The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) recently released several new tools and guidance to ensure that patients and their family members can gain access to information needed to prevent and address opioid abuse and overdose, as well as mental health crises. The materials are focused on the Health Insurance Portability and Accountability Act (HIPAA) and also serve to fulfill certain clarification requirements on HIPAA and research under the 21st Century Cures Act (the “Cures Act”).  The Cures Act was passed by Congress in 2016 and requires, in part, that “health care providers, professionals, patients and their families, and others involved in mental [health] or substance use disorder treatment have adequate, accessible, and easily comprehensible resources relating to appropriate uses and disclosures of protected health information (PHI) under . . . [HIPAA].”

Opioid Crisis Related Actions

OCR recently updated two webpages,  with one  focused on a consumer audience and the other targeted at a  professional audience.

The consumer page alerts both consumers of mental health services, and parents and family members of children and adults with mental health conditions, as to (a) how HIPAA treats mental health information; (b) when mental health information may be shared with family and friends of an individual with a mental illness; and (c) the circumstances in which information relating to mental health conditions may be shared for health and safety purposes.  For instance, the consumer page informs families, and even friends in some cases, that they may access mental health information without a patient’s permission if a provider determines that allowing access is in the best interests of an incapacitated or unconscious patient.

• The professionals page clarifies when health care professionals are permitted to share protected health information (PHI) related to mental health conditions with parents and family members of patients under treatment.  Professionals may find updated guidance and answers to frequently asked questions related to the Privacy Rule on this page.

OCR has also provided new information and guidance materials related to sharing PHI in times of crisis. The new information includes fact sheets, an infographic, decision charts (including materials specifically tailored to the parents of children who have a mental health condition), and scenarios that address sharing information when an individual experiences an opioid overdose.

Research Related Actions

OCR also released updated guidance on HIPAA and research, as called for in the Cures Act. Specifically, OCR’s guidance relates to the HIPAA Privacy Rule, as well as the Common Rule (such guidance can be found here). These rules permit researchers to disclose PHI for research with or without an individual’s authorization, depending on the circumstances.

In addition, OCR announced that it is launching a working group to study and report on the uses and disclosures of PHI for research purposes. “The working group will include representatives from relevant federal agencies as well as researchers, patients, healthcare providers, and experts in healthcare privacy, security, and technology.” The working group is to release a report stating whether uses and disclosures of PHI for research purposes should be changed to better facilitate research while still protecting individuals’ privacy rights. This report is expected to be released in January of 2019.