On September 16, 2008, the HHS Office for Civil Rights (“OCR”) released new guidance on how to interact with a patient’s family or friends without violating the HIPAA privacy regulations. OCR released two separate guides on this issue: one for patients and one for providers.
The guides are in a question-and-answer format and address common and sometimes confusing situations about when a physician or other medical staff member can share information on a patient’s condition with his or her family members. For instance, the provider’s guide asks, “If the patient is present and has the capacity to make health care decisions, when does HIPAA allow a health care provider to discuss the patient’s health information with the patient’s family, friends, or others involved in the patient’s care or payment for care?” The guide states that the provider may have such discussions if the patient agrees. “A health care provider also may share information with these persons if, using professional judgment, he or she decides that the patient does not object. In either case, the health care provider may share or discuss only the information that the person involved needs to know about the patient’s care or payment for care,” OCR says.
Another question addresses sharing information when the patient is not present or is incapacitated. “[A] health care provider may share the patient’s information with family, friends, or others as long as the health care provider determines, based on professional judgment, that it is in the best interest of the patient. When someone other than a friend or family member is involved, the health care provider must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care,” it says. “The health care provider may discuss only the information that the person involved needs to know about the patient’s care or payment.” Still, providers should not reveal past medical problems that are unrelated to the patient’s current condition.
The provider and patient guides are available at www.hhs.gov/ocr/hipaa/privacy.html.
© 2009 Parsonage Vandenack Williams LLC