Go BackInformation Sharing Toolkit
Information sharing can be a challenge for overdose fatality review (OFR) teams and their members. To assist teams in capturing as much information as possible about a decedent to make meaningful recommendations for prevention, Legislative Analysis and Public Policy Association (LAPPA), in partnership with IIR, developed information sharing fact sheets. These fact sheets provide OFR teams an understanding of what members legally can and cannot share regarding federal law (such as 42 CFR and HIPAA).
Modules
- Obtaining Medical Records
- Obtaining Behavioral Health Records
- Obtaining Educational Records
- Obtaining Child Services Records
- Obtaining Prescription Drug Monitoring Program (PDMP) Records
- Obtaining Next of Kin Consent
- Allowing Nonmember Professional Observers
- Limiting Use of Shared Information
- Freedom of Information Act Request
- Sharing Overdose Detection Mapping Application Program (ODMAP) Data
- Obtaining medical and behavioral health records from the Veterans Health Administration
- Obtaining medical records from the Indian Health Service
-
Obtaining Medical Records
How can an OFR team obtain medical records after a person dies?
Medical records containing protected health information (PHI) are safeguarded by the Health Insurance Portability and Accountability Act (HIPAA) for 50 years after an individual dies. Therefore, to obtain medical records of a decedent that contain PHI from a HIPAA-covered entity, an OFR team must rely on one of the following options:
- State statute, state regulation, or local ordinance that specifically allows an OFR team to receive the information.
- State statute, state regulation, or local ordinance that allows a public health authority to access medical records for certain purposes (such as health surveillance or death investigations).
- Authorization form signed by the decedent’s authorized personal representative.
Obtaining Behavioral Health Records
How can an OFR team obtain behavioral health records after a person dies?
Behavioral health records that DO NOT contain Part 2 records are treated the same as other medical records. Medical records containing protected health information (PHI) are safeguarded by the Health Insurance Portability and Accountability Act (HIPAA). Therefore, in order to obtain a decedent’s behavioral health records from a HIPAA-covered entity when such records do not contain Part 2 records but do contain PHI, an OFR team must rely on one of the following options:
- State statute, state regulation, or local ordinance that specifically allows an OFR team to receive the information.
- State statute, state regulation, or local ordinance that allows a public health authority to access the records for certain purposes (such as heath surveillance or death investigations).
- Authorization form signed by the decedent’s authorized personal representative.
The disclosure of behavioral health records that DO contain Part 2 records is covered by 42 U.S.C. § 290dd-2 and 42 CFR Part 2. Under these laws and regulations, OFR teams have only two options to attempt to obtain these records. These options are:
- Relying on a state law requiring the collection of death or other vital statistics or permitting inquiry into the cause of death that allows Part 2 records to be shared with an OFR team.
- Obtaining consent from the decedent’s executor or personal representative, or where no such person is appointed, his or her next of kin.
Obtaining Educational Records
How can an OFR team obtain educational records after a person dies?
If the decedent meets the U.S. Department of Education definition of “eligible student,” the privacy protections afforded by the Family Educational Rights and Privacy Act (FERPA) lapse or expire upon the death of the student.
An “eligible student” is a student who is:
- Over age 18; or
- Under age 18 but enrolled in an institute of higher learning (e.g., college, university, community college).
In situations where neither (1) nor (2) are true at the time of death, the decedent’s privacy rights under FERPA are held by his or her parents until their deaths. In that situation, the OFR team would need a consent form signed by the parents allowing the team to access the records or to have the parents request the records on behalf of the OFR team.
Obtaining Child Services Records
How can an OFR team obtain child services records after a person dies?
The only way an OFR team can acquire records directly from the state department of children’s services is through state statute requiring that the records be provided to the OFR team upon request. Alternatively, OFR teams may wish to interview the family or friends of the decedent for any information or reports they can provide regarding the decedent’s potential involvement with children’s services.
Obtaining PDMP Records
How can an OFR team obtain Prescription Drug Monitoring Program records after a person dies?
In the absence of a specific state statute or regulation authorizing the release of Prescription Drug Monitoring Program (PDMP) records to an OFR team, it is unlikely the team can directly receive prescription information from the state PDMP. However, OFR teams should contact the administrator of their state PDMP to determine if other avenues exist through which one or more team members can obtain PDMP records in the absence of direct authority, such as via the decedent’s medical file or a next of kin request.
Obtaining Next of Kin Consent
Does an OFR team need signed consent to share information from the decedent’s friends or family?
No. Health information known firsthand by a decedent’s family, friends, next of kin, or other loved ones is not subject to the Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 290dd-2, or 42 CFR Part 2. This is because these individuals are neither HIPAA-covered entities nor Part 2 programs. Therefore, the OFR team is free to speak with any of the decedent’s family or friends without needing a release or consent form, and any information received by the team from a decedent’s family or friends can and should be shared freely with the rest of the OFR team.
Allowing Nonmember Professional Observers
How can an OFR team include nonmember professional observers?
Individuals who are not members of the OFR team (such as professionals from other communities, medical professionals, or other individuals who may have information relevant to the review of a particular decedent’s case) can attend OFR team meetings. However, the OFR team must ensure that:
- Proper mechanisms are in place to allow the team to validly redisclose information about the decedent to nonmembers; and
- Observers have signed a confidentiality agreement that expressly acknowledges that they are prohibited from redisclosing any information shared during the OFR team meeting.
For each type of information that an OFR team anticipates disclosing during an OFR team meeting at which observers will be present, the OFR team should:
- Determine the applicable law covering redisclosure of that type of information.
- Ensure that data-sharing agreements, if any, between the OFR team and the entity providing the information at issue appropriately cover redisclosure to observers.
- Ensure that confidentiality/nondisclosure agreements appropriately cover their ability to receive, use, and redisclose information discussed at the meeting.
Working through these issues may be challenging for an OFR team. Teams may need to discuss the various options with the legal department in the agency that houses the team, or the team may decide to only disclose deidentified information.
Limiting Use of Shared Information
How can an OFR team limit attendees’ use of shared information?
OFR teams can limit how information shared in an OFR team meeting can be used by attendees (such as police departments and prosecutors’ offices that pursue charges against those who sold drugs to overdose victims) by using interagency data-sharing agreements and confidentiality agreements.
OFR teams can limit how information shared in an OFR team meeting can be used by attendees (such as police departments and prosecutors’ offices that pursue charges against those who sold drugs to overdose victims) by using interagency data-sharing agreements and confidentiality agreements.
In addition, the OFR team should require each team member and observer to sign a confidentiality agreement that sets out all requirements for keeping information shared during the meeting confidential and that prohibits any use of such information not in alignment with the OFR team’s goals and responsibilities. The confidentiality agreement should be clear that it does not prevent a team member from fulfilling any agency-mandated responsibilities of that individual.
Freedom of Information Act Request
Must an OFR team comply with a freedom of information act request?
Maybe. The answer depends on the contents of the state law(s) that apply to disclosure of information held by an OFR team. States with OFR-specific statutes often address this issue by exempting an OFR team from state freedom of information act laws or declaring OFR information confidential. In the absence of such provisions, however, an OFR team should consult a local attorney to determine what, if any, OFR records must be produced under other protections/exceptions that exist in state disclosure laws (e.g., protections against disclosure of individuals’ health information or confidentiality of ongoing death investigation and public health authority investigation data or information).
Sharing Overdose Detection Mapping Application Program (ODMAP) Data
May an overdose fatality review (OFR) team member with authorized access to the Overdose Detection Mapping Application Program’s (ODMAP) National Map share ODMAP overdose spike and aggregate data trend information to provide additional context to the OFR team?
Yes. Using ODMAP in this fashion does not violate federal health information privacy laws. In addition, it is allowed under ODMAP’s policies and procedures. For example, an ODMAP user participating on an OFR team can share—with respect to the general location of the fatal overdose under review—the number of overdose incidents reported to ODMAP in the days surrounding the fatal overdose and how this number compares to the typical number of overdose incidents in that area. The OFR team in Ocean County, New Jersey, uses ODMAP information in this manner.
Do note that only authorized users at ODMAP participating agencies granted access to the National Map by the agency administrator may view the National Map’s informational dashboard. Accordingly, for ODMAP information to be used in any form by an OFR team, one or more OFR team members must have access to the National Map.
Sharing Overdose Detection Mapping Application Program (ODMAP) Data
How can an OFR team obtain medical and behavioral health records from the Veterans Health Administration (VHA) after a person dies?
Medical records held by the VHA containing protected health information (PHI) are safeguarded by the Health Insurance Portability and Accountability Act (HIPAA) for 50 years after an individual dies. As such, medical records that do not contain substance use disorder (SUD) treatment information may be obtained the same as from private medical providers.
Behavioral health records held by the VHA fall into one of two categories:
- Behavioral health records that do not contain SUD treatment records, such as records related to treatment for depression or anxiety.
- Behavioral health records that do include SUD treatment records.
Behavioral health records held by the VHA that DO include SUD treatment records are governed not by 42 Code of Federal Regulations (CFR) Part 2, as non-VHA SUD treatment records are, but by 38 CFR Part 1. Pursuant to this rule, records that would identify a patient as an “alcohol or drug user,” either directly or indirectly, and are provided or obtained for the purpose of treating SUD, making a diagnosis for that treatment, or making a referral for that treatment are restricted from disclosure.
Obtaining medical records from the Indian Health Service
How can an OFR team obtain medical records, including behavioral health records, from the Indian Health Service?
Overdose fatality review (OFR) teams can obtain medical records, including behavioral health records, from the Indian Health Service (IHS) in the same fashion as teams obtain such records from non-IHS medical providers, with one possible complicating factor.
IHS medical records containing protected health information (PHI) are safeguarded by the Health Insurance Portability and Accountability Act (HIPAA) for 50 years after an individual dies. Therefore, to obtain the medical records of a decedent that contain PHI from the IHS, an OFR team must rely on one of the following options:
- State statute, state regulation, or local ordinance that specifically allows an OFR team to receive the information and applies to the IHS. (The second part of this is the complicating factor, discussed more thoroughly below.)
- State statute, state regulation, or local ordinance that allows a public health authority to access medical records for certain purposes (such as health surveillance or death investigations)
- Authorization form signed by the decedent’s authorized personal representative
Behavioral health records, meanwhile, fall into one of two categories:
- Behavioral health records that do not contain 42 Code of Federal Regulations (CFR) Part 2 records, such as records about treatment for depression or anxiety
- Behavioral health records that do include 42 CFR Part 2 records
Behavioral health records that DO NOT contain Part 2 records are treated the same as other medical records. The disclosure of behavioral health records at the IHS that DO contain Part 2 records is covered by 42 United States Code (U.S.C.) § 290dd-2 and 42 CFR Part 2. Under these laws and regulations, OFR teams have only two options to attempt to obtain these records. These options are as follows:
- Relying on a state law that requires the collection of death or other vital statistics or permitting inquiry into the cause of death that allows Part 2 records to be shared with an OFR team and applies to the IHS
- Obtaining consent from the decedent’s executor or personal representative or, where no such person is appointed, the decedent’s next of kin
Behavioral health records held by the VHA that DO include SUD treatment records are governed not by 42 Code of Federal Regulations (CFR) Part 2, as non-VHA SUD treatment records are, but by 38 CFR Part 1. Pursuant to this rule, records that would identify a patient as an “alcohol or drug user,” either directly or indirectly, and are provided or obtained for the purpose of treating SUD, making a diagnosis for that treatment, or making a referral for that treatment are restricted from disclosure.
OFR State Legislation Resources
-
This Model OFR Teams Act addresses the duties, responsibilities, and composition of OFR teams in order for them to properly examine and understand the circumstances leading up to a fatal overdose.
-
This OFR Summary of State laws outlines state-by-state statutes related to overdose fatality review as a point of reference for the development of new state statute(s).
Appendix
-
Overdose Fatality Review Knowledge Lab
Online Resource - 10/27/2023
The OFR Model Law Virtual Knowledge Lab provides state and county leaders with an opportunity to deepen their awareness and understanding of how OFR model law can assist jurisdictions in implementing OFRs.
The Overdose Fatality Review Knowledge Lab highlights state policy and legislative activities related to the Model Overdose Fatality Review Teams Act
Explore More
Launch your OFR
Learn more about OFR, and find resources and practical steps to start an OFR.
Strengthen your ofr
Find out what other OFRs are doing, lessons learned, and national standards and tools.
Resource Library
Access OFR tools including videos, podcasts, fact sheets, manuals, templates, and sample materials from your OFR peers.