With Whom Can the Hospital Discuss Medical Conditions?
A fairly common question from healthcare providers is whether a hospital or physician may disclose protected health information to family members or other people involved in the patient’s care. The same question also extends to contacting the family with respect to payment for the patient’s care.
The Healthcare Information Portability and Accountability Act (HIPAA) privacy rules generally allow such disclosures under the following circumstances:
- Disclosures to family members and others involved in the patient’s healthcare. There are certain circumstances in which HIPAA allows hospitals and physicians to disclose information to family members and others involved in the patient’s healthcare and/or payments.
If the patient is present and able to make decisions, the hospital/physician must:
a) Obtain the patient’s permission; or
b) Reasonably conclude that the patient does not object to the disclosure of said information. (45 CFR 64.510(b)(2)).
If the patient is not present or is unable to consent to a release, the hospital/physician may disclose the information so long as:
a) The hospital believes it is in the patient’s best interest to make the disclosure;
b) The patient has not otherwise objected to such disclosures; and
c) The hospital limits the information disclosed to what is relevant to the family member or other person’s involvement in the patient’s healthcare. ( at 164.510(b)(3)).
Common examples include a physician talking to a friend who accompanies the patient to the hospital, or to family member who pays the patient’s medical bills, so long as the patient does not object.
- Disclosures to the personal representative. HIPAA allows healthcare providers to disclose protected health information to the patient’s personal representative. A personal representative generally has the right to access a patient’s personal health information to the same extent as a patient. (45 CFR 164.502(a)(2)(i) and (g)).
For purposes of HIPAA, a “personal representative” is the person with authority under applicable state law to make healthcare decisions for the patient.
Examples include:
a) The parent of an unemancipated minor.
b) The spouse of an incapacitated adult. ( at 164.502(g)).
c) In the case of deceased patient, the “personal representative” is the executor, administrator or other person authorized to act on behalf of the deceased person or their estate. ( at 164.502(g)(4)).
But what if the physician or the hospital does not believe the disclosure of information to be in the best interest of the patient?
Well, there are limited exceptions that will allow a hospital or physician to decline to disclose information to the patient’s personal representative. The obvious example of not disclosing such information would be if the physician or hospital believes that providing such information would endanger the patient. (Id. at 164.502(g)(5)).
- Disclosures for treatment, payment or certain healthcare operations. HIPAA allows healthcare providers to use or disclose protected health information without the patient’s authorization for purposes of treating a patient or obtaining payment, or for certain healthcare operations of the covered entity. (45 CFR 164.506). For example, a provider may need to disclose limited information to ensure a patient is cared for at home, or an appropriate medical history is obtained.
There are limitations:
a) Hospitals and physicians may not make such disclosures if they have already agreed with the patient not to disclose. In general, a hospital or physician should avoid making promises to the patient that would otherwise limit their ability to make disclosures allowed by HIPAA.
b) Providers generally may not disclose psychotherapy notes without the patient’s written authorization. (at 164.508).
c) Finally, hospitals and physicians may not disclose information if a more restrictive law prohibits disclosure. A common example would be state or federal laws that apply to substance abuse programs.
- Disclosures for facility directories. If a hospital maintains a directory of patients in the facility, HIPAA allows disclosures of the following information to those who ask for the patient by name unless the patient has objected to such disclosures:
a) The patient’s name;
b) The patient’s location in the facility; and
c) The patient’s condition described in general terms that do not communicate specific information about the patient. (45 CFR 164.510(a)).
- Disclosures to avert serious and imminent threat of harm. HIPAA allows disclosures that are necessary to prevent or lessen a serious and imminent threat of harm to a person or the public, provided that the disclosure is to a person who is reasonably able to prevent or lessen the threat. (45 CFR 164.512(j)).
- Disclosures required by law. HIPAA allows disclosures to the extent the disclosure is required by another law. (45 CFR 164.512(a)). For example, if a state law requires disclosure to parents, the provider may do so.
- Disclosures with the patient’s written authorization. Unless the disclosure fits within one of the preceding rules or another HIPAA exception, the hospital or physician generally must have the patient’s written, HIPAA-compliant authorization to make the disclosure. (45 CFR 164.508). Even if the disclosure is allowed, the hospital/physician generally must limit the amount of information disclosed to the minimum necessary to accomplish the purpose of the healthcare provider’s disclosure. (45 CFR 164.514(d)). In addition, if the hospital/physician does not know the family member or other person associated with the patient, the hospital/physician must take reasonable steps to verify the identity and authority of the person seeking to obtain the information. (Id. at 164.514(h)).
The Office for Civil Rights has published a very helpful guide, Communicating with a Patient’s Family, Friends, or Others Involved in the Patient’s Care, which is available here.