Communicating with a Patient’s Family, Friends, or Others Involved in the Patient’s Care

This guide explains when a health care provider is allowed to share a patient’s health information with the patient’s family members, friends, or others identified by the patient as involved in the patient’s care under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. HIPAA is a Federal law that sets national standards for how health plans, health care clearinghouses, and most health care providers are to protect the privacy of a patient’s health information.1 Even though HIPAA requires health care providers to protect patient privacy, providers are permitted, in most circumstances, to communicate with the patient’s family, friends, or others involved in their care or payment for care. This guide is intended to clarify these HIPAA requirements so that health care providers do not unnecessarily withhold a patient’s health information from these persons. This guide includes common questions and a table that summarizes the relevant requirements.2

COMMON QUESTIONS ABOUT HIPAA 1. If the patient is present and has the capacity to make health care decisions, when does HIPAA allow a health care provider to discuss the patient’s health information with the patient’s family, friends, or others involved in the patient’s care or payment for care? If the patient is present and has the capacity to make health care decisions, a health care provider may discuss the patient’s health information with a family member, friend, or other person if the patient agrees or, when given the opportunity, does not object. A health care provider also may share information with these persons if, using professional judgment, he or she decides that the patient does not object. In either case, the health care provider may share or discuss only the information that the person involved needs to know about the patient’s care or payment for care. Here are some examples: • An emergency room doctor may discuss a patient’s treatment in front of the patient’s friend if the patient asks that her friend come into the treatment room. • A doctor’s office may discuss a patient’s bill with the patient’s adult daughter who is with the patient at the patient’s medical appointment and has questions about the charges. • A doctor may discuss the drugs a patient needs to take with the patient’s health aide who has accompanied the patient to a medical appointment. • A doctor may give information about a patient’s mobility limitations to the patient’s sister who is driving the patient home from the hospital. 1 The HIPAA Privacy Rule applies to those health care providers that transmit any health information in electronic form in connection with certain standard transactions, such as health care claims. See the definitions of “covered entity,” “health care provider,” and “transaction” at 45 C.F.R. § 160.103. 2 The full text of these requirements can be found at 45 C.F.R. § 164.510(b). Note that this guide does not apply to a health care provider’s disclosure of psychotherapy notes, which generally requires a patient’s written authorization. See 45 C.F.R. § 164.508(a)(2).

COMMUNICATING WITH A PATIENT’S FAMILY, FRIENDS, OR OTHERS INVOLVED IN THE PATIENT’S CARE
Page 2 of 5 Communicating With a Patient’s Family, Friends, or
Others Involved in the Patient’s Care
• A nurse may discuss a patient’s health status with the patient’s brother if she informs the patient she is going to do so and the patient does not object. BUT: • A nurse may not discuss a patient’s condition with the patient’s brother after the patient has stated she does not want her family to know about her condition.
2. If the patient is not present or is incapacitated, may a health care provider still share the patient’s health information with family, friends, or others involved in the patient’s care or payment for care? Yes. If the patient is not present or is incapacitated, a health care provider may share the patient’s information with family, friends, or others as long as the health care provider determines, based on professional judgment, that it is in the best interest of the patient. When someone other than a friend or family member is involved, the health care provider must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care. The health care provider may discuss only the information that the person involved needs to know about the patient’s care or payment. Here are some examples: • A surgeon who did emergency surgery on a patient may tell the patient’s spouse about the patient’s condition while the patient is unconscious. • A pharmacist may give a prescription to a patient’s friend who the patient has sent to pick up the prescription. • A hospital may discuss a patient’s bill with her adult son who calls the hospital with questions about charges to his mother’s account. • A health care provider may give information regarding a patient’s drug dosage to the patient’s health aide who calls the provider with questions about the particular prescription. BUT: • A nurse may not tell a patient’s friend about a past medical problem that is unrelated to the patient’s current condition. • A health care provider is not required by HIPAA to share a patient’s information when the patient is not present or is incapacitated, and can choose to wait until the patient has an opportunity to agree to the disclosure. 3. Does HIPAA require that a health care provider document a patient’s decision to allow the provider to share his or her health information with a family member, friend, or other person involved in the patient’s care or payment for care? No. HIPAA does not require that a health care provider document the patient’s agreement or lack of objection. However, a health care provider is free to obtain or document the patient’s agreement, or lack of objection, in writing, if he or she prefers. For example, a provider may choose to document a patient’s agreement to share information with a family member with a note in the patient’s medical file. 4. May a health care provider discuss a patient’s health information over the phone with the patient’s family, friends, or others involved in the patient’s care or payment for care? Yes. Where a health care provider is allowed to share a patient’s health information with a person, information may be shared face-to-face, over the phone, or in writing.

COMMUNICATING WITH A PATIENT’S FAMILY, FRIENDS, OR OTHERS INVOLVED IN THE PATIENT’S CARE
Page 3 of 5 Communicating With a Patient’s Family, Friends, or
Others Involved in the Patient’s Care
5. If a patient’s family member, friend, or other person involved in the patient’s care or payment for care calls a health care provider to ask about the patient’s condition, does HIPAA require the health care provider to obtain proof of who the person is before speaking with them? No. If the caller states that he or she is a family member or friend of the patient, or is involved in the patient’s care or payment for care, then HIPAA doesn’t require proof of identity in this case. However, a health care provider may establish his or her own rules for verifying who is on the phone. In addition, when someone other than a friend or family member is involved, the health care provider must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care. 6. Can a patient have a family member, friend, or other person pick up a filled prescription, medical supplies, X-rays, or other similar forms of patient information, for the patient? Yes. HIPAA allows health care providers to use professional judgment and experience to decide if it is in the patient’s best interest to allow another person to pick up a prescription, medical supplies, X-rays, or other similar forms of information for the patient. For example, the fact that a relative or friend arrives at a pharmacy and asks to pick up a specific prescription for a patient effectively verifies that he or she is involved in the patient’s care. HIPAA allows the pharmacist to give the filled prescription to the relative or friend. The patient does not need to provide the pharmacist with their names in advance. 7. May a health care provider share a patient’s health information with an interpreter to communicate with the patient or with the patient’s family, friends, or others involved in the patient’s care or payment for care? Yes. HIPAA allows covered health care providers to share a patient’s health information with an interpreter without the patient’s written authorization under the following circumstances: • A health care provider may share information with an interpreter who works for the provider (e.g., a bilingual employee, a contract interpreter on staff, or a volunteer). For example, an emergency room doctor may share information about an incapacitated patient’s condition with an interpreter on staff who relays the information to the patient’s family. • A health care provider may share information with an interpreter who is acting on its behalf (but is not a member of the provider’s workforce) if the health care provider has a written contract or other agreement with the interpreter that meets HIPAA’s business associate contract requirements. For example, many providers are required under Title VI of the Civil Rights Act of 1964 to take reasonable steps to provide meaningful access to persons with limited English proficiency. These providers often have contracts with private companies, community-based organizations, or telephone interpreter service lines to provide language interpreter services. These arrangements must comply with the HIPAA business associate agreement requirements at 45 C.F.R. 164.504(e). • A health care provider may share information with an interpreter who is the patient’s family member, friend, or other person identified by the patient as his or her interpreter, if the patient agrees, or does not object, or the health care provider determines, using his or her professional judgment, that the patient does not object.

COMMUNICATING WITH A PATIENT’S FAMILY, FRIENDS, OR OTHERS INVOLVED IN THE PATIENT’S CARE
Page 4 of 5 Communicating With a Patient’s Family, Friends, or
Others Involved in the Patient’s Care
For example, health care providers sometimes see patients who speak a certain language and the provider has no employee, volunteer, or contractor who can competently interpret that language. If the provider is aware of a telephone interpreter service that can help, the provider may have that interpreter tell the patient that the service is available. If the provider decides, based on professional judgment, that the patient has chosen to continue using the interpreter, the provider may talk to the patient using the interpreter. 8. Where can I find additional information about HIPAA? The Office for Civil Rights, part of the Department of Health and Human Services, has more information about HIPAA on its Web site. Visit http://www.hhs.gov/ocr/hipaa for a wide range of helpful information, including the full text of the Privacy Rule, a HIPAA Privacy Rule Summary, fact sheets, over 200 Frequently Asked Questions, as well as many other resources to help health care providers and others understand the law.