How do clinicians keep loved ones informed while respecting HIPAA guidelines?

Although HIPAA is all about privacy, how practical is it when family is there or on the phone? Can you say anything at all? How much can you say? What about emergencies? What about minors?

The guiding rule about sharing protected health information (PHI) is that it’s the patient’s decision. Sometimes, it’s easy to know what the patient wants, but not always. The easy one is when a patient has named a person in advance on their ‘consent to treatment’ form (or intake or other initial paperwork). This is called an ‘Authorization.’ If they have not named the person, the HIPAA Privacy Rule requires that the patient have “the opportunity to agree or object” to sharing information.

Many situations are not as obvious, and what should you do in the rush of patient care?

Common Dilemmas for HIPAA and Communicating with Loved Ones

Question: I’m talking with a patient whose wife walks in. May I continue our conversation?

Answer: If you are unsure whether the patient has named someone in advance – it could be a family member or a friend, ask the patient. You do NOT need to get written permission. They may agree verbally. Best practices require you to document that agreement in their patient record afterward.

Question: I’m treating a patient who is unconscious and unable to tell me – may I talk with her family?

Answer: If the patient is unable to tell you, use your experience and professional judgment to decide if it’s in the patient’s best interest to talk with them. Be sure to follow the “minimum necessary” rule – only discuss information relevant to that person’s involvement with the patient’s care. Later, you should document this in the patient’s record.

Question: I have a 19-year-old patient, and her mom would like to talk with me about her daughter’s migraines. Her mom, who lives out of state, has called me, but I do not have anything signed giving her permission to have this information.

Answer: You may talk to the mom if she is involved in your patient’s care, as long as you give your patient, the daughter, the opportunity to agree or object first. You do not need her written authorization but may call and get her verbal agreement. You should document that you obtained her permission and keep it with her records.

Question: I’m caring for an elderly patient, and her son has called me to ask about her medications. May I tell him?

Answer: This is similar to the question above. If your patient has told you it’s ok, that’s enough. You don’t need her written permission, but you should document it in your clinical notes that the patient told you it was ok to talk to him.

On the other hand, if the patient is unable to tell you (has dementia, is unconscious, or otherwise incapacitated), use your experience and professional judgment, follow the minimum necessary rule, and document it.

Question: The patient in our care is now deceased. May I provide information to his family?

Answer: HIPAA protects patient privacy for 50 years after death. However, a family member designated as a ‘personal representative’ may receive patient information. Also, family members involved in the patient’s care or payment for care may receive information; the “minimum necessary” rule applies – only disclose health information relevant to the person’s involvement in the deceased patient’s care or payment for care.

Question: We are an EMS agency and just transported a patient to the hospital. May we tell them if we get a phone call asking for the destination?

Answer: It depends. HIPAA permits you to share “minimum necessary” information with family and friends involved in the individual’s care. So…

If you can verify with a reasonable degree of certainty that the person calling is involved in their care, whether in the family, or even a neighbor who is a caregiver, you may tell them the hospital destination. Document in the record that you spoke to them. HIPAA allows this because it’s in the patient’s best interest for friends and family involved in their care to know. But a nosy neighbor, a random person, or the media… NO.

Question: My patient’s ex-husband has called our office to ask for information because his health insurance covers her. Is it ok to answer the ex-husband’s questions?

Answer: Not unless you have a valid Authorization from your patient naming her ex-husband  – if not, say “no” and tell him to call his health insurance provider.

Question: The parent of college-age (18+) student wants to know when her daughter was last in to see me. May I tell them?

Answer: Probably not. HIPAA defers to State law here, and in most states, a ‘minor’ becomes an ‘adult’ at 18. So, without your patient’s agreement, you should not answer her question. But if an adult child has agreed – and they may agree verbally – you may continue to share information with the parent.

NOTE: How minors (under 18 in most states) are treated is complicated, especially when they become adolescents. The general rule is that parents and guardians are considered the “personal representative” of a minor child – they are “stand-ins” for the child and can make decisions about the child’s health care and receive and ask for health information – but there are some exceptions.

For a fuller description about exceptions related to patient safety or a minor’s treatment for behavioral health issues, see this update.

What the patient wants is central to your decisions about talking to family and friends:

• Has the patient agreed?
• Can you give the patient an “opportunity to agree or object”?
• If not, use your professional judgment.
• Follow the “minimum necessary” rule.
• Make a note in the record.
• A major exception is when the patient poses a “serious and imminent threat” to himself or others. Then, alert the authorities.