View Rule

In an effort to address the opioid epidemic, the proposed rule would make a number of changes to provisions of the HIPAA Privacy Rule regarding uses and disclosures of protected health information to ease the burden on and potential risks to covered entities that may want to disclose PHI in such circumstances.

Statement of Need:

With over 60,000 individuals dying of opioid overdoses in 2016 and others suffering from addiction to the opiates, HHS issued a declaration of emergency to recognize a nationwide opioid epidemic.  HIPAA permits providers and other covered entities to disclose protected health information about an individual to families, caregivers and other relevant parties in circumstances related to opioid overdose and addiction.  Despite this permission and HHS guidance clarifying HIPAA, HHS continues to receive anecdotal evidence that providers and other covered entities are reluctant to share an opioid patient’s health information with family or other caregivers. 

This proposal seeks to encourage covered entities to share protected health information with family members, caregivers, and others in a position to avert threats of harm to health and safety when necessary to promote the health and recovery of those struggling with opioid addiction.

Summary of the Legal Basis:

OCR has broad authority under the HIPAA statute to make modifications to the Privacy Rule, within the statutory constraints of HIPAA, the HITECH Act, and other applicable law (e.g., the Administrative Procedures Act).

OCR, by delegation from the Secretary, has broad authority under HIPAA to make modifications to the Privacy Rule, as provided by section 264 of HIPAA (codified at 42 U.S.C. 1320d-2(note)).

Alternatives:

OCR may issue additional guidance as an alternative to the proposed rule.  However, HIPAA continues to be cited as a barrier to sharing protected health information in crisis situations, despite extensive existing guidance and outreach efforts.  Without regulatory changes, it is not clear that additional guidance would be effective in clarifying the ability to share protected health information in such situations.  Revising the Privacy Rule would be a more effective and permanent vehicle for achieving the desired policy, and would provide additional Good Samaritan safe harbor protections to health care providers who share protected health information when trying to help patients.

Anticipated Costs and Benefits:

The proposed rule will not create any new requirements or costs for regulated entities or the public. It will benefit patients and families by helping to ensure that family members and others involved in the patients’ care can get the information they need to help their loved ones obtain appropriate care and support.  It will also provide additional protections to health care providers exercising their professional judgment when making disclosures of protected health information to further the interests of patients.

Risks:

While we do not anticipate significant risks to privacy associated with this proposal, the NPRM requests public input on whether the impact of these amendments, taken together, could be expected to discourage individuals from seeking care based on concerns that their PHI may be disclosed against their wishes.