President’s call to action to address that crisis, primary care, pain management and behavioral health providers in particular may be faced with privacy issues dealing with a patient’s family, friends or others in relation to treatment for opioid abuse.  What can a provider disclose to others in the aftermath of an overdose in order to assist a patient’s recovery efforts and prevent future incidents?  What information can a provider share about a patient’s condition and treatment in such a situation?

The Health Insurance Portability and Accountability Act (“HIPAA”) prohibits disclosure of a person’s protected health information (“PHI”) to family members, friends or others involved in the patient’s care (or payment for care) without patient consent except for certain defined situations.

In the event an individual is disoriented, unconscious or otherwise incapacitated, a medical provider may provide information to others without the patient’s permission so long as sharing that information is: (1) in the best interest of the patient; and (2) the information shared is directly related to the patient’s care.  Thus, a provider may exercise his or her judgment to advise family or others that an opioid overdose occurred, describe the patient’s condition and how the patient is being treated as a result.

However, when a patient possesses decision making capacity, a provider may only share information without the patient’s consent if sharing that information is for the purpose of avoiding or lessening an imminent threat to the patient’s health or safety. Put another way, a provider may disclose information about the patient’s opioid use or abuse to someone who the provider has a good faith basis to believe could reasonably lessen or prevent further harm from continued opioid use or abuse following the patient’s discharge.  For example, a provider may share information with others in order to help prevent a future overdose, decrease ongoing dependence, or to assist in seeking treatment.  Other appropriate discussions potentially include alternate treatment for pain management, efforts to break an addictive cycle, explanation and treatment of withdrawal symptoms and relapse prevention strategies.  In contrast, a provider should avoid disclosing information about a patient’s history of substance abuse to a family member who the patient may live with but has no involvement in the patient’s care or treatment.

A patient’s decision making capacity is not static and may change during the course of care.  For example, a patient may present to an emergency room in an unconscious or altered state such that at the time of admission, the patient lacks sufficient capacity to consent to sharing PHI.  Nonetheless, sometime later, the patient may recover sufficiently to be alert enough to make informed decisions.  During the initial period of incapacity, a provider may share information with family or others related to the patient’s condition or care without the patient’s consent following the guidance discussed above.  Later, after a patient recovers, a provider may share information in order to prevent a future overdose even if the patient does not consent so long as the provider believes disclosure is in the patient’s best interest and the information shared is related to that person’s involvement in the patient’s health care.

Easier to address are situations involving powers of attorney or patient advocate designations involving express authorization to disclose PHI to a particular individual.  Such documentation allows a provider to disclose information without fear of violating HIPAA.  In addition, parents of minor children are generally considered authorized personal representatives who are entitled to obtain information about a child’s health care.

Also important to consider are state and federal guidelines on confidentiality or rules of medical ethics that would preclude disclosure of a patient’s PHI.

In conclusion, before a nurse, physician or even billing administrator discloses PHI regarding a patient’s opioid use or dependence, care must be taken to comply with HIPAA in the manner discussed above.