Communicating with a Patient's Family, Friends, or Others Involved

HEALTH CARE PROVIDER’S

UIDE TO THE HIPAA PRIVACY RULE:

Communicating with a Patient’s Family, Friends,

or Others Involved in the Patient’s Care

U.S. Department of Health and Human Services • Office for Civil Rights

This guide explains when a health care provider is allowed to share a patient’s health information with the

patient’s family members, friends, or others identified by the patient as involved in the patient’s care under the

Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. HIPAA is a Federal law

that sets national standards for how health plans, health care clearinghouses, and most health care providers are

to protect the privacy of a patient’s health information.

Even though HIPAA requires health care providers to protect patient privacy, providers are permitted, in most

circumstances, to communicate with the patient’s family, friends, or others involved in their care or payment for

care. This guide is intended to clarify these HIPAA requirements so that health care providers do not

unnecessarily withhold a patient’s health information from these persons. This guide includes common

questions and a table that summarizes the relevant requirements.

COMMON QUESTIONS ABOUT HIPAA

1. If the patient is present and has the capacity to make health care decisions, when does HIPAA allow a

health care provider to discuss the patient’s health information with the patient’s family, friends, or

others involved in the patient’s care or payment for care?

If the patient is present and has the capacity to make health care decisions, a health care provider may

discuss the patient’s health information with a family member, friend, or other person if the patient agrees

or, when given the opportunity, does not object. A health care provider also may share information with

these persons if, using professional judgment, he or she decides that the patient does not object. In either

case, the health care provider may share or discuss only the information that the person involved needs to

know about the patient’s care or payment for care.

Here are some examples:

• An emergency room doctor may discuss a patient’s treatment in front of the patient’s friend if the

patient asks that her friend come into the treatment room.

• A doctor’s office may discuss a patient’s bill with the patient’s adult daughter who is with the

patient at the patient’s medical appointment and has questions about the charges.

• A doctor may discuss the drugs a patient needs to take with the patient’s health aide who has

accompanied the patient to a medical appointment.

• A doctor may give information about a patient’s mobility limitations to the patient’s sister who is

driving the patient home from the hospital.

The HIPAA Privacy Rule applies to those health care providers that transmit any health information in electronic form in connection

with certain standard transactions, such as health care claims. See the definitions of “covered entity,” “health care provider,” and

“transaction” at 45 C.F.R. § 160.103.

The full text of these requirements can be found at 45 C.F.R. § 164.510(b). Note that this guide does not apply to a health care

provider’s disclosure of psychotherapy notes, which generally requires a patient’s written authorization. See 45 C.F.R. §

164.508(a)(2).

COMMUNICATING WITH A PATIENT’S FAMILY, FRIENDS, OR OTHERS INVOLVED IN THE PATIENT’S CARE

Page 2 of 5 Communicating With a Patient’s Family, Friends, or

Others Involved in the Patient’s Care

• A nurse may discuss a patient’s health status with the patient’s brother if she informs the patient she

is going to do so and the patient does not object.

BUT:

• A nurse may not discuss a patient’s condition with the patient’s brother after the patient has stated

she does not want her family to know about her condition.

2. If the patient is not present or is incapacitated, may a health care provider still share the patient’s

health information with family, friends, or others involved in the patient’s care or payment for care?

Yes. If the patient is not present or is incapacitated, a health care provider may share the patient’s

information with family, friends, or others as long as the health care provider determines, based on

professional judgment, that it is in the best interest of the patient. When someone other than a friend or

family member is involved, the health care provider must be reasonably sure that the patient asked the

person to be involved in his or her care or payment for care. The health care provider may discuss only the

information that the person involved needs to know about the patient’s care or payment.

Here are some examples:

• A surgeon who did emergency surgery on a patient may tell the patient’s spouse about the patient’s

condition while the patient is unconscious.

• A pharmacist may give a prescription to a patient’s friend who the patient has sent to pick up the

prescription.

• A hospital may discuss a patient’s bill with her adult son who calls the hospital with questions about

charges to his mother’s account.

• A health care provider may give information regarding a patient’s drug dosage to the patient’s

health aide who calls the provider with questions about the particular prescription.

BUT:

• A nurse may not tell a patient’s friend about a past medical problem that is unrelated to the patient’s

current condition.

• A health care provider is not required by HIPAA to share a patient’s information when the patient is

not present or is incapacitated, and can choose to wait until the patient has an opportunity to agree to

the disclosure.

3. Does HIPAA require that a health care provider document a patient’s decision to allow the provider

to share his or her health information with a family member, friend, or other person involved in the

patient’s care or payment for care?

No. HIPAA does not require that a health care provider document the patient’s agreement or lack of

objection. However, a health care provider is free to obtain or document the patient’s agreement, or lack of

objection, in writing, if he or she prefers. For example, a provider may choose to document a patient’s

agreement to share information with a family member with a note in the patient’s medical file.

4. May a health care provider discuss a patient’s health information over the phone with the patient’s

family, friends, or others involved in the patient’s care or payment for care?

Yes. Where a health care provider is allowed to share a patient’s health information with a person,

information may be shared face-to-face, over the phone, or in writing.

COMMUNICATING WITH A PATIENT’S FAMILY, FRIENDS, OR OTHERS INVOLVED IN THE PATIENT’S CARE

Page 3 of 5 Communicating With a Patient’s Family, Friends, or

Others Involved in the Patient’s Care

5. If a patient’s family member, friend, or other person involved in the patient’s care or payment for

care calls a health care provider to ask about the patient’s condition, does HIPAA require the health

care provider to obtain proof of who the person is before speaking with them?

No. If the caller states that he or she is a family member or friend of the patient, or is involved in the

patient’s care or payment for care, then HIPAA doesn’t require proof of identity in this case. However, a

health care provider may establish his or her own rules for verifying who is on the phone. In addition, when

someone other than a friend or family member is involved, the health care provider must be reasonably sure

that the patient asked the person to be involved in his or her care or payment for care.

6. Can a patient have a family member, friend, or other person pick up a filled prescription, medical

supplies, X-rays, or other similar forms of patient information, for the patient?

Yes. HIPAA allows health care providers to use professional judgment and experience to decide if it is in

the patient’s best interest to allow another person to pick up a prescription, medical supplies, X-rays, or

other similar forms of information for the patient.

For example, the fact that a relative or friend arrives at a pharmacy and asks to pick up a specific

prescription for a patient effectively verifies that he or she is involved in the patient’s care. HIPAA allows

the pharmacist to give the filled prescription to the relative or friend. The patient does not need to provide

the pharmacist with their names in advance.

7. May a health care provider share a patient’s health information with an interpreter to communicate

with the patient or with the patient’s family, friends, or others involved in the patient’s care or

payment for care?

Yes. HIPAA allows covered health care providers to share a patient’s health information with an interpreter

without the patient’s written authorization under the following circumstances:

• A health care provider may share information with an interpreter who works for the provider (e.g., a

bilingual employee, a contract interpreter on staff, or a volunteer).

For example, an emergency room doctor may share information about an incapacitated patient’s

condition with an interpreter on staff who relays the information to the patient’s family.

• A health care provider may share information with an interpreter who is acting on its behalf (but is not a

member of the provider’s workforce) if the health care provider has a written contract or other

agreement with the interpreter that meets HIPAA’s business associate contract requirements.

For example, many providers are required under Title VI of the Civil Rights Act of 1964 to take

reasonable steps to provide meaningful access to persons with limited English proficiency. These

providers often have contracts with private companies, community-based organizations, or telephone

interpreter service lines to provide language interpreter services. These arrangements must comply with

the HIPAA business associate agreement requirements at 45 C.F.R. 164.504(e).

• A health care provider may share information with an interpreter who is the patient’s family member,

friend, or other person identified by the patient as his or her interpreter, if the patient agrees, or does not

object, or the health care provider determines, using his or her professional judgment, that the patient

does not object.

COMMUNICATING WITH A PATIENT’S FAMILY, FRIENDS, OR OTHERS INVOLVED IN THE PATIENT’S CARE

Page 4 of 5 Communicating With a Patient’s Family, Friends, or

Others Involved in the Patient’s Care

For example, health care providers sometimes see patients who speak a certain language and the

provider has no employee, volunteer, or contractor who can competently interpret that language. If the

provider is aware of a telephone interpreter service that can help, the provider may have that interpreter

tell the patient that the service is available. If the provider decides, based on professional judgment, that

the patient has chosen to continue using the interpreter, the provider may talk to the patient using the

interpreter.

8. Where can I find additional information about HIPAA?

The Office for Civil Rights, part of the Department of Health and Human Services, has more

information about HIPAA on its Web site. Visit http://www.hhs.gov/ocr/hipaa for a wide range of

helpful information, including the full text of the Privacy Rule, a HIPAA Privacy Rule Summary, fact

sheets, over 200 Frequently Asked Questions, as well as many other resources to help health care

providers and others understand the law.

COMMUNICATING WITH A PATIENT’S FAMILY, FRIENDS, OR OTHERS INVOLVED IN THE PATIENT’S CARE

Page 5 of 5 Communicating With a Patient’s Family, Friends, or

Others Involved in the Patient’s Care

HIPAA Privacy Rule Disclosures to a Patient’s Family, Friends, or

Others Involved in the Patient’s Care or Payment for Care

Family Member or Friend Other Persons

Patient is present and

has the capacity to make

health care decisions

Provider may disclose relevant

information if the provider does

one of the following:

(1) obtains the patient’s

agreement

(2) gives the patient an

opportunity to object and

the patient does not object

(3) decides from the

circumstances, based on

professional judgment, that

the patient does not object

Disclosure may be made in person,

over the phone, or in writing.

Provider may disclose relevant

information if the provider does one

of the following:

(1) obtains the patient’s

agreement

(2) gives the patient the

opportunity to object and

the patient does not object

(3) decides from the

circumstances, based on

professional judgment, that

the patient does not object

Disclosure may be made in person,

over the phone, or in writing.

Patient is not present or

is incapacitated

Provider may disclose relevant

information if, based on

professional judgment, the

disclosure is in the patient’s best

interest.

Disclosure may be made in person,

over the phone, or in writing.

Provider may use professional

judgment and experience to decide

if it is in the patient’s best interest

to allow someone to pick up filled

prescriptions, medical supplies, X-

rays, or other similar forms of

health information for the patient.

Provider may disclose relevant

information if the provider is

reasonably sure that the patient has

involved the person in the patient’s

care and in his or her professional

judgment, the provider believes the

disclosure to be in the patient’s best

interest.

Disclosure may be made in person,

over the phone, or in writing.

Provider may use professional

judgment and experience to decide

if it is in the patient’s best interest to

allow someone to pick up filled

prescriptions, medical supplies, X-

rays, or other similar forms of health

information for the patient.