HHS recently issued guidance about HIPAA compliance when information must be released in conjunction with an extreme risk protection order (ERPO). The guidance will be useful for risk managers and compliance officers, but may present some challenges when trying to adhere to HIPAA restrictions.
An ERPO is “a court order that temporarily prevents a person in crisis, who poses a danger to themselves or others, from accessing firearms. ERPO legislation, which can vary in important ways among states, generally specifies certain categories of petitioners (e.g., law enforcement officers, family members, healthcare providers) who may apply to a court for an ERPO and includes requirements for affidavits or sworn oral statements from the petitioner or witnesses to support the application,” HHS explained. …
The decision to disclose PHI in such a situation can be difficult, Rubin says, coming down to the discretion of the provider assessing the patient’s condition, the statements made by the patient, and the likelihood of the patient acting on a threat. HIPAA allows for disclosure in these situations as long as certain conditions are met. …
The guidance is useful, particularly in the light of concerns over gun violence in the country, says Alaap B. Shah, JD, an attorney with Epstein Becker Green in Washington, DC. Healthcare providers may find themselves in difficult situations when a patient is considered dangerous, and the HHS guidance should help them make a lawful decision.
“People have been confused by HIPAA. It’s often used as a shield, with people automatically saying HIPAA doesn’t allow us to disclose anything,” Shah says. “[HHS] is clarifying that there are some purposeful avenues by which you can disclose sensitive information, including mental health information records, to prevent gun violence.”
However, the guidance only goes so far. It still is up to the covered entity to understand pertinent state laws and other federal laws that may limit disclosure.
“HHS is saying that there are ways to disclose this information under HIPAA, but they’re also emphasizing that they are not the final word on any disclosure decision,” Shah says. “They help you understand how HIPAA applies, but they’re very clear that you have to explore these other avenues before making a decision to disclose.”