OCR Reiterates HIPAA Guidance for Opioid Crisis Response

OCR has updated some of its pages on HIPAA guidance with regard to mental and behavioral health care to help entities respond to the opioid crisis.

Opioid Crisis causes HIPAA PHI guidance changes.jpeg

Article by Elizabeth Snell

December 19, 2017 - OCR recently discussed its current tools and initiatives in place to help organizations face the opioid crisis, touching on HIPAA guidance and how the agency is implementing the 21st Century Cures Act.

OCR launched two new webpages focused on mental and behavioral health information, which included how information sharing can be done with regard to mental health and substance use disorder treatment.

Partner agencies within HHS are also collaborating to develop model programs and materials for training healthcare providers, patients, and their families on permitted PHI uses and disclosures. PHI security is still critical for patients who are undergoing or are looking for mental health or substance use disorder treatment, OCR said. It’s important that a proper plan is developed and then shared with both professionals and consumers.

A working group was also launched “to study and report on the uses and disclosures under HIPAA of protected health information for research purposes,” the agency explained.

“The working group will include representatives from relevant federal agencies as well as researchers, patients, healthcare providers, and experts in healthcare privacy, security, and technology,” OCR said. “The working group will release a report addressing whether uses and disclosures of PHI for research purposes should be modified to facilitate research while protecting individuals’ privacy rights.”

First, OCR now has a webpage devoted to information related to mental and behavioral health, including links to various fact sheets discussing how the data ties into HIPAA regulations.

Providers need to understand their obligations when it comes to data sharing and the circumstances in which it is acceptable and necessary.

“At times, health care providers need to share mental and behavioral health information to enhance patient treatment and to ensure the health and safety of the patient or others,” OCR explains. “Parents, friends, and other caregivers of individuals with a mental health condition or substance use disorder play an important role in supporting the patient’s treatment, care coordination, and recovery.”

The fact sheets include but are not limited to how HIPAA helps professionals prevent harm, how family and friends can stay connected to a patient who has a mental or behavioral health condition, and how HIPAA regulations aid doctors in opioid crisis response.

OCR also updated its guidance on information sharing with regard to mental health. The guidance addresses three key areas:

  • How information related to mental health is treated under HIPAA
  • When information related to mental health may be shared with family and friends of an individual with mental illness, including parents of minors
  • The circumstances in which information related to mental health may be disclosed for health and safety purposes.

The agency also supplied information on how the Cures Act discusses HIPAA and research. The HIPAA Privacy Rule does account for certain situations in which PHI may be used or disclosed by covered entities for research purposes.  

“In the course of conducting research, researchers may obtain, create, use, and/or disclose individually identifiable health information,” OCR states on its website. “Under the Privacy Rule, covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.” 

For example, decedents’ PHI can potentially be used or disclosed.

“Representations from the researcher, either in writing or orally, that the use or disclosure being sought is solely for research on the protected health information of decedents, that the protected health information being sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is being sought,” the agency explains.

Using or disclosing patient information when the patient is being treated for a mental or behavioral health disorder is becoming a more popular issue in healthcare, especially as the opioid crisis grows.  

The US Senate passed Jessie’s Law (S. 581) in the summer of 2017, which required that HHS establish guidelines for when healthcare providers should prominently display a patient’s history of opioid use on his or her medical record. 

The law would help physicians be “better prepared to deal with the medical records of recovering addicts,” stated West Virginia Senator Joe Manchin, who sponsored the bill.

Among other requirements, HHS will need to consider “the benefits of displaying information about a patient’s opioid use disorder history in a manner similar to other potentially lethal medical concerns, including drug allergies and contraindications,” according to the bill.

However, protecting patient privacy must also be a top priority, “including the requirements related to consent for disclosure of substance use disorder information under all applicable laws and regulations.”


e-End operates a secure facility in Frederick, MD and specializes in destroying a wide variety of classified data, and various controlled devices. We also specialize in services to the Healthcare industry. This includes destruction of data containing hard drives that may contain electronic Personal Health Information.