In a previous post, I wrote about HHS relaxing HIPAA to address the opioid abuse in the U.S., and in February I hosted a webinar where we discussed the new laws and how it will impact providers. In today’s post, I address several of the great questions we received during the live session.
Q: If a previously discharged patient requests their protected records for themselves, do they need to expressly authorize the release of information related to alcohol or substance abuse?
A: If the patient is asking for the record for themselves then they can request their record in writing, and do not need to expressly authorize the release of alcohol or substance abuse treatment records. Keep in mind, a covered entity may require individuals to use the entity’s own supplied form, provided use of the form does not create a barrier to or unreasonably delay the individual from obtaining access to his PHI, as described below.
Q: If a patient can’t consent to sharing PHI upon admission but then becomes coherent and stable and now doesn’t want the physician to discuss with anyone else, can a physician still discuss care with family?
A: No. HIPAA anticipates that a patient’s decision-making capacity may change during the course of treatment. If a patient regains the capacity to make healthcare decisions, the provider must offer the patient the opportunity to agree or object before any additional sharing of PHI.
Q: When a patient comes into a clinic, whether seeing a mental health or regular general practitioner, and the patient is of age of majority and becomes angry and uncontrollable should the provider call a relative, and if so, how much information should they release?
A: HIPAA allows health care professionals to disclose some health information without a patient’s permission under certain circumstances, such as sharing health information with family and close friends who are involved in care of the patient if the provider determines that doing so is in the best interests of an incapacitated or unconscious patient and the information shared is directly related to the family or friend’s involvement in the patient’s health care or payment of care. Also, HIPAA states that they can share information if the person to whom they share are in a position to prevent or lessen a serious or imminent threat to a patient’s health or safety.
Q: Does 42 CFR Part 2 have any specific provisions that allow or prohibit denial of treatment for a patient that refuses to authorize disclosure of treatment program records for the purpose of payment?
A: I cannot speak to refusal of treatment; however, HIPAA allows health care professionals to disclose some health information without a patient’s permission under certain circumstances such as sharing health information with family and close friends who are involved in care of the patient if the provider determines that doing so will assist in the payment of care.
Q: Patient is 25 years old and the mother calls stating patient is acting out (manic) and requests medical records as they have moved out of state. Can we release/send medical records?
A: You must have the patient sign an authorization to release the records unless the patient is incapacitated or unconscious, then you default to the patient’s “personal representative” under HIPAA. HIPAA provides a patient’s personal representative the right to request and obtain any information about the patient that the patient could obtain, including a complete medical record. Personal representatives are persons who have health care decision making authority for the patient under state law. This authority may be established through the parental relationship between the parent or guardian of an un-emancipated minor, or through a written directive, health care power of attorney, appointment of a guardian, a determination of incompetency, or other recognition consistent with state laws to act on behalf of the individual in making health care related decisions.
Q: Does the provider need to document in the medical record whether the patient is a threat or in imminent danger before sharing the information?
A: The Part 2 regulations at 42 CFR §2.51 specify that when a disclosure is made in connection with a medical emergency, the Part 2 program must document in the patient’s record the name and affiliation of the recipient of the information, the name of the individual making the disclosure, the date and time of the disclosure, and the nature of the emergency [42 CFR § 2.51(c)].
Q: We are an acute care hospital. We do not have a substance abuse program. We do receive many substance abuse patients in the emergency department. Based on this, I am assuming we do not have to follow CFR 42 Part 2, but rather HIPAA only. Correct?
A: Correct. Not every primary care provider who prescribes controlled substances meets the definition of a “program” or part of a “program” under Part 2. For providers to be considered “programs” covered by the Part 2 regulations, they must be both ”federally-assisted” and meet the definition of a program under 42 CFR § 2.11. Physicians who prescribe controlled substances to treat substance use disorders are DEA-licensed and thus meet the test for federal assistance [42 CFR § 2.12(b)(2)]. Nevertheless, the regulations establish additional criteria to meet the definition of a “program”:
- If a provider is not a general medical care facility, then the provider meets Part 2’s definition of a “program” if it is an individual or entity that holds itself out as providing, and provides alcohol or drug abuse diagnosis, treatment or referral for treatment.
- If the provider is an identified unit within a general medical care facility, it is a “program” if it holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment.
- If the provider consists of medical personnel or other staff in a general medical care facility, it is a program if its primary function is the provision of alcohol or drug abuse diagnosis, treatment or referral for treatment and is identified as such specialized medical personnel or other staff within the general medical care facility.
Q: Where can you obtain the 42 CFR Part 2 Form?
A: The Legal Action Center has created some forms to be used and they can be found here.
Q: If a patient is leaving the practice to move out of state do we have to send an authorization to the treating psych.
A: Yes, best practice would be to require the patient to sign an authorization for the release of his or her records to their new treating physician.
Q: Electronic sharing of medical records between facilities is becoming more routine. Records may not be flagged as sensitive or break the glass, especially if ED/acute care. Referrals to outpatient programs may be part of aftercare. Is special authorization required?
A: Unlike HIPAA, which generally permits the disclosure of protected health information without patient consent or authorization for the purposes of treatment, payment, or health care operations, Part 2, with limited exceptions (i.e., medical emergencies and audits and evaluations), requires patient consent for such disclosures (42 CFR §§ 2.3, 2.12, 2.13). For a comparison of the HIPAA Privacy Rule and Part 2 provisions, refer to the SAMHSA guidance.
Q: AHIMA recommends “the signed date on an authorization from cannot be prior to the date of the actual treatment. Can we locate this statement from HIPAA regs?
A: There is guidance on this here. Which state, provided that the Authorization encompasses the category of information that was later created, and that the Authorization has not expired or been revoked by the individual. Unless otherwise expressly limited by the Authorization, a covered entity may use or disclose the protected health information identified on the Authorization regardless of when the information was created.
Q: What categories of health care professionals are considered “medical personnel” for the purpose of obtaining information during a medical emergency?
A: Part 2 allows patient identifying information to be disclosed to medical personnel in a medical emergency [42 CFR § 2.51]. Part 2 does not define the term “medical personnel” but merely provides that information can be given to medical personnel who have a need for information about a patient for the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention. It is up to the health care provider or facility treating the emergency to determine the existence of a medical emergency and which personnel are needed to address the medical emergency. The name of the medical personnel to whom the disclosure was made, their affiliation with any health care facility, the name of the individual making the disclosure, the date and time of the disclosure, and the nature of the medical emergency must be documented in the patient’s records by the Part 2 program disclosing them [42 CFR §2.51(c)].
Q: What is the Opioid guidance and 42 CFR Part 2’s relationship with state laws (including but not limited to Wisconsin)?
A: 42 CFR § 2.20, states that “no State law may authorize or compel any disclosure prohibited by these [Part 2] regulations.” However, States may impose additional confidentiality protections. Thus, § 2.20 provides that, “If a disclosure permitted under these regulations is prohibited under State law, neither these regulations nor the authorizing statutes may be construed to authorize any violation of that State law.”
.svg)
