In which patient access cases does the Preventing Harm Exception recognize “substantial harm” 3 ?
In which patient access cases does the Preventing Harm Exception recognize “substantial harm” 3 ?
The Preventing Harm Exception at 45 CFR 171.201 relies on the same types of harm as apply for a covered entity to deny access to protected health information under the HIPAA Privacy Rule (see 45 CFR 164.524(a)(3)). Where an actor's practice, based on an individualized (45 CFR 171.201(c)(1)) determination of risk, is likely to interfere with a patient's or patient representative's access, exchange, or use of the patient's EHI, the type of harm (45 CFR 171.201(d)) needed for the exception to apply depends on who is seeking access to the EHI, and what EHI they are seeking to access.4
The table below shows the type of harm recognized under the Preventing Harm Exception for several commonly encountered patient access scenarios.1
|
Access, exchange, or use of patient's EHI |
EHI for which access, exchange, or use is affected by the interfering practice is |
Applicable type of harm1 |
Regulation Text References |
|
Patient exercising own right of access |
Patient's EHI |
Danger to life or physical safety of the patient or another person |
§ 171.201(d)(3), referencing HIPAA Privacy Rule § 164.524(a)(3)(i) |
|
Patient's EHI that references another person |
Substantial harm3 to such other person |
§ 171.201(d)(2), referencing HIPAA Privacy Rule § 164.524(a)(3)(ii) |
|
|
Patient's personal representative as defined in HIPAA Privacy Rule (45 CFR 164.502) exercising right of access to patient's EHI (for example, parent of a minor child)2 |
Patient's EHI |
Substantial harm3 to the patient or to another person |
§ 171.201(d)(1), referencing HIPAA Privacy Rule § 164.524(a)(3)(iii) |
|
Patient's EHI that references another person |
Substantial harm3 to such other person |
§ 171.201(d)(2), referencing HIPAA Privacy Rule § 45 CFR 164.524(a)(3)(ii) |
|
| Notes: | |||
|
1 - For simplicity of presentation, this table focuses only on patient access use case examples where risk has been determined on an individual basis (45 CFR 171.201(c)(1)). Where the risk arises from data that is known or reasonably suspected to be misidentified or mismatched, corrupt due to technical failure, or erroneous for another reason (45 CFR 171.201(c)(2)), the exception's applicable type of harm conditions (45 CFR 171.201(d)(3) and (4)) recognize only danger to life or physical safety of the patient or another person. |
|||
|
2 - For more information about the definition of a “personal representative” under the HIPAA Privacy Rule, please see https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html |
|||
|
3 - “Substantial harm” includes “substantial physical, emotional, or psychological harm” (see, for example, HIPAA Privacy Rule preamble at 65 FR 82556). |
|||
|
4 - In order for the Preventing Harm Exception to cover any practice likely to interfere with access, exchange, or use of EHI based on an individualized (45 CFR 171.201(c)(1)) determination of risk, the practice must also satisfy requirements in 45 CFR 171.201(a), (b), (e), and (f). |
|||
For more information about the Preventing Harm Exception, please reference the ONC Cures Act Final Rule preamble discussion and the other FAQs under the Preventing Harm Exception heading.
For more information about the HIPAA Privacy Rule, the Privacy Rule individual right of access, or grounds for denial of access under the Privacy Rule, please visit the Health Information Privacy section of the HHS website.