The Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) Privacy Rule permits covered entities (CEs) to disclose information to non-family members of a patient when that information relates to the non-family member’s care of or payment for health care of the patient, but it also allows CEs to notify a non-family member of the patient’s location, general condition, or death. The HHS Office for Civil Rights (OCR) issued an FAQ discussing these issues in response to the 2016 Pulse Nightclub shootings in Orlando, when confusion arose over hospitals’ ability to discuss patients’ conditions with their partners. In an emailed press release, the OCR noted, “the FAQ makes clear that the potential recipients of information under the relevant permissive disclosure provisions . . . are not limited by the sex or gender identity of the person.”
45 C.F.R. section 164.510(b)(1) states that CEs may disclose protected health information (PHI) relevant to a person’s involvement with a patient’s care or payment for the patient’s care, “to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual.” It further permits a CE to share PHI “to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death.” When a patient is unable to give verbal permission regarding the disclosure of PHI to specific people, the OCR stated that the Privacy Rule defers to the CE’s professional judgment without requiring it to verify the relationship between the person receiving the disclosure and the patient.
The OCR also discussed required disclosures in relationship to the rights of same-sex spouses, and issued additional guidance regarding same-sex spouses’ rights. Pursuant to the U.S. Supreme Court decision in Obergefell v. Hodges, states must permit same-sex marriages and recognize lawful same-sex marriages performed in other states. The guidance reminds CEs that the term “marriage” refers to all lawful marriages, the term “spouse” refers to all lawfully married spouses, and the term “family member” includes both the lawful spouses and the dependents of all lawful marriages. The Privacy Rule regards persons authorized under state or other applicable law to act on behalf of the individual in making health care related decisions as the individual’s “personal representative.” 45 C.F.R. section 164.502(g) provides when, and to what extent, the personal representative must be treated as the individual. Therefore, if a state grants legally married spouses the authority to make health care related decisions on each other’s behalf, the spouses are personal representatives and CEs must provide them with access to medical records.