Loved Ones Need Information
HIPAA permits healthcare providers to talk with family and friends while respecting patient privacy.
Patients often have family members present while receiving care, and family members or friends may follow up with a provider to find out information. Guidelines help you decide how to handle communications while ensuring privacy and confidentiality.
The Patient Decides
The basic principle about sharing protected health information (PHI) is that it’s the patient’s decision.
Knowing what the patient wants is sometimes easy, but not always. The easy one is when a patient has named a person in advance on their ‘consent to treatment’ form (or other intake paperwork). This is called an ‘Authorization.’ If they have not named the person, the HIPAA Privacy Rule requires that the patient have ‘the opportunity to agree or object’ to sharing information.
Many situations are not as obvious, and what should you do in the rush of patient care?
Frequently Asked Questions for HIPAA and Communicating with Loved Ones
Question: I’m talking with a patient whose daughter walks in. May I continue our conversation?
Answer: If unsure whether the patient has authorized disclosure to this daughter in advance, ask the patient. You do not need to get written permission. They may agree verbally, but best practices require you to document that agreement in their patient record.
Question: I’m treating a patient on a ventilator who is unable to tell me his preferences – may I talk with his family?
Answer: If the patient cannot tell you, use your experience and professional judgment to decide if it’s in the patient’s best interest to talk with them. Be sure to follow the “minimum necessary” rule – only discuss information relevant to that person’s involvement with the patient’s care. Later, you should document this in the patient’s record.
Question: I have a 19-year-old patient whose dad would like to talk with me about his son’s sports injury. The dad, who lives out of state, has called me, but I do not have anything signed permitting him to have this information.
Answer: You may talk to the dad if he is involved in your patient’s care or the payment for care, as long as you give your patient, the son, the opportunity to agree or object first. You do not need his written authorization but may get his verbal agreement. You should document that you obtained his permission and keep it with his records.
Question: I’m caring for an elderly patient whose son has called me to ask about her medications. May I tell him?
Answer: This is similar to the question above. If your patient has told you it’s ok, that’s enough. You don’t need her written permission, but you should document in the patient’s record that the patient gave her permission.
On the other hand, if the patient is unable to tell you (has dementia, is unconscious, or otherwise incapacitated), use your experience and professional judgment, follow the minimum necessary rule, and document it.
Question: We are an EMS agency that just transported a patient to the hospital. If a family member calls asking for the destination, may we tell them?
Answer: It depends. HIPAA permits you to share “minimum necessary” information with family and friends involved in the individual’s care. So…
If you can verify with a reasonable degree of certainty that the person calling is involved in their care, whether in the family or even a neighbor who is a caregiver, you may tell them the hospital destination. Document in the record that you spoke to them. HIPAA allows this because it’s in the patient’s best interest for friends and family involved in their care to know.
But a nosy neighbor, a random person, or the media… NO.
Question: My patient’s ex-husband has called our office to ask for information because his health insurance covers her. Is it ok to answer the ex-husband’s questions?
Answer: Not unless you have a valid Authorization from your patient naming her ex-husband – if not, say “no” and tell him to call his health insurance provider.
Question: The parent of a college-age (18+) student wants to know when her daughter was last in to see me. May I tell them?
Answer: Probably not. HIPAA defers to State law here, and in most states, a ‘minor’ becomes an ‘adult’ at 18. So, without your patient’s agreement, you should not answer her question. But if an adult child has agreed – and they may agree verbally – you may continue to share information with the parent.
NOTE: How minors (under 18 in most states) are treated is complicated, especially when they become adolescents. The general rule is that parents and guardians are considered the “personal representatives” of a minor child—they are “stand-ins” for the child and can make decisions about the child’s health care and receive and ask for health information—but there are some exceptions.
Exceptions – Mental Health, Drug/Alcohol Treatment, Sexual Health Services
In special situations, a parent is not treated as a minor child’s “personal representative.” For example, a State law might allow adolescents to obtain sexual health services or mental health treatment without parental consent. In those situations, the HIPAA Privacy Rule defers to State law. With the opioid crisis, there are Federal privacy laws that are stricter than HIPAA and may not permit parental involvement.
HIPAA Family and Friends Exception – Safety
A parent also may not be a personal representative if there are safety concerns. If you believe that the minor is a victim of abuse or neglect by the parent or may be endangered if you treat the parent as the personal representative, then you do not need to treat them as such. What to do? You can report it – see below.
Question: I strongly suspect that a patient is a victim of domestic abuse, although the patient has not confided in me. The abuse seems to be escalating, judging by the injuries I’ve seen. May I do anything?
Answer: Yes. If you believe the patient is a victim of abuse, you should alert a government agency authorized by law to receive such a report. You may obtain an adult patient’s agreement but are not required to do so in certain circumstances. It would be best if you informed the patient of your report unless you believe that telling the patient would increase the risk of further abuse.
Question: I am a therapist for someone who I believe poses a threat of harm to himself or others – do I have any leeway about talking to law enforcement or the family without the patient’s permission?
Answer: Yes. The HIPAA Privacy Rule allows you to provide necessary information about a patient to law enforcement, family members, school administrators, or others if you believe the patient presents a serious and imminent threat to himself or others and that a warning could help prevent or lessen the threat. In 2013, following mass school shootings, HHS published a letter to the nation’s healthcare providers describing the scope of this permission under HIPAA.
Six Steps to Decide
What the patient wants is central to your decisions about talking to family and friends:
- Has the patient agreed?
- Can you give the patient an “opportunity to agree or object”?
- If not, use your professional judgment.
- Follow the “minimum necessary” rule.
- Make a note in the record.
- An exception is when the patient poses a “serious and imminent threat” to himself or others. Then, alert the authorities.