January 21, 2022

OCR: HIPAA Allows Disclosure of PHI for Extreme Risk Protection Orders in Limited Circumstances

In December 2021, the HHS Office for Civil Rights (OCR) issued  guidance confirming that HIPAA allows covered entities to disclose PHI without patient authorization in limited circumstances to support an application for an “extreme risk protection order” (ERPO) to prevent access to firearms by a person in crisis posing a danger to self or others.  The guidance follows a framework issued by DOJ in June 2021 for states to use in crafting ERPO laws. The guidance reviews potentially applicable HIPAA provisions addressing disclosures required by law, in response to court orders, or as necessary to prevent or lessen serious and imminent threats. In the guidance, OCR also reminds covered entities to adhere to HIPAA’s minimum necessary standard and take into account the specific circumstances of each case, the specific state ERPO law, and other potentially applicable laws and regulations, when considering disclosures in connection with an ERPO.