Providers may discuss the patient’s condition with family and friends under HIPAA, as long as the patient’s wishes are respected.
Family and Friends Under HIPAA
Loved Ones Need Information
Family members and friends are often involved in a patient’s care. Patients may have loved ones present during their care, and family members or friends may follow up with a provider to obtain information.
In all cases, disclosures to family members, friends, or other persons involved in the patient’s care or payment for care are to be limited to only the protected health information (PHI) directly relevant to the person’s involvement in the patient’s care or payment for care.
Guidelines help you decide how to handle communications while ensuring privacy and confidentiality.
The First Rule is That the Patient Decides
The basic principle about sharing protected health information is that it’s the patient’s decision.
Knowing what the patient wants is sometimes easy, but not always. If a patient has authorized someone in advance on their intake forms, the decision is easy. If a patient has not named a specific person, the HIPAA Privacy Rule requires that the patient have ‘the opportunity to agree or object’ to the provider sharing information.
Many situations are not obvious, so here are some common scenarios that help guide a provider’s decisions.
FAQs
Talking with Family and Friends Under HIPAA
Question: I’m talking with a patient when her daughter (or any family member or friend) walks in. Is it okay to continue speaking with the patient?
Answer: If unsure, simply ask the patient. You do not need to stop and get their written consent. They may agree verbally, but you should document the consent yourself in the patient’s record.
Question: I’m treating a patient in the ER who has not completed an intake form and is unable to tell me his preferences – may I talk with his family?
Answer: If the patient cannot tell you, use your experience and professional judgment to decide if it’s in the patient’s best interest to talk with them.
Be sure to follow the “minimum necessary” rule – only discuss information relevant to that person’s involvement with the patient’s care. Later, you should document this in the patient’s record.
Question: The father of a 19-year-old patient would like to talk with me about his son’s sports injury. The father lives out of state and has called me, but I do not have a consent or authorization from the son permitting him to have this information.
Answer: You may talk to the father if he is involved in your patient’s care or the payment for care, as long as you give your patient, the son, the opportunity to agree or object first. You do not need his written authorization but may get his verbal agreement. You should document that you obtained his permission and keep it with his records.
Senior Patients and Potential Questions of Competence
Question: I’m caring for an elderly patient whose son has called me to ask about her medications. May I tell him?
Answer: If the patient is not present, and has not named the son in her intake forms (or told you verbally), you should obtain the patient’s consent first. You don’t need her permission in writing, but you should document in the patient’s record that the patient gave her permission.
On the other hand, if the patient is unable to tell you (has dementia, is unconscious, or otherwise incapacitated), use your experience and professional judgment, follow the minimum necessary rule, and document it.
Question: The daughter of our elderly patient called to schedule an appointment for her mother. She said her mother is not doing well and she has power of attorney for her mother’s healthcare. She also said that she will need to be with her mother at all times during the appointment and will make decisions on her care; however, when we asked for a document proving she has the power of attorney she said the document was lost in a house fire and she does not have one. Should we allow the daughter to take over her care?
Answer: If the daughter wants you to accept that her mother is not competent to make her own decisions, she either needs to bring a new power of attorney, or a document that shows she is her mother’s “personal representative.”
Question: As an EMS agency that transports patients to the hospital, sometimes a family member will call asking to find out where they’ve been taken. May we tell them?
Answer: It depends. HIPAA permits you to share “minimum necessary” information with family and friends involved in the individual’s care.
So…
- If you can verify with a reasonable degree of certainty that the person calling is involved in their care, whether in the family or even a neighbor who is a caregiver, you may tell them the hospital destination. Document in the record that you spoke to them. HIPAA allows this because it’s in the patient’s best interest for friends and family involved in their care to know.
- But a nosy neighbor, a random person, or the media… NO.
Question: My patient’s ex-spouse has called our office to ask for information because their health insurance covers our patient. Is it ok to answer the ex-spouse’s questions?
Answer: Not unless you have a valid Authorization from your patient naming the ex-spouse. If not, say “no” and tell them to call their health insurance provider.
Personal and Public Safety are Protected Under HIPAA
Question: I strongly suspect that a patient is a victim of domestic abuse, although the patient has not confided in me. The abuse seems to be escalating, judging by the injuries I’ve seen. May I do anything?
Answer: Yes. If you believe the patient is a victim of abuse, you should alert a government agency authorized by law to receive such a report. You may obtain an adult patient’s agreement but are not required to do so in certain circumstances. It would be best if you informed the patient of your report unless you believe that telling the patient would increase the risk of further abuse.
Question: I am a therapist for someone who I believe poses a threat of harm to himself or others – do I have any leeway about talking to law enforcement or the family without the patient’s permission?
Answer: Yes. The HIPAA Privacy Rule allows you to provide necessary information about a patient to law enforcement, family members, school administrators, or others if you believe the patient presents a serious and imminent threat to himself or others and that a warning could help prevent or lessen the threat. In 2013, following mass school shootings, HHS published a letter to the nation’s healthcare providers describing the scope of this permission under HIPAA.
Parents and Guardians of a Minor Child
Question: The parent of a college-age (18+) student wants to know when her daughter was last in to see me. May I tell them?
Answer: Probably not. HIPAA defers to State law here, and in most states, a ‘minor’ becomes an ‘adult’ at 18. So, without your patient’s agreement, you should not answer her question. But if an adult child has agreed – and they may agree verbally – you may continue to share information with the parent.
NOTE: How minors (under 18 in most states) are treated is complicated, especially when they become adolescents. The general rule is that parents and guardians are considered the “personal representatives” of a minor child—they are “stand-ins” for the child and can make decisions about the child’s health care and receive and ask for health information—but there are some exceptions.
Exceptions: Mental Health, Drug/Alcohol Treatment and Sexual Health Services
In special situations, a parent is not treated as a child’s personal representative. For example, a State law might allow adolescents to obtain sexual health services or mental health treatment without parental consent. In those situations, the HIPAA Privacy Rule defers to State law. With the opioid crisis, there are Federal privacy laws that are stricter than HIPAA and may not permit parental involvement.
Exception: Safety for a Minor Child
A parent may not be a personal representative if there are safety concerns. If you believe that the minor is a victim of abuse or neglect by the parent or may be endangered if you treat the parent as the personal representative, then you do not need share information with them. Consult with management or legal counsel about whether to report safety concerns to an appropriate agency or law enforcement.
Communication and Behavioral Health
HIPAA has extra guidance around communicating with family and friends of adult patients in behavioral health situations, including substance use disorder treatment.
Six Steps to Decide
The patient’s preference is central to your decisions about talking to family and friends under HIPAA:
- Has the patient agreed?
- Can you give the patient an “opportunity to agree or object”?
- If not, use your professional judgment.
- Follow the “minimum necessary” rule.
- Make a note of the patient’s consent in their record.
- An exception is when the patient poses a “serious and imminent threat” to himself or others. If so, alert the authorities.
