Following the release of the President’s plan to reduce gun violence, the Office for Civil Rights within the Department of Health and Human Services (HHS) issued a “Message to Our Nation’s Health Care Providers” regarding HIPAA and reporting threats of violence. 

In the letter, which was prompted by the recent mass shootings in Newtown, Connecticut, and Aurora, Colorado, HHS states that it wants to ensure that health care providers are aware that the HIPAA Privacy Rule does not prevent them from disclosing necessary information about a patient to law enforcement, family members of the patient, or other persons, when the health care provider believes the patient “presents a serious danger to himself or other people.”

Specifically, under 45 C.F.R. § 164.512(j), a covered health care provider who believes in good faith that a warning is necessary to prevent a serious threat to health or safety may, consistent with applicable law and standards of ethical conduct, alert those persons whom the provider believes are reasonably able to prevent or lessen the threat.  As an example, a mental health professional whose patient has made a credible threat to inflict serious bodily harm on another person may alert the police, a parent, school administrators, and others who may be able to intervene.

HHS also pointed out that, in addition to professional ethical standards, most states have laws and/or court decisions that address and often require disclosure of patient information to prevent or lessen the threat of harm; and providers must understand their duties and authority in those situations.  The letter closes by emphasizing that, because health care providers may have information about a patient that indicates a serious and imminent threat to health or safety, they “play an important role in protecting the safety of their patients and the broader community.”