Research · 12 min read
What a Provider May Report When It Believes Someone Is at Risk
Two standards in the federal privacy rule turn on a belief rather than on a subpoena or a signature. They are also the two places where the rule says something about whether the person in the record gets told.
Key takeaways
- Two standards in the section run on the entity's belief rather than on a document arriving from outside.
- The abuse standard reaches a government authority authorized to receive such reports, and it excludes child abuse reports, which travel another paragraph.
- It also carries the section's clearest duty to the individual: prompt notice that a report has been or will be made, with two printed exceptions.
- The serious threat standard requires both that the disclosure be necessary and that it go to someone reasonably able to prevent or lessen the threat.
- A statement learned in counseling, therapy or a referral request for that treatment is carved out of the law enforcement limb.
- A presumption of good faith applies where the belief rests on actual knowledge or on a credible representation by someone with apparent knowledge or authority.
Answer first: belief is the trigger, and conditions follow it
Most routes in this section of the privacy rule start with something arriving. A court order, an administrative demand, a legal reporting duty.
Two do not. One covers disclosures about a person the entity reasonably believes to be a victim of abuse, neglect or domestic violence. The other covers disclosures to avert a serious threat.
Both are permissions. Neither says a covered entity must do anything, and both attach conditions to what the belief can produce.
They are also the pair worth reading together, because they answer opposite versions of the same question. One is about a person being harmed, the other about a person feared to be dangerous.
The abuse standard, and the report it carves out first
The standard opens by excluding something. Reports of child abuse or neglect are permitted by a different paragraph, inside the public health standard, and they travel that route rather than this one.
What remains covers an individual the covered entity reasonably believes to be a victim of abuse, neglect or domestic violence. The recipient is a government authority authorized by law to receive such reports, including a social service or protective services agency.
Three doors then open onto that, and only one of them involves the person agreeing.
The first is where the disclosure is required by law, limited to what that law actually requires. The second is where the individual agrees.
The third is where a statute or regulation expressly authorizes the disclosure, and one of two further things is true.
The third door, and the two ways through it
The first way is professional judgment. The covered entity, exercising it, believes the disclosure is necessary to prevent serious harm to the individual or to other potential victims.
The second way applies where the individual is unable to agree because of incapacity, and it does not run on the entity's judgment alone.
A law enforcement or other public official authorized to receive the report has to represent two things. That the information sought is not intended to be used against the individual.
And that an immediate enforcement activity depending on the disclosure would be materially and adversely affected by waiting until the individual can agree.
Both representations come from the requester, which is a pattern this section uses whenever it lets someone else's statement stand in for the person's own.
The duty that runs back to the person
This standard does something the rest of the section mostly does not. It creates a duty owed to the individual.
A covered entity making one of these disclosures has to promptly inform the individual that a report has been or will be made.
Two exceptions are printed, and both are narrow. The first is where the entity, in the exercise of professional judgment, believes informing the individual would place that person at risk of serious harm.
The second concerns a personal representative. Where the entity would be informing one, it may withhold the information in a stated case. That is where it reasonably believes the representative is responsible for the abuse, neglect or other injury, and telling that person would not be in the individual's best interests.
A rule of construction closes the standard. Nothing in the section may be read to permit a disclosure that a separate prohibition forbids, where the sole basis of the report is the provision or facilitation of reproductive health care.
The serious threat standard has two limbs
The second standard permits use or disclosure consistent with applicable law and standards of ethical conduct, where the covered entity in good faith believes one of two things.
The first limb has two halves joined by an and, and both have to hold. The use or disclosure has to be necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
And it has to go to a person or persons reasonably able to prevent or lessen the threat. The rule adds three words there: including the target of the threat.
That second half is the part most summaries drop. A belief that a threat is serious does not open a disclosure to anyone at all, only to someone positioned to act on it.
The second limb is narrower and points at law enforcement. It covers information necessary to identify or apprehend a person, in two situations only.
The two situations, and the counseling exception
The first is a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim.
The second is where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody.
An exception then removes the first situation in the setting where such a statement is most likely to be said out loud.
The permission does not apply where the entity learned the statement in the course of treatment to affect the propensity to commit the conduct in question, or in counseling or therapy. Nor where it learned it through a request by the individual to start or be referred for that treatment.
A limit on content sits alongside it. A disclosure made on such a statement may contain only the statement itself and the same short identification list the law enforcement standard uses.
The presumption written into the standard
A final paragraph tells you how the good faith requirement is judged, and it leans one way.
A covered entity acting under this standard is presumed to have acted in good faith about its belief, in two circumstances.
Where the belief rests on the entity's own actual knowledge. Or where it rests on a credible representation by a person with apparent knowledge or authority.
A presumption is not a guarantee, and the rule states it as a presumption rather than as a rule of immunity. It does mean the standard is written to be usable in the moment rather than reconstructed afterwards.
What a reader can actually look at
Whether a privacy notice describes either purpose, since a notice has to cover uses that need no authorization from you.
Whether it says anything about telling you afterwards, because one of these two standards requires prompt notice and the other says nothing.
Whether a program describes who its clinicians are and what state they are licensed in, since professional judgment is exercised by a licensed person somewhere.
Whether the notice separates a disclosure to a protective agency from a disclosure to law enforcement, because the two standards send information to different places.
And whether a company's stated policy is narrower than the rule, since a company may promise more than the regulation requires of it.
What this does not decide
It does not say that any company has ever made such a disclosure, and it names no one.
It does not decide what a clinician should do in any situation. Both standards are permissions, and the professional judgment they refer to belongs to a licensed clinician rather than to a rulebook.
It does not describe the prohibition the abuse standard's rule of construction points at, which lives in a different section and is covered separately.
And it is not legal advice. It reports what two standards of one federal subpart say, in their own terms.
Sources
- 45 CFR 164.512, "Uses and disclosures for which an authorization or opportunity to agree or object is not required", read at paragraphs (c) and (j)Paragraph (c)(1), permitting disclosure about an individual the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence, and excluding from that paragraph reports of child abuse or neglect permitted by paragraph (b)(1)(ii). Paragraphs (c)(1)(i) through (iii), the three routes: to the extent the disclosure is required by law and is limited to the relevant requirements of such law; where the individual agrees; and where the disclosure is expressly authorized by statute or regulation and either the covered entity in the exercise of professional judgment believes the disclosure is necessary to prevent serious harm to the individual or other potential victims, or the individual is unable to agree because of incapacity and an official authorized to receive the report represents both that the information is not intended to be used against the individual and that an immediate enforcement activity depending on the disclosure would be materially and adversely affected by waiting. Paragraph (c)(2), the duty to promptly inform the individual that such a report has been or will be made, and its two exceptions. Paragraph (c)(3), the rule of construction on reports whose sole basis is the provision or facilitation of reproductive health care. Paragraph (j)(1), permitting use or disclosure consistent with applicable law and standards of ethical conduct on a good faith belief, and its two limbs: that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or that it is necessary for law enforcement authorities to identify or apprehend an individual, either because of a statement admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim, or where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody. Paragraph (j)(2), that the first of those two situations does not permit a use or disclosure where the information was learned in the course of treatment to affect the propensity to commit the criminal conduct, or in counseling or therapy, or through a request by the individual to initiate or be referred for such treatment. Paragraph (j)(3), the limit confining such a disclosure to the statement itself plus the information described in paragraph (f)(2)(i). Paragraph (j)(4), the presumption of good faith where the belief is based upon the covered entity's actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority.
- 45 CFR 164.501, "Definitions", read at the defined term correctional institutionThe definition of correctional institution, which 45 CFR 164.512(j)(1)(ii)(B) points to: any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program center operated by, or under contract to, the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, for the confinement or rehabilitation of persons charged with or convicted of a criminal offense or other persons held in lawful custody. The same entry describes who those other persons are, naming juvenile offenders adjudicated delinquent, aliens detained awaiting deportation, persons committed to mental institutions through the criminal justice system, witnesses, and others awaiting charges or trial. Lawful custody is described inside that entry rather than defined separately.
Frequently asked questions
Can a provider report a suspicion of abuse without my agreement?
The standard permits it on stated conditions. It covers an individual the covered entity reasonably believes to be a victim of abuse, neglect or domestic violence. The recipient is a government authority authorized by law to receive such reports, including a social service or protective services agency. Three doors open onto it. The first is where the disclosure is required by law and limited to what that law requires, and the second is where the individual agrees. The third is where a statute or regulation expressly authorizes it, and one of two further things is true. Either the entity's professional judgment finds the disclosure necessary to prevent serious harm to the individual or other potential victims. Or the individual cannot agree because of incapacity and an official makes two stated representations. Reports of child abuse or neglect travel a different paragraph.
Would I be told that such a report was made?
This is the one standard in the section that says so. A covered entity making the disclosure must promptly inform the individual that a report has been or will be made. Two exceptions are printed. The first is where the entity, in the exercise of professional judgment, believes informing the individual would place that person at risk of serious harm. The second concerns a personal representative the entity reasonably believes is responsible for the abuse, neglect or other injury. There the entity may withhold notice if telling that person would not be in the individual's best interests.
What does the serious threat standard actually require?
A good faith belief, plus two things that both have to hold. The use or disclosure has to be necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. And it has to be made to a person or persons reasonably able to prevent or lessen that threat, which the rule says includes the target of the threat. The second half is a real limit: a belief that a threat exists does not open a disclosure to anyone, only to someone positioned to act. A separate limb covers information necessary for law enforcement to identify or apprehend a person, in two narrow situations.
Does something said in counseling fall under this?
The rule carves that out. The limb covering a statement admitting participation in a violent crime carries an exception. It does not apply where the covered entity learned that statement in the course of treatment to affect the propensity to commit the conduct, or in counseling or therapy. It also does not apply where the entity learned it through a request by the individual to start or be referred for that treatment. Where a disclosure is permitted on such a statement, the content is limited to the statement itself plus the same short identification list the law enforcement standard uses.
What is the presumption of good faith?
A paragraph at the end of the serious threat standard says a covered entity using or disclosing information under it is presumed to have acted in good faith with regard to its belief. That presumption applies where the belief is based upon the entity's own actual knowledge, or in reliance on a credible representation by a person with apparent knowledge or authority. The rule states it as a presumption rather than as immunity. It sits alongside the standard's opening words, which require the use or disclosure to be consistent with applicable law and standards of ethical conduct.
Do these standards apply to a telehealth weight program?
Whether any privacy standard applies to a particular business is decided by whether that business is a covered entity or a business associate, which is a definitional question covered separately. Where the rules do apply, these two standards apply the same way they do anywhere else, because neither one is written for a setting or a specialty. Both are permissions with conditions attached, and neither says anything about what any individual company chooses to do.