OCR launches campaign on HIPAA and opioid patient data

HHS Office of Civil Rights (OCR) recently launched an education campaign about civil rights protections in response to the national opioid crisis, including specific guidelines for covered entities (CE) under HIPAA.

According to a OCR press release, the campaign’s goal is to improve access to evidence-based opioid use disorder treatment and therapeutic services by ensuring that CEs know their obligations under federal nondiscrimination laws, and to educate the public about HIPAA and disability rights protections that may apply to individuals in recovery from an opioid addiction. In the press release, OCR Director Roger Severino stated that bias and stereotypical beliefs about persons recovering from opioid addiction can create unlawful barriers to receiving health and social services.

OCR plans to issue materials to help educate the public about civil rights protections, which complement 2017 guidance on how HIPAA regulations allow healthcare providers to effectively respond the opioid crisis.

According to OCR guidance from 2017, HIPAA allows healthcare professionals to disclose patient health data without patient permission during certain situations that may occur in an opioid overdose, including:

• Disclosing information with family or friends involved in the patient’s care when doing so is in the best interests of the patient and they are unconscious or incapacitated (45 CFR §§ 164.510(b)(1)(i) and 164.510(b)(3))
• Informing persons who are in a position to prevent or lessen a serious or immanent threat to an individual’s health or safety (45 CFR § 164.512(j)(1)(i))

For opioid use disorder patients who have decision-making capacity, the provider is not permitted to share health information without patient agreement unless it is an emergency situation. However, HIPAA anticipates that decision-making capacity may change during the course of treatment, especially in cases of opioid use disorder. If a patient regains the capacity to make healthcare decisions, the provider must offer the patient the opportunity to agree or object to additional sharing of information (45 CFR § 164.510(b)(2)).

See www.hhs.gov/ocr/opioids for more information.