HIPAA, the Opioid Crisis and the Role of Part 2

Updated as of December 2018

With the ever-growing opioid crisis and the President’s call to action to address that crisis particularly through the signing of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act or the SUPPORT for Patients and Communities Act, P.L. 115-271 in October, 2018 , primary care, pain management and behavioral health providers in particular may be faced with privacy issues dealing with a patient’s family, friends or others in relation to treatment for opioid abuse. What can a provider disclose to others in the aftermath of an overdose in order to assist a patient’s recovery efforts and prevent future incidents? What information can a provider share about a patient’s condition and treatment in such a situation?

The discussion in this article highlights the tale of two federal laws addressing patient confidentiality each of which has vastly different policy considerations behind it. One law is an attempt to promote the free exchange of certain patient information in order in improve access to information among persons with a need to know and the streamline health care delivery while the other is an attempt to insulate the free exchange of certain substance use information in an effort to encourage treatment and recovery. These diametrically opposed policy purposes presents many legal quagmires for health care professionals and family members looking to “just do what is right for the patient.”

The Health Insurance Portability and Accountability Act (“HIPAA”) prohibits disclosure of a person1s protected health information (“PHI”) to family members, friends or others involved in the patient’s care (or payment for care) without patient consent except for certain defined situations.

In the event an individual is disoriented, unconscious or otherwise incapacitated, a medical provider may provide information to others without the patient’s permission so long as sharing that information is: (1) in the best interest of the patient; and (2) the information shared is directly related to the patient’s care. Thus, a provider may exercise his or her judgment to advise family or others that an opioid overdose occurred, describe the patient’s condition and how the patient is being treated as a result.

However, when a patient possesses decision making capacity, a provider may only share information without the patient’s consent if sharing that information is for the purpose of avoiding or lessening an imminent threat to the patient’s health or safety. Put another way, a provider may disclose information about the patient’s opioid use or abuse to someone who the provider has a good faith basis to believe could reasonably lessen or prevent further harm from continued opioid use or abuse following the patient’s discharge. For example, a provider may share information with others in order to help prevent a future overdose, decrease ongoing dependence, or to assist in seeking treatment. Other appropriate discussions potentially include alternate treatment for pain management, efforts to break an addictive cycle, explanation and treatment of withdrawal symptoms and relapse prevention strategies. In contrast, a provider should avoid disclosing information about a patient’s history of substance abuse to a family member who the patient may live with but has no involvement in the patient’s care or treatment.

A patient’s decision making capacity is not static and may change during the course of care. For example, a patient may present to an emergency room in an unconscious or altered state such that at the time of admission, the patient lacks sufficient capacity to consent to sharing PHI. Nonetheless, sometime later, the patient may recover sufficiently to be alert enough to make informed decisions. During the initial period of incapacity, a provider may share information with family or others related to the patient’s condition or care without the patient’s consent following the guidance discussed above. Later, after a patient recovers, a provider may share information in order to prevent a future overdose even if the patient does not consent so long as the provider believes disclosure is in the patient’s best interest and the information shared is related to that person’s involvement in the patient’s health care.

Easier to address are situations involving powers of attorney or patient advocate designations involving express authorization to disclose PHI to a particular individual. Such documentation allows a provider to disclose information without fear of violating HIPAA. In addition, parents of minor children are generally considered authorized personal representatives who are entitled to obtain information about a child’s health care.

In stark contrast to the provisions of HIPAA which exist to facilitate the exchange of information for the purpose of treatment, payment or health care operations, a Federal Statute and set of Federal Regulations commonly and collectively referred to as “Part 2” (42 CFR Part 2) exist in order to protect “records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research.” Such a strong confidentiality provision was enacted in order to encourage those needing treatment to seek it under a near absolute cloak of confidentiality. Unlike HIPAA, Part 2 does not permit the release of information covered by it to anyone other than medical personnel in the event of a medical emergency or as ordered by a court upon the showing of good cause.

Part 2 casts a wide net over “providers” participating in federal programs, like Medicare, and “patients” who seek or have been given a diagnosis, treatment or referral for treatment for a substance use disorder. Thus, to the extent that opioid related information may fall within Part 2, precautions should be taken to avoid the disclosure of such information to anyone without specific consent of the patient other than health care personnel involved in the care and treatment of the patient during a medical emergency unless otherwise ordered by a court of competent jurisdiction.

Originally published in Healthcare Michigan, August 2018.

About the Author:

Kimberly Ruppel is a Member of Dickinson Wright’s Troy office. For over 19 years, Kim has provided counsel and representation to clients in a range of commercial and business disputes and litigation. Known as a trusted advisor with a skill for developing efficient and cost-sensitive solutions, Kim represents clients in matters related to healthcare disputes and litigation, HIPAA compliance, governmental investigations, ERISA and insurance claims and coverage issues, probate, fiduciary and trust litigation, and class actions in state and Federal courts. Kim can be reached at 248-433-7291 or kruppel@dickinsonwright.com.

Gregory Moore is a Member of Dickinson Wright’s Troy office and Co-Chair of the firm’s Behavioral Health Care Practice Group. With over 25 years of experience serving clients in the industry, his practice covers the full spectrum of regulatory, transactional, and litigation services. He has been recognized as a thought leader and innovator when it comes to the integration of behavioral and physical health care. Greg can be reached at 248-433-7268 or gmoore@dickinsonwright.com.