Won’t the HIPAA Privacy Rule’s minimum necessary restrictions impede the delivery of quality health care by preventing or hindering necessary exchanges of patient medical information among health care providers involved in treatment?
How are covered entities expected to determine what is the minimum necessary information that can be used, disclosed, or requested for a particular purpose?
Does HIPAA permit health care providers to share protected health information (PHI) about an individual with mental illness with a third party that is not a health care provider for continuity of care purposes? For example, can a health care provider refer a homeless patient to a social services agency, such as a housing provider, when doing so may reveal that the basis for eligibility is related to mental health?
Does HIPAA permit health care providers to share protected health information (PHI) about an individual who has mental illness with other health care providers who are treating the same individual for care coordination/continuity of care purposes?
Does HIPAA prevent a school administrator, or a school doctor or nurse, from sharing concerns about a student’s mental health with the student’s parents or law enforcement authorities?
What options do family members of an adult patient with mental illness have if they are concerned about the patient’s mental health and the patient refuses to agree to let a health care provider share information with the family?
Does HIPAA provide extra protections for mental health information compared with other health information?
How does HIPAA interact with the federal confidentiality rules for substance use disorder treatment information in an emergency situation—which rules should be followed?
Does HIPAA require a mental health provider to let a patient know that the provider is going to share information with others before disclosing PHI to prevent or lessen a serious and imminent threat?
What constitutes a “serious and imminent” threat that would permit a health care provider to disclose PHI to prevent harm to the patient, another person, or the public without the patient’s authorization or permission?