Physician Practice

OCR updates HIPAA guidance on permissible disclosures

Physician Practice Insider, February 7, 2017

Providers may share information with a patient’s loved ones, regardless of whether they are recognized as relatives under applicable laws, the Office for Civil Rights (OCR) said in updated HIPAA guidance released January 10. OCR also issued an FAQ explaining that disclosures to a loved one who is not married to the patient or otherwise recognized as a relative are generally permissible under the same conditions and circumstances as disclosures to a spouse or other relative.

The updated guidance defines family member and personal representative under applicable sections of HIPAA. Family member includes the patient’s lawful spouse and dependents of all lawful marriages. Covered entities (CE) are permitted to share protected health information (PHI) with family members under certain circumstances. An individual’s personal representative must be treated as the individual with regards to access to PHI, except in certain limited circumstances.

CEs are permitted to share relevant information about a patient with the patient’s partner, guardian, caregiver, or close personal friend. The information should be directly relevant to that individual’s involvement in the patient’s care or payment for healthcare. CEs should obtain verbal permission from the patient when possible. CEs are also permitted to disclose a patient’s information to notify or assist in notifying a patient’s loved ones. OCR defers to providers’ professional judgment and does not require that the CE verify that an individual is a family member, partner, or friend. CEs may not limit disclosures to loved ones based on sex or gender identity.

OCR developed the updated guidance and FAQ in response to questions raised in the wake of the 2016 Orlando nightclub shooting. Orlando Mayor Buddy Dyer requested that the White House waive HIPAA as hospitals attempted to identify patients and notify family members and loved ones. HHS responded that a waiver was not necessary and that providers may use their professional judgment to make disclosures in the best interest of a patient.

This article originally appeared on Revenue Cycle Advisor.

Most Popular