Do the Preventing Harm Exception requirements for the type of harm align with the HIPAA Rules?

Yes. The Preventing Harm Exception’s type of harm condition relies on the same types of harm that serve as grounds for reviewable denial of an individual’s right of access under the Privacy Rule (45 CFR 164.524). (See ONC Cures Act Final Rule preamble Table 3—Mapping of Circumstances Under § 171.201(d) to Applicable Harm Standards.)

In most instances, including where a practice interferes with a patient’s own or the patient’s other health care providers’ legally permissible access, exchange, or use of the patient’s electronic health information (EHI), coverage under the Preventing Harm Exception requires that the risk be of physical harm. (See 45 CFR 171.201(d)(3) and (4).)

However, the Preventing Harm Exception’s type of harm condition applies a “substantial harm” standard for practices interfering with a patient’s representative’s requested access, exchange, or use of the patient’s EHI and to the patient’s or their representative’s access to other persons’ individually identifiable information within the patient’s EHI in some circumstances. (See 45 CFR 171.201(d)(1) and (2)).