HB 2948 – Specifies additional conditions under which protected health information may be disclosed by health care provider that do not subject health care provider to civil liability. It is “codified” into Oregon state statutes as 2015 ORS 192.567.
Backgound: The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is the federal law to make it easier for individuals to keep health insurance, protect the confidentiality and security of their healthcare information and to help the healthcare industry. Protected health information (PHI) is information relating to an individual’s health status, healthcare or payment for healthcare. Generally, this includes any part of an individual’s medical record and/or payment history.
What HB 2948 (ORS 192.567) does: Clarifies the conditions under which protected health information may be disclosed by a healthcare provider without obtaining an authorization from the individual or a personal representative. It specifies information that may be disclosed by healthcare provider for an individual being treated for mental illness. It specifies that healthcare provider making disclosure is not subject to any civil liability. It places this clarification in Oregon Statute.
The Intent: People receiving care for mental health conditions and their families or other support people often experience health care workers attributing their inability to talk with a patient’s support people to HIPAA. Many times, parents of minors are locked out of pertinent information about their minor children and are told by health care workers that HIPAA prohibits them from sharing. This law clarifies the circumstances when it is permitted for health care workers to communicate with family members or other support persons, even without a HIPAA Release of Information signed by the patient.
Here is exactly how the Statute reads:
(1)(a) A health care provider may use or disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual if the conditions in paragraph (b) of this subsection are met and:
(A) The disclosure is to a family member, other relative, a close personal friend or other person identified by the individual, and the protected health information is directly relevant to the person’s involvement with the individual’s health care; or
(B) The disclosure is for the purpose of notifying a family member, a personal representative of the individual or another person responsible for the care of the individual of the individual’s location, general condition or death.
(b) A health care provider may make the disclosures described in paragraph (a) of this subsection if:
(A)(i) The individual is not present or obtaining the individual’s authorization is not practicable due to the individual’s incapacity or an emergency circumstance; and
(ii) In the exercise of professional judgment and based on reasonable inferences, the health care provider determines that the disclosure is in the best interests of the individual; or
(B) The individual is present and the health care provider gives the individual an opportunity to object to the disclosure and the individual does not express an objection or the health care provider reasonably infers from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure.
(2) A health care provider may disclose protected health information to a person if the health care provider, consistent with standards of ethical conduct, believes in good faith that the disclosure is necessary to prevent or lessen a serious threat to the health or safety of any person or the public, and if the information is disclosed only to a person who is reasonably able to prevent or lessen the threat, including the target of the threat.
(3) With respect to an individual who is being treated for a mental illness, the protected health information disclosed under this section may include, to the extent consistent with the health care provider’s professional judgment and standards of ethical conduct:
(a) The individual’s diagnoses and the treatment recommendations;
(b) Issues concerning the safety of the individual, including risk factors for suicide, steps that can be taken to make the individual’s home safer, and a safety plan to monitor and support the individual;
(c) Information about resources that are available in the community to help the individual, such as case management and support groups; and
(d) The process to ensure that the individual safely transitions to a higher or lower level of care, including an interim safety plan.
(4) Any disclosure of protected health information under this section must be limited to the minimum necessary to accomplish the purpose of the disclosure.
(5) A health care provider is not subject to any civil liability for making a disclosure in accordance with this section.
(6) This section shall be known and may be cited as the Susanna Blake Gabay Act.