Providers must first provide patients the opportunity to agree or object to the disclosure of “directory information.” If the patient is incapacitated, the provider must inform the patient that such disclosures were made and give the patient the opportunity to object to further disclosures as soon as practicable.
This requirement protects, for example, victims of domestic abuse who may not want their whereabouts divulged to their abuser.
Below are 10 clinical situations in the ED where HIPAA is commonly invoked and how HIPAA actually applies to those situations.
Keep in mind, however, that every investigation of an alleged HIPAA violation is very fact-specific.
What HIPAA says: HIPAA requires providers to give a patient access to his/her PHI when the patient specifically requests it, unless the PHI or patient is subject to special protections or another law authorizes the provider to withhold the information (e.g., a state law further restricting disclosure of mental health information).
Absent such a request and assuming the patient has not objected to the provider’s disclosure of PHI to family members, this situation raises ethical rather than HIPAA concerns.
The disclosing provider must use professional judgment to determine whether the requested PHI relates to the patient’s treatment by the requesting physician.
What HIPAA says: Location and general health status (i.e., directory information) can be disclosed if the requestor identifies the patient by name unless the patient has objected to such disclosures.
Situation #6: A patient’s family member asks the provider not to inform the patient of a serious diagnosis (i.e., brain tumor) made in the ED that was shared with the family for a patient who came in incapacitated (i.e.
in status epilepticus) and is now awake and alert because the family doesn’t think the patient cannot handle the information.