What HIPAA says: Most of HIPAA’s disclosure exceptions are permissive; meaning that the provider may use professional judgment when deciding whether or not to disclose the information.If the records request is for treatment purposes, HIPAA permits disclosure to another provider without patient authorization, i.e., without an authorization document that meets certain requirements.Situation #6: A patient’s family member asks the provider not to inform the patient of a serious diagnosis (i.e., brain tumor) made in the ED that was shared with the family for a patient who came in incapacitated (i.e.
While serving as the protector of PHI, limiting disclosures without patient authorization, and generally ensuring that people’s private medical conditions are not broadcasted in public, HIPAA is often misunderstood and misapplied in practice.
Incorrectly applied invocations of HIPAA can sometimes limit access to vital information and harm patients.
Below are 10 clinical situations in the ED where HIPAA is commonly invoked and how HIPAA actually applies to those situations.
Keep in mind, however, that every investigation of an alleged HIPAA violation is very fact-specific.
This rule prevents inappropriate disclosures when, for example, a caller inquires about the status of “the gunshot victim.” A provider may disclose PHI to the media where necessary to identify, locate, or notify individuals responsible for the patient’s care, but media-initiated inquiries about a specific patient do not fall within this exception.
What HIPAA says: Disclosures made “incident to” an otherwise permitted disclosure of PHI (such as disclosures for treatment purposes) are permissible.
This opportunity to object may be offered verbally or in writing, such as through the notice of privacy practices that is given to patients upon arrival in the ED.
What HIPAA says: Disclosures of PHI from one provider to another provider for treatment purposes are permissible without the patient’s authorization.
For example, the “minimum necessary” rule requires that the PHI disclosed for non-treatment related purposes must be limited to the minimum amount necessary to accomplish the intended purpose of the disclosure.
In other words, only relevant information may be disclosed.