Ending 2021 with HIPAA’s privacy rule and disclosures of PHI for Extreme Risk Protection Orders

For those looking to close the door on 2021, this article may resonate. Instead of publishing an uplifting article, I am going to address Extreme Risk Protection Orders (“ERPOs”) in relation to HIPAA, based on December’s announcement by HHS. Importantly, this is not a new concept as HHS published a Final Rule (81 Fed. Reg. 382 (Jan. 6, 2016)), addressing HIPAA and the National Instant Criminal Background Check System (NICS).

In bioethics, I teach one type of ERPO – the ability of a physician to report a legitimate threat of harm to law enforcement when an individual is deemed to be a threat to him/herself or to another individual. This concept is based on a California Supreme Court case – Tarasoff v. Regents of the University of California, 17 Cal. 3d. 425 (1976), which rejected a mental health professional’s position that “he owed no duty to the woman” that a patient relayed during a session that he intended to kill. Subsequently, the patient killed the woman and her parents sued for failure to warn. (As an aside, there are actually two Tarasoff cases known as Tarasoff I and Tarasoff II).

In Tarasoff II, the California Supreme Court reheard the case, noting plaintiffs’ argument that therapists failed to exercise reasonable care to protect Tatiana Tarasoff. Although the police were warned, no other steps were taken such as detaining Poddar or warning Tatiana of the danger. In its 1976 ruling, the Court replaced duty to warn with a duty to protect. The famous quote from Tarasoff II, which was adapted by many states across the country, made the change clear: “When a therapist determines, or should determine, that his patient presents a serious danger of violence to another, he incurs an obligation to use reasonable care to protect the intended victim from danger.”

In 1985, California’s legislature codified the Tarasoff Rule and “California law now provides that a psychotherapist has a duty to protect or warn a third party only if the therapist actually believed or predicted that the patient posed a serious risk of inflicting serious bodily injury upon a reasonably identifiable victim.”

Fast forward to the passage of HIPAA in 1996 and the subsequent Privacy Rule and Security Rule. Tarasoff’s impact can been seen in three ways: (1) a physician or other medical professional, may disclose to law enforcement a situation where a person poses an imminent threat to either themselves, another person, and/or the public, or may produce protected health information pursuant to a court order or other legal requirement (45 CFR 164.512); (2) using the minimum necessary standard, in limited circumstances the “Privacy Rule allows a covered health care provider to disclose PHI to support an ERPO application by the provider or another person in certain circumstances” pursuant to 45 CFR 164.512 (the caveat is that one needs to seek legal advice because just because a subpoena or discovery is requested, it does not mean the entity needs to produce it); and (3) under certain circumstances, a patient’s psychotherapy notes may be disclosed.

The HHS website mentioned above also discusses the U.S. Department of Justice’s Commentary on the subject of model legislation related to the ability of courts to issue ERPOs that temporarily prevent a person in crisis from accessing firearms. HIPAA plays an important role in giving providers latitude while ensuring that an individual’s due process rights are maintained.

As suicide is a leading cause of death and mass shootings and other group violence have become more prominent, it is important to be educated about different legal and clinical options, which adhere to a variety of laws, yet serve to protect both an individual and others.

Here’s to closing the door on 2021, with the hope that more people will be informed about ERPOs in the context of HIPAA and other laws – both common law and statutory.