Guide

Break-glass disclosures: emergencies and the documentation after

Summary

In a genuine emergency you may disclose protected health information without authorization when doing so is necessary to prevent or lessen a serious and imminent threat to someone's health or safety, and to a person able to act on it. You may also share limited information with family already involved in care, and with medical staff treating a client in crisis. Disclose only what the situation requires, then document the decision the same day.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

The disclosure HIPAA already permits in a crisis

The Privacy Rule permits — it does not require — a covered entity to disclose protected health information without authorization to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, so long as the disclosure goes to someone reasonably able to prevent or lessen it 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.OCR mental-health guidance that HIPAA permits disclosing PHI to prevent or lessen a serious and imminent threat, and to family involved in care.. That covers calling emergency services, warning an identifiable person at risk, or alerting a caregiver who can intervene.

The standard has two moving parts: your good-faith belief that a threat is serious and imminent, and a recipient positioned to act on it. You are generally presumed to act in good faith when your belief rests on your own observation or on a credible communication from someone who knows the client. Because this is a permission and not a mandate, the decision — and the reasoning behind it — is yours to make and yours to record.

Talking to family and others involved in the client's care

When a client is present and has capacity, you may share information directly relevant to that person's involvement in the client's care with family or friends helping in that care — if the client agrees, does not object when given the chance, or you can reasonably infer from the circumstances that they would not object 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.OCR mental-health guidance that HIPAA permits disclosing PHI to prevent or lessen a serious and imminent threat, and to family involved in care.. When the client is incapacitated or not present, you may use professional judgment to decide a limited disclosure is in their best interest, such as telling a spouse the client has been taken to an emergency department.

A personal representative — someone with legal authority to make health-care decisions for the client — stands in the client's shoes and generally has the same access the client would 2Ref 2HHS Office for Civil Rights (2026).Personal Representatives.That a personal representative generally has the client's access rights, with state law defining who qualifies and abuse/endangerment exceptions.. State law defines who qualifies, and it carves out exceptions when the representative may be the source of abuse or endangerment.

Psychotherapy notes in an emergency

Psychotherapy notes carry a second lock. They are the private analysis you keep separate from the rest of the chart, and they generally require the client's written authorization to disclose — even to a payer 3Ref 3HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are kept separate and generally require the client's authorization to disclose, even to a payer.. The serious-and-imminent-threat permission is one of the few exceptions that reaches them: you may disclose psychotherapy notes without authorization when doing so is necessary to avert that threat 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.OCR mental-health guidance that HIPAA permits disclosing PHI to prevent or lessen a serious and imminent threat, and to family involved in care..

Outside that narrow exception, the emergency permission that opens the general record does not unlock the notes. Keeping the two tiers physically and logically separate is what preserves the distinction — a note dumped into the running progress record loses its heightened protection, and with it your ability to withhold it later.

The 42 CFR Part 2 medical-emergency exception

If any of what you would disclose originated in substance use disorder treatment covered by 42 CFR Part 2, a stricter regime governs — and it, too, has an emergency door. Part 2 permits disclosure to medical personnel without the patient's consent when there is a bona fide medical emergency and obtaining consent is impractical because immediate treatment is needed 4Ref 4Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The Part 2 bona fide medical-emergency exception permitting disclosure to medical personnel without the patient's consent.. You then document who received the information, the nature of the emergency, and the date in the patient's record.

The 2024 Part 2 final rule, in effect since early 2026, aligned much of Part 2's consent machinery with HIPAA — a single patient consent can now authorize future treatment, payment, and health-care operations uses — but it left the medical-emergency exception intact 5Ref 5Substance Abuse and Mental Health Services Administration (2024).Confidentiality of Substance Use Disorder (SUD) Patient Records.The 2024 Part 2 final rule's single-consent alignment with HIPAA while preserving the medical-emergency exception.. If your chart blends general mental-health material with Part 2 content, handle the Part 2 portion by the stricter standard.

Minimum necessary, even when the glass is broken

Even a lawful emergency disclosure is bounded by the minimum necessary standard: you release only the information the situation actually requires, not the entire file 6Ref 6HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.Core Privacy Rule permissions including minimum necessary and the individual's right to an accounting of disclosures.. Break-glass is the honest image for it — you break the pane, take the one item needed to stop the harm, and leave the rest behind the glass.

A crisis is never a reason to hand over a whole chart, and it is a different question entirely from when the client wants everything in their own record, which runs on the access right rather than an emergency exception. It is also never a shortcut for convenience, curiosity, or outreach. When you are unsure, disclose the narrower set and note what you withheld and why.

The documentation after

The disclosure is only half the task; the note you write afterward protects both the client and you. Record the date and time, exactly what you released, who received it, the specific threat or emergency that justified it, and the professional judgment you applied. Because a covered entity must generally be able to account for disclosures made outside treatment, payment, and operations, a client may later request the accounting of disclosures — so keep the entry retrievable and precise 6Ref 6HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.Core Privacy Rule permissions including minimum necessary and the individual's right to an accounting of disclosures..

This is a different animal from incidental disclosures — the overheard-in-the-waiting-room byproducts of ordinary operations that the rule tolerates when you have reasonable safeguards. An emergency disclosure is deliberate, and a deliberate disclosure earns a deliberate note.

What to record	Why it matters
Date and time of the disclosure	Fixes the sequence if the decision is later questioned
What you disclosed, specifically	Shows you released only the minimum necessary
Who received it and their role	Confirms the recipient could act on the threat
The threat that justified it	Establishes the serious-and-imminent basis
The professional judgment you applied	Documents the good faith you are measured against

When it's a subpoena, not an emergency

Not every urgent-feeling demand is an emergency. A subpoena, an attorney's letter, or a payer's records request runs on the ordinary disclosure track, not the break-glass exception. A court order lets you disclose only what the order specifies; a bare subpoena that no judge has signed requires satisfactory assurances — that the client has been notified, or that a protective order is in place — before you produce anything 7Ref 7HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That a court order authorizes only what it specifies while a bare subpoena requires satisfactory assurances before disclosure..

All of this also assumes HIPAA reaches your practice at all, which the covered-entity test decides. And routine sharing for payment — payers and the chart — still follows minimum necessary, not the emergency rule. When a request arrives dressed as urgent, slow down and route it through the process it actually belongs to.

Common questions

HIPAA's serious-and-imminent-threat provision is a permission, not a command — it lets you disclose but never forces you to. Some states layer a separate duty to warn or protect on top of it, which can compel action; that duty comes from state law, not HIPAA, so check your own jurisdiction's rule. Document your reasoning either way, because the judgment is yours.

Yes, within limits. When the client is present and capable, you may share information involved in their care if they agree or do not object. When the client is incapacitated, you may use professional judgment to make a limited disclosure in their best interest. In both cases you share only what the situation needs, never the full record by default.

No — records from a Part 2 program are stricter. Part 2 has its own bona fide medical-emergency exception that lets you disclose to treating medical personnel without consent, but ordinary emergencies outside that narrow door still need consent or another Part 2 basis. If your notes mix general mental-health and Part 2 material, treat the Part 2 content by the stricter standard.

Record the date and time, exactly what you disclosed, who received it, the specific threat or emergency that justified it, and the professional judgment you applied. This entry supports a later accounting of disclosures and shows a reviewer you took only what averting the danger required. Write it the same day, while the details are still exact.

No. A subpoena, attorney letter, or payer demand runs on the ordinary disclosure track, not the break-glass exception. A court order lets you release only what it specifies; a plain subpoena requires satisfactory assurances — notice to the client or a protective order — before you produce records. Treat urgency in the request as a reason to slow down, not to skip steps.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). HIPAA Privacy Rule and Sharing Information Related to Mental Health. U.S. Department of Health and Human Services. linkOCR mental-health guidance that HIPAA permits disclosing PHI to prevent or lessen a serious and imminent threat, and to family involved in care.
2.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkThat a personal representative generally has the client's access rights, with state law defining who qualifies and abuse/endangerment exceptions.
3.HHS Office for Civil Rights (2026). Does HIPAA provide extra protections for mental health information compared with other health information?. U.S. Department of Health and Human Services. linkThat psychotherapy notes are kept separate and generally require the client's authorization to disclose, even to a payer.
4.Office of the Federal Register (2026). 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records. eCFR. link ✓The Part 2 bona fide medical-emergency exception permitting disclosure to medical personnel without the patient's consent.
5.Substance Abuse and Mental Health Services Administration (2024). Confidentiality of Substance Use Disorder (SUD) Patient Records. Federal Register. link ✓The 2024 Part 2 final rule's single-consent alignment with HIPAA while preserving the medical-emergency exception.
6.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkCore Privacy Rule permissions including minimum necessary and the individual's right to an accounting of disclosures.
7.HHS Office for Civil Rights (2026). Court Orders and Subpoenas. U.S. Department of Health and Human Services. linkThat a court order authorizes only what it specifies while a bare subpoena requires satisfactory assurances before disclosure.

https://www.gale.care/for-providers/pr-emergency-disclosures-consent · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers