NRPM: Standards for Privacy of Individually Identifiable Health Information. b. Proposed requirements.


We would permit covered entities, consistent with applicable law and standards of ethical conduct, to disclose protected health information based on a reasonable belief that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Covered entities would only be permitted to make such disclosures to persons who are reasonably able to prevent or lessen the threat, including to the target of the threat.

Anticipating all circumstances under which emergency disclosure could be necessary is not possible. This section must be stated in somewhat general terms. We intend to permit covered entities to respond to emergency requests for protected health information, where it is reasonable for the covered entity to believe that such disclosure would prevent or reduce a serious emergency situation. Such emergencies may threaten a single person or the general public. We do not intend to permit disclosure of protected health information in response to hypothetical scenarios or potential emergencies that are not imminent and serious. This permitted disclosure would be narrow; it should not become a loophole for disclosures not permitted by the other provisions of the proposed rule.

This provision would permit disclosure of relevant information in response to credible requests from law enforcement, public health, or other government officials. The covered entity would be permitted to reasonably rely on credible representations that an emergency exists and that protected health information could lessen the threat. If the disclosure was made in a good faith belief that these circumstances exist, it would be lawful under this section. A covered entity could also disclose protected health information on its own initiative if it determined that the disclosure were necessary, consistent with other applicable legal or ethical standards. Our proposed rule is intended to permit such disclosures where they are otherwise permitted by law or ethical standards. We do not intend to permit disclosures by health care providers or others that are currently prohibited by other law or ethical standards.

Disclosure for emergency circumstances could be authorized by statute or common law and could also be addressed in medical professional ethics and standards. For example, the American Medical Association Principles of Medical Ethics on Confidentiality provides that:

[T]he obligation to safeguard patient confidences is subject to certain exceptions that are ethically and legally justified because of overriding social consideration. Where a patient threatens to inflict serious bodily harm to another person or to him or herself and there is a reasonable probability that the patient may carry out the threat, the physician should take reasonable precautions for the protection of the intended victim, including notification of law enforcement authorities.

The duty to warn third persons at risk has been addressed in court cases, and the provision proposed permits disclosures in accord with such legal duties. The leading case on this issue is Tarasoff v. Regents of the University of California, 17 Cal. 3d 425 (1976). In that case, a therapist’s patient made credible threats against the physical safety of a specific person. The Supreme Court of California found that the therapist involved in the case had an obligation to use reasonable care to protect the intended victim of his patient against danger, including warning the victim of the peril. Many States have adopted (judicially or legislatively) versions of the Tarasoff duty to warn, but not all States have done so. This proposed rule is not intended to create a duty to warn or disclose but would simply permit the disclosure under the emergency circumstances consistent with other applicable legal or ethical standards.

An emergency disclosure provision does present some risks of improper disclosure. There will be pressures and uncertainties when disclosures are requested under emergency circumstances, and decisions must often be made instantaneously and without the ability to seek individual authorization or to perform complete verification of the request. We believe that this risk would be warranted when balancing the individual’s interest in confidentiality against the societal interests to preserve life and protect public safety in those rare emergency circumstances where disclosure is necessary. A covered entity that makes a reasonable judgement under such pressure and discloses protected health information in good faith would not be held liable for wrongful disclosure if circumstances later prove not to have warranted the disclosure.

We would also exempt emergency disclosures from provisions that allow individuals to request restrictions on uses and disclosures of their protected health information for treatment, payment and health care operations. In emergency situations, health care professionals need to have any information that will allow them to respond to the emergency circumstance, and cannot be expected to take the time to remind themselves of restrictions on particular information. See proposed § 164.506(c).