Most people have at least a passing familiarity with HIPAA’s restrictions on disclosure of personal medical information, or “protected health information.” A recent New York Times article points out some of the overreactions “because of HIPAA”: a church bulletin that no longer listed sick parishioners, family members asked to stop discussing a patient’s condition in a hospital’s café, an emergency room that refused to take the medical history of a patient over the phone, and a retirement community that wouldn’t say what had happened to its residents who were no longer there.
As the article points out, HIPAA does not apply at all to the church bulletin and café conversation examples because the church and family members are not health care providers covered by the privacy rules. Additionally, there are no privacy concerns when someone is giving information to a health provider. A nursing home or assisted living facility can report deaths of residents and can give a resident’s condition and location if the resident is still in the facility. Residents can give permission to a facility’s administrators to let their neighbors to know if they go to a hospital.
Another common concern is how a patient makes a valid consent to release information. Although facilities may insist on a signed consent, verbal consents to release information to a relative or friend are perfectly fine, too.
The article notes that many staff members fear retribution for disclosing information. However, the Health and Human Services Office for Civil Rights that enforces the privacy rules is more interested in fixing problems and not in playing a “gotcha game” if the staff member acted in good faith.
For more information on HIPAA’s requirements, check out the Office of Civil Rights’ extensive online resources, including FAQs. A quick review of these resources may help to clear up these types of misunderstandings.