On October 27, 2017, the Department of Health and Human Services’ Office for Civil Rights (OCR) released guidance about the situations in which health care providers may share a patient’s health information with family members or friends when that patient may be in crisis and possibly incapacitated, such as during an opioid overdose. The guidance was issued the day after President Trump directed Acting HHS Secretary Eric Hargan to declare the opioid crisis a “public health emergency.”

In situations where there are no federal or state laws that provide more stringent privacy protections than HIPAA, health care professionals are permitted share health information without a patient’s consent to the following persons under the following two circumstances:

  • In the case of an unconscious or incapacitated patient, to family members or close friends involved in the patient’s care, if the professional determines that sharing the information is in the patient’s best interests and the information relates to the recipient’s involvement in the patient’s health care or payment for that care. For example, providers may exercise their professional judgment to discuss an opioid overdose and related medical information with the spouse of a person who is currently incapacitated by such an overdose. However, sharing additional health information without the patient’s consent would not be permitted.
  • Even when a patient has decision-making capacity, to people who are in a position to prevent or lessen what the provider believes is a serious and imminent threat to a patient’s health or safety. For example, a physician treating a patient who has overdosed on opioids may inform family, friends, or caregivers of the patient’s opioid use if the physician determines that the patient poses a serious and imminent threat to herself through continuing opioid use upon discharge.

However, where patients have decision-making capacity and a health care provider does not determine that the patient’s conduct poses a serious and imminent threat to the patient’s health or safety, the provider must first offer the patient an opportunity to agree or object to the sharing of health information before the provider may give information to the patient’s family, friends, or others.

The guidance emphasizes that the decision-making capacity of an individual who is under the influence of opioids or other substances will fluctuate. Health care providers must determine that a patient is unable to make health care decisions before sharing information with appropriate family members or friends under these circumstances. If the patient regains capacity during a hospital stay or patient encounter, the provider must obtain the patient’s permission before sharing any further health information—again, except in a case where the provider believes under the circumstances that sharing information with a family member or friend is indicated because the patient poses a serious and imminent threat to his or her health and the family member is in a position to prevent or lessen that threat.

Finally, the guidance notes that providers may share a patient’s health information with the patient’s personal representative to the same extent as the information may be shared with the patient. Thus, if a patient is an unemancipated minor or an incapacitated adult, a health care provider generally may share health information with the minor’s parent or guardian, or with the adult’s guardian or health care power of attorney, without restriction. An exception to this general rule would arise if applicable state or other federal law provides greater privacy protection for unemancipated minors or incapacitated adults under these circumstances.