Alaap B. Shah, Member of the Firm in the Health Care & Life Sciences practice, in the firm’s Washington, DC, office, was quoted in Healthcare Risk Management, in “HHS Guidance Addresses HIPAA and Emergency Protective Orders,” by Greg Freeman.

Following is an excerpt:

HHS recently issued guidance about HIPAA compliance when information must be released in conjunction with an extreme risk protection order (ERPO). The guidance will be useful for risk managers and compliance officers, but may present some challenges when trying to adhere to HIPAA restrictions.

An ERPO is “a court order that temporarily prevents a person in crisis, who poses a danger to themselves or others, from accessing firearms. ERPO legislation, which can vary in important ways among states, generally specifies certain categories of petitioners (e.g., law enforcement officers, family members, healthcare providers) who may apply to a court for an ERPO and includes requirements for affidavits or sworn oral statements from the petitioner or witnesses to support the application,” HHS explained. …

The decision to disclose PHI in such a situation can be difficult, Rubin says, coming down to the discretion of the provider assessing the patient’s condition, the statements made by the patient, and the likelihood of the patient acting on a threat. HIPAA allows for disclosure in these situations as long as certain conditions are met. …

The guidance is useful, particularly in the light of concerns over gun violence in the country, says Alaap B. Shah, JD, an attorney with Epstein Becker Green in Washington, DC. Healthcare providers may find themselves in difficult situations when a patient is considered dangerous, and the HHS guidance should help them make a lawful decision.

“People have been confused by HIPAA. It’s often used as a shield, with people automatically saying HIPAA doesn’t allow us to disclose anything,” Shah says. “[HHS] is clarifying that there are some purposeful avenues by which you can disclose sensitive information, including mental health information records, to prevent gun violence.”

However, the guidance only goes so far. It still is up to the covered entity to understand pertinent state laws and other federal laws that may limit disclosure.

“HHS is saying that there are ways to disclose this information under HIPAA, but they’re also emphasizing that they are not the final word on any disclosure decision,” Shah says. “They help you understand how HIPAA applies, but they’re very clear that you have to explore these other avenues before making a decision to disclose.”

Jump to Page

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.