Have you ever had questions about what might be going on with an older loved one’s health? But then you find that your older relative is unable — or unwilling — to let you in on the health details?
Or maybe you’ve wanted to talk to your parent’s doctor, but worried that doing so might be a HIPAA violation?
Such issues come up often for the family caregivers of aging adults. Common situations include:
- An older parent who starts to act in ways that are strange or worrisome, such as becoming paranoid or delusional.
- An older adult who seems to be physically or mentally declining, but seems reluctant to discuss the situation
- A hospitalization or emergency room visit
- A hospitalized older person becoming confused (this would be delirium) and becoming no longer able to explain to family what the doctors have said
In these situations, family caregivers often find themselves grappling with issues related to the HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule.
Why all the grappling?
Well, although most people — and all clinicians — have heard of HIPAA, its rules and requirements are often misunderstood. So for instance, families may assume that it’s a HIPAA violation to report a relative’s worrisome behavior to the doctor, because their relative hasn’t given them permission to do so.
Even worse: doctors and other clinicians sometimes refuse to disclose any information to families, and will incorrectly claim that it’s a HIPAA violation to do so. This can create extra confusion and stress for families, or can even sometimes put an older person at risk for harm.
If you’ve been concerned about an aging parent’s health, or are otherwise helping someone with their health concerns, then it can be very helpful to understand HIPAA better. HIPAA regulations will also govern your access to medical records and other important health information.
In fact, the American Bar Association includes “Know your rights of access to health information” among its Ten Legal Tips for Caregivers.
The detailed ins and outs of HIPAA can indeed be hard to fully understand. But, it’s not too hard to learn some practical basics, especially since the US Department of Health and Human Services (HHS) provides a Summary of the Privacy Rule here, and maintains a truly useful set of online FAQs about HIPAA here.
In this article, I’ll explain five useful key basics to help you understand HIPAA better, especially when it comes to getting information and medical records as a family caregiver.
I’ll also address five questions I’ve often heard family caregivers ask about HIPAA.
At the end, I’ll share some of my favorite online HIPAA resources, as well as some final tips to keep in mind.
5 Key Basics About HIPAA
1. What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law passed in 1996. Among other things, HIPAA required the Department of Health and Human Services (HHS) to create a federal “Privacy Rule” for health providers and health plans, governing how these entities must protect the privacy of an individual’s medical information.
Usually, when people refer to HIPAA, they are actually referring to the HIPAA Privacy Rule created by HHS.
The HIPAA Privacy Rule basically says that “covered entities” must take certain steps to keep a person’s health information confidential and secure.
“Covered entities” means health providers, health insurers, and many other professionals whose daily work involves the handling of individuals’ medical information.
Private citizens and family caregivers are not “covered” by the Privacy Rule. This means that you do not have to maintain your — or your older parent’s — health information confidential in the same way that health providers do.
Exactly how “covered entities” should comply with the Privacy Rule can get pretty complicated to explain. What is most important for you to know is that this often — but not always — means taking steps to make sure that patients are in agreement, before their health information is shared with other people.
Overall, HIPAA is intended to balance a person’s right to privacy with the need for health providers to share medical records and otherwise communicate with others, in order to properly care for a patient and act in the patient’s best interest.
To read about the rule in more technical detail, see here: Summary of the HIPAA Privacy Rule.
To read a good plain-English summary of your rights (as an individual) under HIPAA, see here: Your Rights Under HIPAA.
2. What information is protected by HIPAA?
HIPAA’s Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity, no matter what form it is in. So HIPAA applies whether a person’s health information is held or disclosed electronically, orally, or in written form.
A person’s health information is often referred to as “protected health information” (PHI). This covers information that relates to:
- a person’s past, present or future physical or mental health or conditions
- any health care provided to a person (e.g. clinical notes or lab results related to a person’s medical care)
- past, present, or future payments related to a person’s health care (e.g. billing records)
In other words, this is information created by, or stored by, healthcare providers and insurers, such as medical records.
HIPAA also covers demographic data and any information that can be used to identify a person, such as names and addresses.
If you are a family caregiver, remember that you are not a “covered entity.” Hence you aren’t responsible for protecting health information in the same way that your relative’s doctor is.
3. What to know about HIPAA’s rules on the disclosing of protected health information without committing a HIPAA violation
You’ll be able to sort out what is and isn’t a HIPAA violation more easily if you understand a few fundamentals about HIPAA’s rules on these issues.
According to the HHS Summary of the HIPAA Privacy Rule: “A covered entity may not use or disclose protected health information, except either:
(1) as the Privacy Rule permits or requires; or
(2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.”
In other words, doctors are allowed to disclose health information if a person authorizes it in writing, or if the Privacy rule otherwise permits or requires such disclosure.
Now, let’s address the difference between being required and being permitted to disclose, because that is really at the heart of a lot of HIPAA confusion.
The difference is that when doctors are required to disclose, then they have to do it, whether or not they want to.
Whereas when they are permitted to disclose, they are allowed to do it, but they don’t have to. (Which means, they might refuse to do it, and they are legally allowed to do so, unless other federal, state, or local laws apply.)
You now probably will want to know: under what circumstances are health providers required or permitted to disclose health information?
Required disclosures of health information. Health providers must disclose protected health information in these two situations:
- When individuals — or their personal representatives — request access to their protected health information. Individuals can also request an accounting of disclosures, which means the covered entity has to tell a person with whom the information was shared.
- When the Department of Health and Human Services requests information, as part of a compliance audit or enforcement investigation.
In short: if you request it, your doctors must give you copies of your medical records. This is known as the “Right of Access.” You can learn more about your rights to view or obtain copies of your health information here: Individuals’ Right under HIPAA to Access their Health Information.
And if you are the durable power of attorney for healthcare for your relative, and if you are currently authorized to act, you have the right to request and obtain your relative’s health information.
Permitted disclosures of health information. Under certain circumstances, health providers are allowed — but not required — to disclose information, without obtaining the patient’s written permission.
Now here’s where things start getting trickier, because the list of permitted circumstances is much longer and more complicated than the list of required disclosures.
If you want to learn about all the permitted disclosures and uses, you can do so by reading the HHS Summary of the Privacy Rule.
But I think it’s more useful to learn from the FAQs that HHS has published online, especially the ones created to guide doctors and other healthcare professionals. I will share some of the more useful ones in the next section, when I address FAQs based on the questions I’ve had people ask me.
For now, the main thing you should know is this: in many cases, health providers are allowed, but not required, to disclose health information to others, even if a patient doesn’t give written or verbal permission for this.
As you will see below, when we go through some FAQs, doctors are allowed to use their clinical judgment and disclose information when a patient lacks capacity to give consent, if the clinician decides that the disclosure is in the best interest of the patient.
4. What to know about HIPAA’s “minimum necessary” requirement
The HIPAA Privacy Rule describes a principle of “minimum necessary” use and disclosure:
“A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.”
Basically, this means that when health providers disclose health information to someone other than the patient, they can’t just disclose anything and everything about their patient’s health. Instead, they should only share on a “need to know” basis, and focus on what’s relevant and necessary.
Note that the minimum necessary requirement does not apply to all disclosures. The Privacy Rule summary lists six situations as exempt, including “disclosure to or a request by a health care provider for treatment.”
In short, if your doctor refers you to another doctor, she can send your whole medical chart along. But, if a doctor is speaking to your family while you are sick in the hospital, the doctor is only allowed to disclose what is necessary and relevant to your current hospitalization and care needs.
5. What is a “HIPAA release”?
Many health providers and other covered entities will require a person to sign a written authorization, before they disclose protected health information. This is sometimes called a HIPAA release, a HIPAA waiver, or a release of information authorization.
Interestingly, the HIPAA Privacy rule itself does not require health providers to do this. Instead, per the Summary:
“Obtaining ‘consent’ (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities. The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent.”
In other words, although it’s extremely common for health providers to ask patients to sign written authorizations before disclosing health information, such written consent is not actually required by HIPAA.
Instead, a requirement for written consent usually reflects a clinic’s policies, or perhaps the preference of an individual clinician. Understandably, clinicians want to avoid HIPAA violations or otherwise being accused of failing to protect a patient’s confidentiality.
5 Caregiver FAQs about HIPAA and avoiding HIPAA violations
1. Is written permission always required by HIPAA, for a doctor to be able to talk to me about my older parent’s health?
Nope! As noted above, for permitted disclosures of health information, HIPAA does not require that a patient give written permission.
Instead, clinicians are allowed to use a patient’s verbal consent.
HIPAA also says it’s ok for clinicians to give patients an opportunity to object and to proceed if they don’t object, or even to “reasonably infer, based on professional judgment, that the patient does not object.”
Personally, I have often spoken to a patient’s adult children on the phone, because the patient told me it was okay to do so. However, I usually document in my clinical note that the patient said it was fine to talk to his or her children.
Last but not least, if a patient is not present or if it’s “impracticable because of emergency circumstances or the patient’s incapacity for the covered entity to ask the patient about discussing her care or payment with a family member or other person,” HIPAA says that clinicians can disclose information if they determine that doing so is in the best interest of the patient.
In short, HIPAA allows health providers to have a lot of leeway, when it comes to disclosing medical information to family and others. However, those disclosures will usually have to comply with the “minimum necessary” rule.
Most state laws are similar to HIPAA, but in some states, requirements may be more stringent.
You can find more details through these FAQs:
2. Can doctors talk to me about my older parent’s health during an emergency?
Yes, HIPAA allows this type of disclosure. So doctors are permitted to update you about your parent’s health during an emergency.
Furthermore, HIPAA does not require providers to ask family caregivers for proof of identity, before disclosing information.
That said, just because doctors are permitted to disclose information to you doesn’t mean they have to do it. As this FAQ notes, “a health care provider is not required by HIPAA to share a patient’s information when the patient is not present or is incapacitated, and can choose to wait until the patient has an opportunity to agree to the disclosure.”
For more information:
3. My older parent doesn’t want his doctor to talk to me. What can I do?
This question tends to come up when a family has become concerned about an older person’s mental and/or physical decline. Some older adults will resist their family’s desire to communicate with the doctor. So what can be done?
First of all, as a family member, remember that you are not a “covered entity.” So whether or not a doctor is permitted to disclose information to you, HIPAA does not prevent you from contacting your parent’s doctor and relaying any concerns or information you have.
You can even ask questions; the doctor probably won’t answer them, but it’s good for your parent’s doctor to know what kind of questions your family has.
Otherwise, if your parent has specifically told his doctor to not talk to you, then there are a couple of angles you can consider:
- Consider the possibility of incapacity. HIPAA does permit doctors to disclose information to family when a patient is incapacitated or otherwise unable to consent to the disclosure.
- If you think your parent might be incapacitated by cognitive decline, delirium, or another medical problem, ask the doctor to consider this.
- You can start by voicing concerns in a phone call, but it’s best to eventually put them in writing, because your letter will normally end up scanned into your parent’s medical chart. Be sure to include information on concerning behaviors of incidents that you have observed (such as any of these: 8 Behaviors to Take Note of if You Think Someone Might Have Alzheimer’s).
- You can learn more about incapacity here: Incompetence & Losing Capacity: Answers to 7 FAQs
- Has anyone been designated as durable power of attorney for healthcare? HIPAA allows a patient’s representative to request medical records and health information.
- Check any durable power of attorney documentation to see under what circumstances the agent has authority to act. Most documents require the older person to be incapacitated, but some allow the agent to act right away.
Of course, even if you are legally permitted to seek information about your parent’s health, your parent is likely to be angry about your doing so. The decision to override an older person’s decision or preferences is a serious one, and should only be considered under special circumstances.
If you have good reason to believe your parent’s insight and judgment are impaired, then it may be ethically reasonable to override their preference for privacy and take actions that will help them achieve their health and safety goals. Just be sure to think through the benefits and risks of your available options carefully, before you proceed.
Of course, what is better is that older adults plan ahead and tell their children what they should do if their older parent ever seems to be ill or mentally impaired, and refuses assistance. But as most older adults don’t get around to doing this, family caregivers do sometimes have to consider some difficult trade-offs when it comes to privacy versus health, safety, or other goals.
Relevant HIPAA FAQs and other information:
Incompetence & Losing Capacity: Answers to 7 FAQs
4. Does a power of attorney for healthcare give me the right to access my parent’s health information?
HIPAA gives a patient’s authorized “personal representative” the right to access information and medical records. A personal representative is defined as a person authorized, under State or other applicable law, to act on behalf of the individual in making health care related decisions.
So yes, if you are the durable power of attorney for healthcare, then you will have a right to access your parent’s health information, provided you are currently authorized to act.
A power of attorney document should specify under what conditions the agent can act. Some are “springing,” which means the agent can only act if the “principal” (the person signing the document) is incapacitated.
But other durable power of attorney documents may allow the agent to have authority to act right away. In this case, you can act unless there is a conflict with what the principal says (assuming the principal has not been deemed incapacitated).
For more information:
Guidance: Personal Representatives
Individuals’ Right under HIPAA to Access their Health Information
Addressing Medical, Legal, & Financial Advance Care Planning
5. My parents want their doctors to share health information with me. How can we make sure the doctors do this?
The best approach is for your parents to bring this up with their doctors and ask what should be documented, to ensure this.
Even though HIPAA itself does not require patients to provide written authorization in order to disclose information to family, clinicians usually feel more comfortable disclosing information if the patient has put something in writing. Many clinics have forms available for this purpose.
Another thing to consider is having your parents designate you as durable power of attorney for health. Consider having your parent indicate that your authority is effective immediately, rather than upon incapacity. (This is an option on health POA forms in California.) This will confirm your status as their “personal representive,” when it comes to requesting access to their medical information.
For more information:
More Useful HIPAA Resources
I’ve tried to cover the practical basics for caregivers in this article, but of course, there’s a lot more to HIPAA and medical privacy. As of 2020, there has also been additional guidance provided related to COVID, which you can find here: HIPAA and COVID-19.
Here are some of my favorite resources.
HIPAA Resource List
HIPAA FAQs for Professionals: Disclosures to Family and Friends
California Civil Code (regarding disclosures to family): CHAPTER 2. Disclosure of Medical Information by Providers
Individuals’ Right under HIPAA to Access their Health Information (Includes FAQs)
Next Step in Care Guide: HIPAA: Questions and Answers for Family Caregivers
Final Tips
Here are a few final tips for you to keep in mind, if you ever want to talk to a doctor about a relative’s healthcare.
- Plan ahead if possible.
- Older people should consider how their family might be able to communicate with doctors in the event of an emergency, or even in the event of developing memory or thinking problems.
- Find out how your family’s usual doctors and health providers will be most comfortable disclosing health information. Complete release of information forms ahead of time if possible.
- Every older person should complete a durable power of attorney form for healthcare. Consider giving the agent authority to act immediately; this will enable the agent to request medical records even if the older person has not been proven to be incapacitated.
- Consider researching your state’s laws governing disclosure of health information to family and friends.
- Many states have laws similar to HIPAA, but some may impose additional restrictions.
- Be prepared to politely help inform clinicians of what HIPAA permits. Some clinicians may not realize that HIPAA does allow them to talk to you about your relative’s health, depending on the circumstances.
- Consider printing out a copy of the relevant HHS HIPAA FAQs for Professionals: Disclosures to Family and Friends.
- For a good NPR story confirming that hospital employees and health providers often do NOT understand your access rights: It’s Your Right To See Your Medical Records. It Shouldn’t Be This Hard To Do.
- Remember that although HIPAA permits clinicians to disclose information under many circumstances, such disclosures are not required. Clinicians are only required to disclose health information when a patient — or authorized representative — requests this, based on the patient’s right of access.
This article was last reviewed and updated in July of 2024.
David D says
My father has passed away and my sister was the executor of the estate. i am in need of my fathers medical records as i have a claim to file with the division of Energy Employees Occupational Illness Compensation. is there any other way to obtain my fathers medical records other than through my sister?
Leslie Kernisan, MD MPH says
I am not sure what your options are, I think it will depend on several things, including whether you were your father’s power of attorney, the laws of the state where you are, and more. These two resources can help you:
HIPAA FAQs: Decendents
Accessing Deceased Patient Records—FAQ
Trisha says
This article is very interesting. I do have a question:
If a wife requests an eyeglass prescription for her husband, is this allowed to be given without his permission? I relate it to a relative picking up a medical Rx at the drug store, which is allowed???
Leslie Kernisan, MD MPH says
I think this would be allowed under HIPAA, based on this FAQ:
HIPAA FAQ 535-Can a patient have family pick up a filled prescription?
However, just because HIPAA allows something doesn’t mean the provider has to do it, it just means the provider is allowed to decide. The provider is also usually expected to use good judgment and have reasons for believing that the disclosure (or allowing a family member to pick up meds) is not something the patient would object to and/or is in the best interest of the patient.
Tara P says
Hi. I recently facilitated placing my 91 yr old uncle with NO previous hx of dementia or decline in health, in a rehab facility following an acute episode of delirium secondary to kidney nephrosis, uremic toxicity. Once there, because he had no advance directives, the facility excluded me from participating in his care. I am his only local relative, the only other relative being my mother (his sister and his durable POA,) she has also been excluded. His doctor there refuses to speak with us, even though my uncle couldnt give consent either way. His delium is starting to clear but he still thinks someone is trying to kill him, and that he is already dead, that all his friends have died, that someone has taken all his money, etc. He told me yesterday he is afraid of the place and the people there. The facility had him sign a DNR two days ago, informed me after the fact. I have challenged the DNR, because i do not believe he has capacity, and I fear he was coerced. The facility assured me he read and understood what he was signing, but he didnt even have his glasses, and doesnt read much anymore because a stroke 20 yrs ago made it difficult to always comprehend what he was reading. He has for 20 yrs had his sister/ POA take care of all his bills, legal, and financial affairs. Am I correct to be concerned about him initiating DNR at this time? He has significant financial resources.
Leslie Kernisan, MD MPH says
Hm, this sounds like a sticky situation. If you think he’s been delirious, then it certainly sounds questionable for them to have him sign legally binding paperwork, as he may not currently have the decision-making capacity for this.
I have more on decision-making capacity here: Incompetence & Losing Capacity: Answers to 7 FAQs
Some possible ways to proceed:
– Put your concerns regarding his capacity to make these decisions in writing. Explain why you are concerned that he may not have capacity to oversee his health at this time or to engage in advance care planning. Spell out your reasoning and also spell out that his family has previously overseen his care. Ask for them to meet with your family to discuss a better way forward. You may or may not want to hint at the possibility your family might consider filing a complaint or legal action if your concerns aren’t addressed.
– Consider contacting the long-term care ombudsman for your location. There should be one in every state.
You basically need to be polite but persistent. Ask to talk to supervisors and management. Be clear about why you’re concerned about your uncle and why they should allow your family to be involved. Good luck!
Rebecca Jackson says
My mother has been in the hospital for 3 weeks. For the most part she has been unresponsive. How can I collect her medical records if she is unable to give consent?
Leslie Kernisan, MD MPH says
Sorry to hear about your mother’s hospitalization, it sounds serious. It also sounds like she did not complete a durable power of attorney for healthcare form. (Or if she did, she didn’t name you as the agent.)
If no person is the durable power of attorney for healthcare and a person is unable to make medical decisions, most states have some kind of process for allowing the next of kin to make necessary medical decisions. So healthcare providers would be able to disclose at least some medical information to family, especially that which is necessary to make the needed medical decisions. However, I don’t know how much access this gives family members to the medical records. It’s possible that to get the full record, you might need to petition the court for at least temporary guardianship. An elder law attorney should be able to advise you regarding your state’s laws and what your options are.
The hospital should also be able to advise you as to your options for overseeing your mother’s medical care in the short term. Of course, if there are several close family members involved or wanting to be involved, things can get complicated. Good luck!
Richard O. says
Hello,
My sister in law works at a va medical center as a RN. She has provided on several occasions information on my treatmens, labs and diagnosed health issues ive have had over the past year. To my spouse. Has she violated my privacy? Has she violated HIPPA. I have told my spouse that she has no right to do that.
Am I correct. How do I get her to stop.
Leslie Kernisan, MD MPH says
Hm. It sounds like you are a patient at the VA where your sister-in-law is an RN.
I’m not an attorney and the following is not legal advice, it’s just my understanding of the principles related to your comment.
In general, healthcare professionals and employees of the medical center can access most patients’ individual medical records, but we are not supposed to do so unless we have a legitimate reason for viewing that information, e.g. the patient is under our care.
If we do have legitimate reasons for viewing and accessing a person’s protected health information (PHI), then we are not supposed to disclose it to family or friends or others unless the patient gives consent. (As I explain in the article, there are some exceptions and loopholes: clinicians can disclose PHI without consent if the patient is impaired and if they think it’s necessary and in the best interest of the patient.)
Per HIPAA a patient can give consent verbally, but some institutions have policies specifying how clinicians have to document consent. I’m not sure what the VA’s policy is regarding this.
In terms of the situation you describe, whether your sister-in-law committed privacy violations presumably depends on whether she initially had a legitimate reason to view or obtain your medical information. “I’m related to him and work here” probably isn’t legitimate, whereas “I’m the nurse assigned to work with his primary care doctor and have to regularly view his chart” might be. If she did have legitimate reasons to access your information, then the next question would be whether the VA had your consent to disclose information to your spouse, or whether there were other legitimate reasons to justify the disclosure.
You can view a VA patient privacy brochure here: Privacy and Records Management Respecting Veterans Privacy
I think if you are concerned or think she should stop, you should contact the VA Medical Center. They each have a Privacy Officer, that is probably the person to report the concern to.
Mary B says
What amount or kind of information can I give to my son’s mental health practitioner that the practitioner does not have to disclose to the patient or client that this information has been transmitted? My son has mental health issues and I know things that could help the therapist to understand his illness. Part of the illness is son’s denial of this health condition. I want to send the therapist written information (articles). Does the therapist have to tell my son that I sent them this information? It’s pretty benign – is this entirely up to the therapist or is therapist legally bound to disclose to patient that I sent this?
Leslie Kernisan, MD MPH says
I just addressed similar issues in a recent comment. My understanding is that the therapist does not have to disclose this type of information to a patient. Whether this information could be found if your son requests his medical record, that would depend on whether it fell into the medical record versus the provider’s psychotherapy notes.
You could try contacting the therapist just to ask this question. I would think that this comes up often in mental health treatment. It might also help to let the therapist know about your preference that your son not know you’ve contacted his therapist. Good luck!
Ann says
We have a family member that is severely mentally ill and paranoid. We want to send a detailed letter to his physician to explain his condition but do not want him to know that we have done so. He is manipulative and can alter his behavior long enough to get his meds filled but then quickly lapses back into his violent and disfunctional behavior. Is the physician obligated to tell the patient that family members have submitted a letter describing the disturbing behavior? Our only motivation is to help this family member get treatment but we are afraid if the physician discloses that we have done this, family members will be in danger due to the patients serious paranoia and anger issues. Thank you!
Leslie Kernisan, MD MPH says
I’m not an attorney or expert on the law. My understanding is that clinicians have no obligation to tell patients that family members have provided a letter or other information. If you are very clear in stating your request that the clinician not disclose your letter and you add that this is due to a safety concern, then I think most clinicians will not mention the letter to the patient.
Now, patients do have the right to request their medical record. In many cases, letters or other information from family members gets scanned and is added to the patient’s medical record. So if the patient subsequently requests to view or get a copy of their medical record (which they have a right to do), a family member’s correspondence to the clinician could be found at that point.
There is one exception to patient’s right to their health record, and that is that they don’t have the right to “psychotherapy” notes, which are special notes kept by mental health professionals, which complement the record. (More on those here.)
In my experience, patients rarely ask to view or get copies of their medical records, but some do. If you think this is a possibility, I suppose you could send a letter to the health provider and ask that it not be added to your relative’s medical record. The clinician presumably doesn’t have to honor your request but perhaps would…they would have to decide what they felt made sense given the circumstances.
I do think you are right to try to notify your relative’s health provider, and hope you find a way to do so. Good luck!
Gary Puntman says
I didn’t know very much about HIPAA before finding this article. It’s good to know that the American Bar Association mentioned you should know your rights of access to health information. I think this is true. You should always understand what HIPAA includes beforehand. You want to make sure you know how to access a family member’s information when you need to.
Leslie Kernisan, MD MPH says
quite so, thank you.
VS says
Is there a HIPAA rule where it states that a Verbal authorization (only to be able to speak about treatment) should be signed separate from a Disclosure Authorization?
Thank you.
Leslie Kernisan, MD MPH says
Hm…I’m not sure what you mean by a “verbal authorization.” Technically HIPAA distinguishes between getting a patient’s consent for disclosure, versus getting an authorization for disclosure. You can learn more through this HHS.gov FAQ: What is the difference between “consent” and “authorization” under the HIPAA Privacy Rule?
Providers do have a lot of leeway in how they can obtain and document a patient’s consent to the provider talking with family or others.
Sue Hawes says
This is really helpful information!!! So many times personnel hide behind the HIPAA rules without knowing what is permitted and what is required. I live in a CCRC and am going to bring this into a program for our seniors here. We might even do a TV program on our closed network and make it available on our streaming service.
Thank you.
Leslie Kernisan, MD MPH says
Glad you found this useful. If you live in a CCRC, it might be a helpful to approach the management and ask them to clarify what their CCRC policy is, regarding allowable disclosures of information. This way you’ll be able to start finding out if the personnel are “hiding” behind HIPAA rules based on their individual preferences and understandings of the rule, versus based on their employer’s policies and directives. Good luck!
Evita Crowder says
My son Doctor office will not give me his medical records can I take legal action?
Nicole Didyk, MD says
This sounds like a stressful situation. I think the success of any legal action would depend on a lot of things like the age and health conditions of your son, and whether or not he is capable of consenting for you to see the records. I hope you can find a way to help your son with access to his records or not.
Carl Tyler says
My wife is at a hospital I have called 3 times over the last 4 hours they are using HIPPA saying that can’t release any information to me. They won’t even tell me if she is alive. I don’t know what I can do.
Nicole Didyk, MD says
That sounds very frustrating and I can understand your concern.
It seems that under HIPPA, the hospital can disclose information about your wife if they have your wife’s permission. If she isn’t capable of giving permission, they can disclose if they think, in their professional opinion, that disclosing information would be beneficial to her.
You can read more about that on the US Health and Human Services website here: https://www.hhs.gov/hipaa/for-professionals/faq/2069/under-hipaa-when-can-a-family-member/index.html
If there’s no reason that your wife would object to you knowing that she’s there, then it is probably a misunderstanding and I would advise someone in your position to be persistent. I hope your wife is OK and you can get the information that you need.
Melissa Anderson says
Hi Leslie,
My dear sweet Mother passed away last Nov still piecing together what was the cause of the horrific fall which lead to her death. The sister who was POA caregiver executor has had no communication with me for years and nothing was communicated to me by her what exactly happened or any medical issues.
How do I get this info. I also want to vew the will.
Had to get alot of info on my own.
Can you help me please.
Melissa
Nicole Didyk, MD says
I’m so sorry to hear that you lost your mother. I can understand having so many questions about how it all happened.
You don’t mention if you’ve asked your sister for information, but if you haven’t that’s a good place to start. Sometimes, after the parent has passed, there can be a softening of tensions between siblings.
If she’s not forthcoming, you may be able to view the will if it’s been filed in a probate court. I’m not a lawyer, and it may be unavoidable that you need to speak to one to get the best advice.
Medical records can be harder to obtain, but again, working with a lawyer will point you in the right direction.
I hope you get the answers that you need and can find some peace.