Does HIPAA require a mental health provider to inform a patient before sharing PHI to prevent or lessen a serious or imminent threat?

• A. Not at the time of disclosure; the Notice of Privacy Practices should include an example; exceptions exist for abuse reporting.
• B. Yes, always before disclosure.
• C. Only if the patient is present.
• D. Only if the patient signs a release.

Answer: (B)

Disclosures to prevent a serious or imminent threat are permitted under HIPAA without patient authorization or prior notice. The Privacy Rule allows sharing necessary PHI to prevent harm to a specific individual or the public, so you’re not required to obtain the patient’s consent or inform them before making the disclosure. The Notice of Privacy Practices should describe the kinds of disclosures that may occur without consent, including examples of threat-related situations, and there are legal justifications for abuse reporting under applicable laws. In practice, you document the rationale and limit the disclosure to the minimum necessary information, and you may inform the patient afterward if appropriate and feasible. The other options imply that pre-disclosure consent, patient presence, or a signed release are needed, which is not how the imminent-threat disclosure rule works.