Sharing Health Information

March 1, 2008

I’m unclear on when it’s OK to give out information to a spouse, relative, or friend. I found the following statement online: “The HIPAA Privacy Rule at 45 CFR 164.510(b) specifically permits covered entities to share information that is directly relevant to the involvement of a spouse, family members, friends, or other persons identified by a patient, in the patient’s care, or payment for health care. If the patient is present, or is otherwise available prior to the disclosure, and has the capacity to make health care decisions, the covered entity may discuss this information with the family and these other persons if the patient agrees or, when given the opportunity, does not object. The covered entity may also share relevant information with the family and these other persons if it can reasonably infer, based on professional judgment that the patient does not object.” Do we need to ask each patient to write down all of the people to whom we can disclose healthcare information and then double-check this information each time a spouse or relative calls?

Question: I’m unclear on when it’s OK to give out information to a spouse, relative, or friend. I found the following statement online: “The HIPAA Privacy Rule at 45 CFR 164.510(b) specifically permits covered entities to share information that is directly relevant to the involvement of a spouse, family members, friends, or other persons identified by a patient, in the patient’s care, or payment for health care. If the patient is present, or is otherwise available prior to the disclosure, and has the capacity to make health care decisions, the covered entity may discuss this information with the family and these other persons if the patient agrees or, when given the opportunity, does not object. The covered entity may also share relevant information with the family and these other persons if it can reasonably infer, based on professional judgment that the patient does not object.” Do we need to ask each patient to write down all of the people to whom we can disclose healthcare information and then double-check this information each time a spouse or relative calls?

Answer: No, you don’t need an individualized list from each person. It would likely be impossible to refer to it every time anyway.

What you can do is make it clear in your privacy policy that you will be using your best professional judgment about whether to share some medical information with family members. Then, in each instance, you use professional judgment, making sure everyone in the office understands that privacy is paramount.

So, for example, if a patient’s husband calls in asking about his wife’s diagnosis but you have no reason to think the patient couldn’t tell him herself if she wanted, you ask the husband to have his wife call you back to give permission.

On the other hand, if you know the wife is completely drugged, unable to communicate, and the husband is asking a specific question about how to treat, say, a bed sore, by all means help the poor fellow out. You might do well to role-play some possible or real situations from the past with staff and physicians so you all share a sense of what’s right.

Document this training!