The HIPAA Privacy rule should be used as a guide to healthcare entities on how to properly share information during an emergency situation.
With the news each day being filled with more and more stories about emergency situations that require medical attention, it is important now more than ever for healthcare entities to be HIPAA complaint. This often puts healthcare organizations in a difficult situation of trying to maintain compliance but also trying to provide good service to the patient and meet the needs of the family.
When is it OK to Share PHI with Family?
Only certain protected health information (PHI) is able to be shared with family members, friends and other people who the patient has identified in their care. A health organization should always first obtain verbal permission to share this information, or if it can reasonably confirm that the patient does not object to the sharing of information. During emergency situations a patient may be incapacitated, making it difficult for them to identify which family or friends should be given information. In this case providers may share the information that they feel is in the best interest of the patient. Professional judgement should be used during these situations.
When is it OK to Share PHI with Other Entities?
Often disaster relief organizations seek information on patients in order to coordinate efforts in locating family. HIPAA does allow for a healthcare organization to give out PHI to these types of entities for the purpose of those efforts. In this case with the release of information only the minimum amount of information needed should be released.
When is it OK to Share PHI with the Media?
When it comes to situations such as a mass casualty incident or a natural disaster, it is important for a healthcare organization to know how to release information to media outlets. If a patient has not restricted their information from the directory and a request comes in about that patient then the healthcare facility may release limited information about them. Information such as their general condition, whether they are deceased or were released. In the case of an incapacitated patient an organization should use their best judgment to release limited directory information.
When in doubt look to the U.S. Department of Health and Human Service Office of Civil Rights (OCR) for guidance.