Brief Summary of Bill

Establishes conditions in which a health provider may disclose protected health information (PHI) of an individual to a family member, friend, personal representative, or care provider without authorization from the individual.
Provides a list of the types of PHI that may be disclosed if the individual is being treated for a mental illness.
Lowers the standard for disclosure of PHI without authorization for the protection of an individual or the public from imminent danger to serious and urgent threat.

Background: PHI of an individual is protected from disclosure by a health provider by federal and state law. PHI includes any individually identifiable information created or received by a health care provider or other enumerated entity that relates to the past, present, or future health or health care of the individual. For general medical information, the federal Health Insurance Portability and Accountability Act (HIPAA) establishes a floor for privacy of health information. State law may provide for increased or additional restrictions on disclosure of PHI. Washington State laws providing increased or additional restrictions on the release of PHI are set forth in chapter 70.02 RCW.

The federal Department of Health and Human Services (HHS) periodically releases guidance to illuminate the interpretation of HIPAA. In 2014, HHS released guidance on how HIPAA both restricts and allows sharing of information related to mental health.

This legislation is substantially similar to Oregon House Bill 2948 (2015), which was enacted by the Oregon Legislature with an effective date of June 24, 2015.

Summary of Bill: A health care provider may disclose PHI of an individual without authorization from the individual if two conditions are met, one out of each of the following sets of circumstances:

Circumstance A

The disclosure is to a family member, relative, close friend, or person identified by the individual, and the PHI is directly relevant to the person's involvement with the individual's health care; or
The disclosure is for the purpose of notifying a family member, personal representative, or person responsible for the care of the individual or the individual's location, general condition, or death; and

Circumstance B

The individual is not present or unable to provide authorization due to incapacity or an emergency circumstance, and in the exercise of professional judgement based on reasonable inferences, the health care provider determines that disclosure is in the best interests of the individual; or
The individual is given the opportunity to object to the disclosure and does not object, or the health care provider exercises professional judgment to reasonably infer from the circumstances that the individual does not object to the disclosure.

When the individual is being treated for a mental illness, the PHI disclosed may include:

diagnosis and treatment recommendations;
issues concerning safety, such as risk factors for suicide, steps to make the individual's home safer, and a safety plan to monitor and support the individual;
information about resources available to help the individual, such as case management and support groups; and
the process to ensure that the individual safely transitions to higher and lower levels of care.

A health care provider is immune from civil liability for making disclosures in accordance with these provisions.

The standard by which a health care provider or facility may disclose PHI without authorization for the purpose to avoid or minimize a risk to the health and safety of any person is reduced from imminent danger to serious and urgent threat. Serious and urgent threat means a substantial risk of impending physical harm that requires immediate action or attention. The threat may be to the public instead of a specific person. The PHI must be disclosed only to a person who is reasonably able to prevent or lessen the threat, including the target of the threat.

Staff Summary of Public Testimony: PRO: A close family member attempted to take his own life. The health providers would tell us nothing because our family member would not consent. This is troubling. Please keep your eyes on the prize and push through the technicalities here to expand the availability of information to family members. If a physician knows that a person has stopped taking medications and there is a historical suicide risk, family members should be informed. My daughter has experienced severe mental illness. Washington laws are overly restrictive and not in alignment with HIPAA. Family members take on the care, support, emotional and financial burden of care, keeping loved ones safe and on the road to recovery. Washington laws make it impossible to get even minimal information. Health providers would not even tell us whether our daughter was safely in the hospital following a health crisis. Many persons with mental illness who have severe symptoms such as hallucinations, delusions, disorganized thinking, and extreme mood disorders may deny they are ill or even need treatment. Features of the illness can impair insight into the need for treatment and capability to provide releases of information. We do not ask for private details of psychotherapy sessions, just the minimal details necessary to control risks of harm to the individual when the therapist agrees it is in the patient's best interest. Our daughter would not recognize her illness or the need for treatment until she faced a life-threatening challenge. We were her support network, but we were largely uninformed about her health needs. We were not integrated into her treatment team, and received no feedback whether our actions were helpful or detrimental to her recovery. We would have been more effective caregivers if her health providers had been able to share health information. Research overwhelming shows that when families take an active role in treatment decisions, outcomes are better.

CON: Health care information is sensitive. If improperly released, it can damage a patient's interests. The definition of consent in this bill is a dramatic departure from what is currently allowed. This opens the door to disclosures to a neighbor who checks on a person three times a week, or a friend who calls every day to see if someone has taken their medicine. Issues can arise of abuse or financial exploitation of the elderly, or an unsuspected domestic violence situations.

OTHER: Please include health care facilities in these new standards. There should be greater alignment with HIPAA law. Differences in language between state and federal law present confusion around the threat language.