Health Information Management

What disclosures can we make in the case of abuse?

HIPAA Weekly Advisor, September 28, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: What disclosures can we make if we believe that a patient is or has been the victim of abuse, neglect, or domestic violence

A: The privacy rule allows such disclosures in the following three situations:

  • When the disclosure is required by law and complies with and is limited to the relevant requirements of the law

  • When the individual agrees to the disclosure

  • When the disclosure is expressly permitted by law, but not required, and the covered entity, exercising professional judgment, believes the disclosure is necessary to prevent serious harm to the individual or other potential victims

    These disclosure provisions apply to such things as abuse of nursing home residents, abuse of residents of facilities for the mentally retarded, and domestic violence. Child abuse and child neglect disclosures are not covered by this provision; child abuse reporting is considered a disclosure for public health activities and should be disclosed according to those provisions.

    A formal authorization is not required but the regulations do require that a covered entity that makes a disclosure regarding abuse, neglect, or domestic violence promptly notify the individual that such a report has been or will be made.

    The regulations state that the individual need not be informed if the covered entity

  • exercising professional judgment, believes informing the individual would place him or her at risk of serious harm

  • would be informing a personal representative, and the covered entity believes the personal representative is causing the abuse, neglect, or other injury, and that informing the representative would not serve the best interests of the individual being abused, neglected, or otherwise injured

    The HHS commentary in the privacy rule states that the covered entity may provide this information orally to the individual whose information is being disclosed. HHS notes that it does not require written notification, and does not encourage it, due to the sensitivity of abuse situations and the potential for the abuser to cause further harm to the individual if, for example, a covered entity sends written notification to the home of the individual and the abuser.

    A disclosure of this type, permitted without authorization, would need to be included in an accounting.

    Editor's note: Brought to you by attorneys Marty Baxter and Gretchen McBeath at Bricker and Eckler, LLP and The Quality Management Consulting Group, Ltd.. E-mail: mbaxter@bricker.com or gmcbeath@bricker.com



    • Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

    • Briefings on APCs

      Worried about the complexities of the new rules under OPPS and APCs? Briefings on APCs helps you understand the new rules...

    • Medical Records Briefing

      Guiding Health Information Management professionals through the continuously changing field of medical records and toward a...

    • Briefings on Coding Compliance Strategies

      Submitting improper Medicare documentaion can lead to denial of fees, payback, fines, and increased diligence from payers...

    • Briefings on HIPAA

      How can you minimize the impact of HIPAA? Subscribe to Briefings on HIPAA, your health information management resource for...

    • APCs Weekly Monitor

      This HTML-based e-mail newsletter provides weekly tips and advice on the new ambulatory payment classifications regulations...

    Most Popular

    Related Articles