Releases of Patient Condition/Location: Guidelines to Compliance

OAHHS HIPAA Taskforce

Gwen M. Dayton, Vice President and General Counsel

The HIPAA regulators determined that certain releases of protected health information are sufficiently informal that a written authorization for use or disclosure of the information is not required. The regulations still provide for some level of patient control over the information, however. Hospitals and other providers must inform a patient in advance that certain information may be released without their authorization and offer the patient the opportunity to agree to, prohibit or restrict the disclosure; the so-called "opt out" opportunity. Both notice of the possible disclosure and the patient's agreement or prohibition may be made orally.

For more information on this topic, also see the Guidelines for Releasing Information on the Condition of Patients released by the American Hospital Association.

Opt Out Requirements

To release information pursuant to the HIPAA Opt Out provisions, hospitals must:

• Inform patients in advance of the possible uses and disclosures of information allowed by the Opt Out provisions and give patients the opportunity to opt out of this release.

• If a patient is unable to express an opinion on this issue due to incapacity, determine that disclosure is consistent with a prior expressed preference, or determine, in the hospital's professional judgement, that release of the information is in the patient's best interest.

Top

Releases to Persons Involved in a Patient's Care

An individual calls your hospital indicating they are involved in a patient's care and asking about the patient.

A hospital may release protected health information about a patient to persons involved in the patient's care if:

• The person requesting the information asks for the patient by name;

• The hospital has determined that the person is in fact involved in the patient's care; and

• The hospital has complied with the Opt Out requirements discussed above.

What information can you release to those involved in a patient's care?

• Protected health information directly relevant to the individual's involvement with the patient's care, and nothing else.

Top

Releases of Facility Directory Information

Family and Friends

Family and friends of a patient may receive what the HIPAA regulations call Facility Directory information about the patient if:

• The family or friend ask about the patient by name; and

• The hospital has followed the Opt Out provisions discussed above.

Facility directory information available to family and friends includes:

• The individual's location in the healthcare provider's facility; and

• The individual's one-word condition. No specific medical information about the individual.

Top

Members of the Clergy

Unlike others asking for information about a patient, members of the clergy do not need to ask for a patient by name. Assuming the "opt out" procedures discussed above have been followed, the clergy may receive facility directory information about a patient. Facility directory information available to clergy includes:

• The individual's name

• The individual's location in the healthcare provider's facility

• The individual's condition described in general terms that does not communicate specific medical information about the individual; and

• Religious affiliation

	Implementation Tips:
	-	Remember that the regulations call for an opt out, not an opt in process. Failure of a patient to object, after being notified of the possible disclosure, may be taken as assent as long as you have provided a meaningful opportunity to opt out.
	-	The regulations do not specify how you must notify a patient of the possible releases of facility directory information and releases to individuals involved in their care, except to say that the notification may be oral. While discussion of the issue in the Privacy Notice may legally suffice, it would be wise to also include notification and opportunity to opt out in your admitting forms.
	-	The regulations actually give the treating physician the responsibility for determining if information should be released when the patient has not had the opportunity to object. Because the hospital is liable for any releases that violate HIPAA, however, the hospital should also take on the responsibility of making the judgement about release.
	-	Hospitals should develop standard criteria to apply when making the judgement whether information may be released when the patient has not had the opportunity to object.
	-	If information is released without the opportunity to object, you must inform the patient of the disclosure as soon as is practicable and provide an opportunity to object to future uses or disclosures.
	-	Whenever you release information about a patient without the opportunity to object, make sure you document the factors that led to the judgement that release of information is appropriate.
	-	Even though the HIPAA regulations allow you to release a patient's religious affiliation, you are not required to obtain this information from the patient.
	-	Never release information that could embarrass or endanger patients. For example, revealing that a patient is located in the psychiatric unit or the obstetric unit following a miscarriage or other adverse outcome may embarrass some patients. Further, if the hospital has reason to believe that a person inquiring about a patient could endanger the patient, such as an abusive partner, the hospital should not provide information about the patient, even if the patient has not opted out of release.

Top

Disaster Situations

Releases to Identify and Locate Family Members

Hospitals and other providers may disclose a patient's protected health information to notify, identify and locate family members or others involved with the patient's care. Disclosure for this purpose is limited to the patient's:

• Location in the hospital;

• Condition; or

• Death

Releases to Other Hospitals or Relief Agencies

You may release patient information to other hospitals, healthcare facilities and relief agencies in situations where multiple facilities are receiving patients from one disaster. Specifically, you may disclose patient information to a public or private organization assisting in relief efforts for the purpose of notifying family members or others responsible for a patient's care about the patient's location, general condition or death.

Releases to the Media

Releases of information to the media are discussed in detail in the guidelines entitled "Media."

Top