The HIPAA Privacy Rule at 45 CFR 164.510(b) specifically permits covered entities to share information that is directly relevant to the involvement of a spouse, family members, friends, or other persons identified by a patient in the patient’s care or payment for health care. If the patient is present or is otherwise available prior to the disclosure and has the capacity to make health care decisions, the covered entity can discuss this information with the family and these other persons if the patient agrees or, when given the opportunity, does not object. The covered entity can also share relevant information with the family and these other persons if it can reasonably infer, based on professional judgment, that the patient does not object. Under these circumstances, for example:
•A physician can give information about a patient’s mobility limitations to a friend driving the patient home from the hospital.
•A hospital can discuss a patient’s payment options with her adult daughter.
•A physician can instruct a patient’s roommate about proper medicine dosage when she comes to pick up her friend from the hospital.
•A physician can discuss a patient’s treatment with the patient in the presence of a friend when the patient brings the friend to a medical appointment and asks if the friend can come into the treatment room.
A covered entity also may leave a message with a family member or other person who answers the phone when the patient is not home. The Privacy Rule permits covered entities to disclose limited information to family members, friends, or other persons regarding an individual’s care even when the individual is not present. However, covered entities should use professional judgment to assure that such disclosures are in the best interest of the individual and limit the information disclosed.