At times, health care providers need to share mental and behavioral health information to enhance patient treatment and to ensure the health and safety of the patient or others. Parents, friends, and other caregivers of individuals with a mental health condition or substance use disorder play an important role in supporting the patient’s treatment, care coordination, and recovery.
The HIPAA Rules are designed to protect the privacy of all of an individuals’ identifiable health information and to ensure that health information is available when needed for treatment and other appropriate purposes. Given the sensitive nature of mental health and substance use disorder treatment information, OCR is providing this guidance addressing HIPAA protections, the obligations of covered health care providers, and the circumstances in which covered providers can share information—as applied to this context.
This page is intended to be a one-stop resource for guidance and other materials on how HIPAA applies to mental health and substance use disorder information. It will be periodically updated with additional information.
Information for patients with a mental health condition or substance use disorder, family and friends of these patients, and mental health professionals with a patient who may be a danger to themselves or others.
HIPAA Privacy Rule and Sharing Information Related to Mental Health
This guidance addresses some of the more frequently asked questions about when the Privacy Rule permits a health care provider to share the protected health information of a patient who is being treated for a mental health condition. The Rule is carefully balanced to allow uses and disclosures of information—including mental health information—for treatment and certain other purposes with appropriate protections. The mental health guidance addresses three core areas:
Guidance on Responding to an Opioid Overdose
HHS Office for Civil Rights has released guidance on when and how healthcare providers can share a patient’s health information with his or her family members, friends, and legal personal representatives when that patient may be in crisis and incapacitated, such as during an opioid overdose.
HIPAA and Personal Representatives for Adults and Minors
HIPAA recognizes that some patients (including those with a mental illness or substance use disorder) may be unable to make their own health care decisions, including decisions related to health information privacy. HIPAA provides personal representatives of a patient with the same rights to request and obtain health information as the individual, including the right to obtain a complete medical record under the HIPAA right of access.
Parents of minor children (typically under age 18) are generally the personal representatives of their children. State law addresses the age at which a minor child may consent to certain types of health care and may contain additional requirements related to disclosing a minor’s health information to parents (or withholding it).
HIPAA also allows a health care provider to determine, based on professional judgment, that treating someone as a patient’s personal representative for HIPAA purposes would endanger the patient, and to refuse to treat the person as a personal representative under those circumstances. This applies whether the patient is an adult or a minor child.
Mental Health FAQ’s
OCR has organized certain FAQ’s related to handling mental health information under HIPAA in two easy-to-access PDFs.
Substance Use Disorder Treatment Records
The protected health information of individuals who receive drug and alcohol abuse treatment in federally-funded programs is subject to additional privacy protections under 42 USC § 290dd-2 and 42 CFR § 2.11 (Part 2). These federal rules are administered by HHS’s Substance Abuse and Mental Health Services Administration (SAMHSA).