U.S. Department of Health and Human Services (HHS) Issues Guidance on Health Insurance Portability and Accountability Act (HIPAA) and Disclosures of Protected Health Information for Extreme Risk Protection Orders (ERPO)

The U.S. Department of Health and Human Services’ (HHS) through its Office for Civil Rights (OCR) is issuing guidance to help clarify how the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule permits covered health care providers to disclose protected health information to support applications for extreme risk protection orders that temporarily prevent a person in crisis, who poses a danger to themselves or others, from accessing firearms.  This guidance helps implement the U.S. Department of Justice’s model extreme risk protection order legislation that provides a framework for states to consider in creating laws allowing law enforcement, concerned family members, or others to seek these orders and to intervene in an effort to save lives.  These orders can be an important step toward improving the public’s safety by helping to prevent firearm injuries and deaths.

The guidance issued today by OCR provides new guidance to support an extreme risk protection order on how HIPAA allows covered health care providers to disclose protected health information about an individual, without the individual’s authorization. The guidance includes specific examples for each permission.

“Too often, communities bear the weight of heartbreaking tragedies caused by the epidemic of gun violence in our country,” said HHS Secretary Xavier Becerra. “Today’s guidance on HIPAA and Extreme Risk Protection Orders is an important step the Biden-Harris Administration is taking towards protecting communities from gun violence by allowing law enforcement, concerned family members, or others to prevent a person in crisis from accessing fire arms.”

“HIPAA should not be a barrier to communication for law enforcement, concerned family members, health care providers, and others when they see an individual in crisis,” said OCR Director Lisa J. Pino. “Today’s guidance helps clarify legal requirements and to better support individuals in crisis.”

The Guidance on HIPAA and Disclosures of Protected Health Information for Extreme Risk Protection Orders may be found at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/extreme-risk-protection-orders/index.html.