“You probably have no idea how horrible it is to go weeks & weeks with the realization that there are only 3 possible scenarios for your loved one. Every time my son’s been hospitalized I knew he would either end up in Jail, Dead or in the Hospital. Please, please, please revise the HIPPA laws to allow family members to be part of the decision making, the conversations & treatment plans!!!”[1]
“Please make it easier for the mentally ill to get help by way of better communication with doctors and staff/facilities. Also allow more freedom to work with family members to get there loved one help. Review and remove some of the barriers that families face due to Hippa.”[2]
“Police routinely called to tell me that they had taken him to a different psychiatric facility for treatment. But when I called these hospitals to speak with healthcare workers to try to get him safely back to his home, I was ignored because of HIPPA laws.”[3]
These heartfelt comments are among those submitted to the HHS Office for Civil Rights (OCR) in response to its January notice of proposed rulemaking (NPRM),[4] which offered the first opportunity for the public to formally weigh in on possible revisions to the HIPAA privacy rule since it went into effect nearly two decades ago. Taken together, many of the commenters—who often misspell HIPAA as HIPPA—reveal the devastating consequences on those with mental health and substance use disorders due to what are arguably misinterpretations of the rule.
OCR has acknowledged since it first began the rulemaking process in December 2018 with a request for information that there were problems with the privacy rule. The agency “has heard calls to revisit aspects of the Rules that may limit or discourage information sharing needed for coordinated care or to facilitate the transformation to value-based health care,” it said at the time.[5]
Added then-OCR director Roger Severino: “We are looking for candid feedback about how the existing HIPAA regulations are working in the real world and how we can improve them.”
And candid the comments are—some, like the ones RPP has reprinted, are so candid OCR has redacted the submitter’s names and other identifying information. RPP has added additional redactions where appropriate.
Eighty-three comments refer to HIPPA. Although a few of these are from attorneys and even nurses who should know the correct spelling, most are from anguished parents and other family members who blame HIPAA for thwarting attempts to help their loved ones.
Many of those address failings with the mental health system—exacerbated, they say, by HIPAA. Typically they don’t actually mention the NPRM or provisions in it. Instead, they plead for access to information, typically born of a lifetime of frustration caring for family members who developed symptoms in their late teens or early 20s.
Problems of homelessness, arrests and repeat hospitalizations are common. Often they note that the person may have anosognosia, the inability to recognize the mental disorder, which may not only complicate treatment but sometimes make it impossible.
For some parents, revising the rule will come too late to help their loved one, but they advocated for changes nonetheless. It will take OCR years to issue a final rule, which would go into effect at some point in the future. But providers and other covered entities could make changes of their own to better assist families even under the current rule.
‘I Was Frantic’
“When my son, [Redacted], was 19, he had his first experience of a serious mental illness. He was in full-blown mania, seeing and hearing things, thinking he was in a movie, etc. He even stole a friend’s car to try to drive to NYC. This was going on for over 3 months, and I recognized what was happening. I had to jump through hoops to ‘trick’ him into seeing a psychiatrist,” who admitted him involuntarily, one mother wrote.[6]
“HIPPA==As soon as he was admitted, I was completely cut off because he was over 18. I was unable to get any information about him, even where he was. He didn’t understand that he had to call and give me a code so I could call him back. I was frantic. Somehow after 2 days of trying to figure out if he was even at [redacted], I was able to track down someone on the inpatient floor who was able to help [redacted] call me. They were not allowed to tell me anything about his condition or treatment due to HIPPA.”
HIPAA for Caregivers, a fledgling organization in Michigan, also submitted a comment with HIPAA misspelled (but also with the correct spelling).[7] The director and co-founder of the organization, Susan Todoroff, told RPP that once the organization was alerted to the NPRM by the local chapter of the National Alliance on Mental Illness, “we knew we had to comment.”
“It was fortuitous that HIPAA for Caregivers formed just as HHS was getting ready to post the NPRM,” Todoroff said. The organization is “interested in how HIPAA rules affect communication with families living in support of a loved one with mental health issues,” she added.
“Compassionate communication between caregivers and health care providers” is needed, Todoroff said. “Our mission is driven by our own personal experiences with the mental health care system. We know the hopelessness and frustration created when caregivers are blocked from communicating with health care providers, both during and after their loved one’s mental health crisis, as a result of excessively strict interpretations” of the privacy rule.
End ‘Fear-Driven’ Approach
Alternatively, “immense benefits [are] derived by both family and patient when doctors take the most generous, least fear-driven view of HIPAA—actively listening to caregivers, effectively reacting to input, and appropriately sharing information about the patient with caregivers,” Todoroff said. “It is so common for a patient, due to mental illness or substance use, to not want a caregiver involved in their health care. Often times, they are so distraught they cannot think clearly. However, the value that would come if loved ones were involved in the conversation is immense.”
Todoroff added that caregivers “are stressing and hurting while they strive, uninformed, to help their loved ones. Even though they are giving far more of themselves than any other entity involved with the patient, they are being withheld from the conversation that could vastly improve the health outcomes of both the patient and the family.”
OCR has proposed changes related to disclosure of protected health information (PHI) when done in the best interest of individuals in health emergencies or crises, including serious mental illness and substance use disorders.
Todoroff and other commenters support these changes.
‘Good Faith Belief’ Could be Used
The NPRM modifies “the standard for certain permitted disclosures from one based on a covered entity’s ‘professional judgment’ to one based on its ‘good faith’ belief that a disclosure would be in the best interests of the individuals,” OCR explained in a fact sheet.[8]
An individual could still object to such a disclosure, but baring this, a change to a good faith standard is proposed to address “concerns that the requirement under the current rule to exercise professional judgment could be understood as limiting the permission to persons who are licensed or who rely on professional training to determine whether a use or disclosure of PHI is in an individual’s best interests.”
As described in the NPRM, a good faith belief may be predicated on “knowledge of the facts of the situation,” such as “any prior expressed privacy preferences of the individual,” and “representations of a person or persons who reasonably can be expected to know relevant facts.”[9]
According to the fact sheet, a provider whose young adult patient overdosed on opioids could “disclose relevant information to a parent who is involved in the patient’s treatment and who the young adult would expect, based on their relationship, to participate in or be involved with the patient’s recovery from the overdose.”
Another example would be when “front desk staff at a physician’s office who have regularly seen a family member or other caregiver accompany an adult patient to appointments” discloses “relevant information to the family member or caregiver as a way of checking in on the welfare of the patient, when a patient misses an appointment, based on the staff’s knowledge of the person’s involvement and a good faith belief about the patient’s best interests.”
‘We Can Always Hope’
If finalized as proposed, covered entities also would be allowed to disclose PHI “to avert a threat to health or safety” when harm to the patient or others is “serious and reasonably foreseeable” from the current standard of when harm is “imminent.”
Todoroff called it “likely” that OCR “will switch the phrases ‘good faith belief’ and ‘serious and reasonably foreseeable threat.’ We are not as hopeful that OCR will truly widen families’ access to information about their loved ones experiencing mental health challenges. Despite that, we can always hope. And, we can be satisfied in knowing that we did our part to make our opinions known.”
RPP asked Todoroff, how, in her view, OCR should balance the comments from some arguing for greater controls with those from her organization and others like it.
“We realize that our suggestions to expand doctors’ obligations in sharing PHI may meet opposition. It’s important that OCR balances input from different perspectives. We are not health care professionals, so we realize that there are factors at work that we may not fully grasp,” Todoroff told RPP. “That said, the facts in support of caregivers should be carefully considered. Research shows that positive family involvement is beneficial to patients. In addition, language supporting families could decrease the economic and emotional burden that caretaking families currently bear.” She noted that the Cures Act “supports many facets of compassionate communication.”
Todoroff also warned that OCR should “take steps to make sure that doctors don’t over-interpret privacy rule language out of self-interest. It is our understanding that health care providers often exert excessive control of the flow of PHI to minimize risk of HIPAA violations and fines,” she said. “HHS has the power to change the text of the privacy law in a way that alleviates, or at least reduces those fears.”
1 HHS, “Comment on FR Doc # 2020-27157,” public submission, HHS-OCR-2021-0006-0777, June 23, 2021, https://bit.ly/3wczrKU.
2 HHS, “Comment on FR Doc # 2020-27157,” public submission, HHS-OCR-2021-0006-0810, June 23, 2021, https://bit.ly/3jJBW4S.
3 HHS, “Comment on FR Doc # 2020-27157,” public submission, HHS-OCR-2021-0006-0427, June 23, 2021, https://bit.ly/2TqrdBL.
4 Proposed Modifications to the HIPAA Privacy Rule To Support, and Remove Barriers to, Coordinated Care and Individual Engagement, 86 Fed. Reg. 6,446 (January 21, 2021), http://bit.ly/3asDtpI.
5 HHS, “HHS seeks public input on improving care coordination and reducing the regulatory burdens of the HIPAA Rules,” news release, December 12, 2018, https://bit.ly/3qQAbEv.
6 HHS, “Comment on FR Doc # 2020-27157,” public submission, HHS-OCR-2021-0006-0829, June 23, 2021, https://bit.ly/3hfukFQ.
7 HHS, “Comment on FR Doc # 2020-27157,” public submission, HHS-OCR-2021-0006-0974, June 23, 2021, https://bit.ly/3dJqsKW.
8 HHS, “Office for Civil Rights (OCR) Proposes Modifications to the HIPAA Privacy Rule to Empower Individuals, Improve Coordinated Care, and Reduce Regulatory Burdens,” fact sheet, December 10, 2020, https://bit.ly/2L5yLp0.
9 Proposed Modifications to the HIPAA Privacy Rule To Support, and Remove Barriers to, Coordinated Care and Individual Engagement, 86 Fed. Reg. at 6,481.
