Privacy
Standards under HIPAA
DIVISON OF MENTAL
HEALTH SERVICES
DEPARTMENT OF HUMAN SERVICES
M E M O R A N D U M
A recent opinion from the Attorney General's office and
the federal plan to begin enforcing privacy standards under
HIPAA necessitate some slight changes in the way we deal
with releasing the information that a person is a patient
at one of our hospitals. Currently, upon receipt of a request
for information about a patient, staff is told to request
specific permission of the patient to disclose that he or
she is in the hospital. That procedure should continue for
most inquiries, but if the inquirer is a family member or
a friend (including personal attorney or physician) of the
patient, and that fact has been confirmed by the patient
or by the personal / medical history that arrived with the
patient, the procedure will be slightly different.
If the inquirer is a family member or friend, the hospital
can disclose that the person is currently in the hospital
if that disclosure is in the best interest of the patient.
No information may be revealed about treatment or diagnosis
without giving the patient an opportunity to object or consent
to release of that information. In addition, the hospital
is prohibited from releasing even the fact that the patient
is in the hospital if the patient has specifically requested
that the inquirer not be told, or if s/he has asked that
no inquirer be told that h/she is there, or if the treatment
team documents that the release of the information would
be against the patient's interests
Therefore, upon admission, or as soon as practicable thereafter,
each patient should be asked if there is anyone who should
not be told they are in the hospital. The team should also
decide if anyone should not be told because it would not
be in the patient's interest for the person to know. When
an inquiry is made after the patient and team have had the
opportunity, the hospital must verify the relationship and
then may release the information that the person is a patient.
The differences in procedure will not be great in most
cases. To confirm that a person is a family member or friend
will often require speaking with the patient, as will the
determination of whether the release is in the interest
of the patient; however, in a few cases where a worried
person cannot locate a missing relative, the knowledge that
the relative is safely in the hospital will provide a large
measure of comfort and is clearly permitted under the HIPAA
standards and state law as interpreted by the Attorney General.