Information Blocking

Preventing Harm Exception

In which patient access cases does the Preventing Harm Exception recognize “substantial harm” ?

The Preventing Harm Exception at 45 CFR 171.201 relies on the same types of harm as apply for a covered entity to deny access to protected health information under the HIPAA Privacy Rule (see 45 CFR 164.524(a)(3)). Where an actor's practice, based on an individualized (45 CFR 171.201(c)(1)) determination of risk, is likely to interfere with a patient's or patient representative's access, exchange, or use of the patient's EHI, the type of harm (45 CFR 171.201(d)) needed for the exception to apply depends on who is seeking access to the EHI, and what EHI they are seeking to access.4

The table below shows the type of harm recognized under the Preventing Harm Exception for several commonly encountered patient access scenarios.1

Access, exchange, or use of patient's EHI

EHI for which access, exchange, or use is affected by the interfering practice is

Applicable type of harm1

Regulation Text References

Patient exercising own right of access

Patient's EHI

Danger to life or physical safety of the patient or another person

§ 171.201(d)(3), referencing HIPAA Privacy Rule § 164.524(a)(3)(i)

Patient's EHI that references another person

Substantial harmto such other person

§ 171.201(d)(2), referencing HIPAA Privacy Rule § 164.524(a)(3)(ii)

Patient's personal representative as defined in HIPAA Privacy Rule (45 CFR 164.502) exercising right of access to patient's EHI (for example, parent of a minor child)2

Patient's EHI

Substantial harmto the patient or to another person

§ 171.201(d)(1), referencing HIPAA Privacy Rule § 164.524(a)(3)(iii)

Patient's EHI that references another person

Substantial harmto such other person

§ 171.201(d)(2), referencing HIPAA Privacy Rule § 45 CFR 164.524(a)(3)(ii)

Notes:

1 - For simplicity of presentation, this table focuses only on patient access use case examples where risk has been determined on an individual basis (45 CFR 171.201(c)(1)). Where the risk arises from data that is known or reasonably suspected to be misidentified or mismatched, corrupt due to technical failure, or erroneous for another reason (45 CFR 171.201(c)(2)), the exception's applicable type of harm conditions (45 CFR 171.201(d)(3) and (4)) recognize only danger to life or physical safety of the patient or another person.

2 - For more information about the definition of a “personal representative” under the HIPAA Privacy Rule, please see https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html

3 - “Substantial harm” includes “substantial physical, emotional, or psychological harm” (see, for example, HIPAA Privacy Rule preamble at 65 FR 82556).

4 - In order for the Preventing Harm Exception to cover any practice likely to interfere with access, exchange, or use of EHI based on an individualized (45 CFR 171.201(c)(1)) determination of risk, the practice must also satisfy requirements in 45 CFR 171.201(a)(b)(e), and (f).

For more information about the Preventing Harm Exception, please reference the ONC Cures Act Final Rule preamble discussion and the other FAQs under the Preventing Harm Exception heading.

For more information about the HIPAA Privacy Rule, the Privacy Rule individual right of access, or grounds for denial of access under the Privacy Rule, please visit the Health Information Privacy section of the HHS website.

ID:IB.FAQ42.1.2022FEB

Where the patient is a minor and to avoid breaching the patient’s confidentiality and trust with the provider, will the Preventing Harm Exception cover an actor’s practices that interfere with a parent or legal representative’s access, exchange, or use of the minor’s EHI?

No. Unless an actor reasonably believes a practice that interferes with a parent or other legal representative’s requested access, exchange, or use of the minor’s electronic health information (EHI) will substantially reduce a risk of at least substantial harm to the patient or another person, the Preventing Harm Exception is not designed to cover that practice.

The Privacy Exception contains a sub-exception (45 CFR 171.202(e)) that covers practices respecting an individual’s request not to share information, subject to certain conditions.

ID:IB.FAQ31.1.2021JAN

Do the Preventing Harm Exception requirements for the type of harm align with the HIPAA Rules?

Yes. The Preventing Harm Exception’s type of harm condition relies on the same types of harm that serve as grounds for reviewable denial of an individual’s right of access under the Privacy Rule (45 CFR 164.524). (See ONC Cures Act Final Rule preamble Table 3—Mapping of Circumstances Under § 171.201(d) to Applicable Harm Standards.)

In most instances, including where a practice interferes with a patient’s own or the patient’s other health care providers’ legally permissible access, exchange, or use of the patient’s electronic health information (EHI), coverage under the Preventing Harm Exception requires that the risk be of physical harm. (See 45 CFR 171.201(d)(3) and (4).)

However, the Preventing Harm Exception’s type of harm condition applies a “substantial harm” standard for practices interfering with a patient’s representative’s requested access, exchange, or use of the patient’s EHI and to the patient’s or their representative’s access to other persons’ individually identifiable information within the patient’s EHI in some circumstances. (See 45 CFR 171.201(d)(1) and (2)).

ID:IB.FAQ32.1.2021JAN

Would the Preventing Harm Exception cover a “blanket” several day delay on the release of laboratory or other test results to patients so an ordering clinician can evaluate each result for potential risk of harm associated with the release?

No. Blanket delays that affect a broad array of routine results do not qualify for the Preventing Harm Exception. The Preventing Harm Exception is designed to cover only those practices that are no broader than necessary to reduce a risk of harm to the patient or another person.

As we discussed in the Cures Act Final Rule, a clinician generally orders tests in the context of a clinician-patient relationship. In the context of that relationship, the clinician ordering a particular test would know the range of results that could be returned and could prospectively formulate, in the exercise of their professional judgment, an individualized determination for the specific patient that:

  • withholding the results of the particular test(s) from the patient would substantially reduce a risk to the patient’s or another person’s life or physical safety
    - or -
  • that withholding the results of the particular test(s) from a representative of the patient would substantially reduce a risk of substantial harm to the patient or another person.

Such individualized determinations made in good faith by an ordering clinician, in the exercise of their professional judgment and in the context of the treatment relationship within which they order the test, would satisfy the type of risk and type of harm conditions of the Preventing Harm Exception. Actors, including but not limited to the ordering clinician, could implement practices in reliance on such determinations and the Preventing Harm Exception would cover such practices so long as the practices also satisfy the other four conditions of the exception.

ID:IB.FAQ33.1.2021JAN

Will the Preventing Harm Exception cover practices interfering with a patient’s access, exchange, or use of their EHI only for the purposes of reducing an imminent or immediate risk of harm? 

No. The reasonable belief condition does not include a requirement that the harm be expected to occur within a particular time period or that the likelihood of the harm be high enough to be considered “imminent.” (See 45 CFR 171.201(a)). The Preventing Harm Exception’s reasonable belief condition requires an actor engaging in a practice likely to interfere with a patient’s access, exchange, or use of their own EHI to have a reasonable belief that the practice will substantially reduce a risk to life or physical safety of the patient or another person that would otherwise arise from the affected access, exchange, or use.

ID:IB.FAQ34.1.2021JAN

Where the patient is a minor and to reduce a risk of harm other than physical abuse, will the Preventing Harm Exception cover an actor’s practices that interfere with a parent or legal guardian’s access, exchange, or use of the minor’s EHI?

Yes, where the risk of harm has been determined on an individualized basis and all other conditions of the Preventing Harm Exception are met. For example, the practice must be no broader than necessary and the actor must reasonably believe the practice will substantially reduce the risk of harm. (For all the conditions of the Preventing Harm Exception, please see 45 CFR 171.201.)

For purposes of the Preventing Harm Exception, a parent or legal guardian would be considered a patient’s legal representative. The Preventing Harm Exception’s type of harm condition applies a “substantial harm” standard for practices interfering with a patient’s representative’s requested access, exchange, or use of the patient’s EHI. (See 45 CFR 171.201(d)(1)).

The type of harm conditions for Preventing Harm Exception coverage of practices interfering with patients’ and their representatives’ access to EHI on the basis of an individualized determination of risk are specifically aligned with the HIPAA Privacy Rule’s grounds for reviewable denial of an individual’s right of access under the Privacy Rule. (See also ONC Cures Act Final Rule preamble discussion and Table 3—Mapping of Circumstances Under § 171.201(d) to Applicable Harm Standards).

ID:IB.FAQ35.1.2021JAN