Have you ever had questions about what might be going on with an older loved one’s health? But then you find that your older relative is unable — or unwilling — to let you in on the health details?
Such questions come up often for the family caregivers of aging adults. Common situations include:
- An older parent who starts to act in ways that are strange or worrisome, such as becoming paranoid or delusional.
- An older adult who seems to be physically or mentally declining, but seems reluctant to discuss the situation
- A hospitalization or emergency room visit
- A hospitalized older person becoming confused (this would be delirium) and becoming no longer able to explain to family what the doctors have said
In these situations, family caregivers often find themselves grappling with issues related to the HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule.
Why all the grappling?
Well, although most people — and all clinicians — have heard of HIPAA, its rules and requirements are often misunderstood. So for instance, families may assume they can’t report a relative’s worrisome behavior to the doctor, because their relative hasn’t given them permission to do so.
Even worse: doctors and other clinicians sometimes refuse to disclose any information to families, and will incorrectly claim that HIPAA doesn’t allow them to do so. This can create extra confusion and stress for families, or can even sometimes put an older person at risk for harm.
If you’ve been concerned about an aging parent’s health, or are otherwise helping someone with their health concerns, then it can be very helpful to understand HIPAA better.
In fact, the American Bar Association includes “Know your rights of access to health information” among its Ten Legal Tips for Caregivers.
The detailed ins and outs of HIPAA can indeed be hard to fully understand. But, it’s not too hard to learn some practical basics, especially since the US Department of Health and Human Services (HHS) provides a Summary of the Privacy Rule here, and maintains a truly useful set of online FAQs about HIPAA here.
In this article, I’ll explain five useful key basics to help you understand HIPAA better, especially when it comes to getting information as a family caregiver.
I’ll also address five questions I’ve often heard family caregivers ask about HIPAA.
At the end, I’ll share some of my favorite online HIPAA resources, as well as some final tips to keep in mind.
5 Key Basics About HIPAA
1. What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law passed in 1996. Among other things, HIPAA required the Department of Health and Human Services (HHS) to create a federal “Privacy Rule” for health providers and health plans, governing how these entities must protect the privacy of an individual’s medical information.
Usually, when people refer to HIPAA, they are actually referring to the HIPAA Privacy Rule created by HHS.
The HIPAA Privacy Rule basically says that “covered entities” must take certain steps to keep a person’s health information confidential and secure.
“Covered entities” means health providers, health insurers, and many other professionals whose daily work involves the handling of individuals’ medical information.
Private citizens and family caregivers are not “covered” by the Privacy Rule. This means that you do not have to maintain your — or your older parent’s — health information confidential in the same way that health providers do.
Exactly how “covered entities” should comply with the Privacy Rule can get pretty complicated to explain. What is most important for you to know is that this often — but not always — means taking steps to make sure that patients are in agreement, before their health information is shared with other people.
Overall, HIPAA is intended to balance a person’s right to privacy with the need for health providers to communicate with others, in order to properly care for a patient and act in the patient’s best interest.
To read about the rule in more technical detail, see here: Summary of the HIPAA Privacy Rule.
To read a good plain-English summary of your rights (as an individual) under HIPAA, see here: Your Rights Under HIPAA.
2. What information is protected by HIPAA?
HIPAA’s Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity, no matter what form it is in. So HIPAA applies whether a person’s health information is held or disclosed electronically, orally, or in written form.
A person’s health information is often referred to as “protected health information.” This covers information that relates to:
- a person’s past, present or future physical or mental health or conditions
- any health care provided to a person (e.g. clinical notes or lab results related to a person’s medical care)
- past, present, or future payments related to a person’s health care (e.g. billing records)
In other words, this is information created by, or stored by, healthcare providers and insurers.
HIPAA also covers demographic data and any information that can be used to identify a person, such as names and addresses.
If you are a family caregiver, remember that you are not a “covered entity.” Hence you aren’t responsible for protecting health information in the same way that your relative’s doctor is.
3. What to know about HIPAA’s rules on the disclosing of protected health information
You’ll be able to sort out health information disclosure issues more easily if you understand a few fundamentals about HIPAA’s rules on these issues.
According to the HHS Summary of the HIPAA Privacy Rule: “A covered entity may not use or disclose protected health information, except either:
(1) as the Privacy Rule permits or requires; or
(2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.”
In other words, doctors are allowed to disclose health information if a person authorizes it in writing, or if the Privacy rule otherwise permits or requires such disclosure.
Now, let’s address the difference between being required and being permitted to disclose, because that is really at the heart of a lot of HIPAA confusion.
The difference is that when doctors are required to disclose, then they have to do it, whether or not they want to.
Whereas when they are permitted to disclose, they are allowed to do it, but they don’t have to. (Which means, they might refuse to do it, and they are legally allowed to do so, unless other federal, state, or local laws apply.)
You now probably will want to know: under what circumstances are health providers required or permitted to disclose health information?
Required disclosures of health information. Health providers must disclose protected health information in these two situations:
- When individuals — or their personal representatives — request access to their protected health information. Individuals can also request an accounting of disclosures, which means the covered entity has to tell a person with whom the information was shared.
- When the Department of Health and Human Services requests information, as part of a compliance audit or enforcement investigation.
In short: if you request it, your doctors must give you copies of your health information. This is known as the “Right of Access.” You can learn more about your rights to view or obtain copies of your health information here: Individuals’ Right under HIPAA to Access their Health Information.
And if you are the durable power of attorney for healthcare for your relative, and if you are currently authorized to act, you have the right to request and obtain your relative’s health information.
Permitted disclosures of health information. Under certain circumstances, health providers are allowed — but not required — to disclose information, without obtaining the patient’s written permission.
Now here’s where things start getting trickier, because the list of permitted circumstances is much longer and more complicated than the list of required disclosures.
If you want to learn about all the permitted disclosures and uses, you can do so by reading the HHS Summary of the Privacy Rule.
But I think it’s more useful to learn from the FAQs that HHS has published online, especially the ones created to guide doctors and other healthcare professionals. I will share some of the more useful ones in the next section, when I address FAQs based on the questions I’ve had people ask me.
For now, the main thing you should know is this: in many cases, health providers are allowed, but not required, to disclose health information to others, even if a patient doesn’t give written or verbal permission for this.
As you will see below, when we go through some FAQs, doctors are allowed to use their clinical judgment and disclose information when a patient lacks capacity to give consent, if the clinician decides that the disclosure is in the best interest of the patient.
4. What to know about HIPAA’s “minimum necessary” requirement
The HIPAA Privacy Rule describes a principle of “minimum necessary” use and disclosure:
“A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.”
Basically, this means that when health providers disclose health information to someone other than the patient, they can’t just disclose anything and everything about their patient’s health. Instead, they should only share on a “need to know” basis, and focus on what’s relevant and necessary.
Note that the minimum necessary requirement does not apply to all disclosures. The Privacy Rule summary lists six situations as exempt, including “disclosure to or a request by a health care provider for treatment.”
In short, if your doctor refers you to another doctor, she can send your whole medical chart along. But, if a doctor is speaking to your family while you are sick in the hospital, the doctor is only allowed to disclose what is necessary and relevant to your current hospitalization and care needs.
5. What is a “HIPAA release”?
Many health providers and other covered entities will require a person to sign a written authorization, before they disclose protected health information. This is sometimes called a HIPAA release, a HIPAA waiver, or a release of information authorization.
Interestingly, the HIPAA Privacy rule itself does not require health providers to do this. Instead, per the Summary:
‘Obtaining “consent” (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities. The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent.’
In other words, although it’s extremely common for health providers to ask patients to sign written authorizations before disclosing health information, such written consent is not actually required by HIPAA.
Instead, a requirement for written consent usually reflects a clinic’s policies, or perhaps the preference of an individual clinician. Understandably, clinicians want to avoid being accused of failing to protect a patient’s confidentiality.
5 Useful Caregiver FAQs about HIPAA and the Disclosure of Health Information
1. Is written permission always required, for a doctor to be able to talk to me about my older parent’s health?
Nope! As noted above, for permitted disclosures of health information, HIPAA does not require that a patient give written permission.
Instead, clinicians are allowed to use a patient’s verbal consent.
HIPAA also says it’s ok for clinicians to give patients an opportunity to object and to proceed if they don’t object, or even to “reasonably infer, based on professional judgment, that the patient does not object.”
Personally, I have often spoken to a patient’s adult children on the phone, because the patient told me it was okay to do so. However, I usually document in my clinical note that the patient said it was fine to talk to his or her children.
Last but not least, if a patient is not present or if it’s “impracticable because of emergency circumstances or the patient’s incapacity for the covered entity to ask the patient about discussing her care or payment with a family member or other person,” HIPAA says that clinicians can disclose information if they determine that doing so is in the best interest of the patient.
In short, HIPAA allows health providers to have a lot of leeway, when it comes to disclosing medical information to family and others. However, those disclosures will usually have to comply with the “minimum necessary” rule.
Most state laws are similar to HIPAA, but in some states, requirements may be more stringent.
You can find more details through these FAQs:
2. Can doctors talk to me about my older parent’s health during an emergency?
Yes, HIPAA allows this type of disclosure. So doctors are permitted to update you about your parent’s health during an emergency.
Furthermore, HIPAA does not require providers to ask family caregivers for proof of identity, before disclosing information.
That said, just because doctors are permitted to disclose information to you doesn’t mean they have to do it. As this FAQ notes, “a health care provider is not required by HIPAA to share a patient’s information when the patient is not present or is incapacitated, and can choose to wait until the patient has an opportunity to agree to the disclosure.”
For more information:
3. My older parent doesn’t want his doctor to talk to me. What can I do?
This question tends to come up when a family has become concerned about an older person’s mental and/or physical decline. Some older adults will resist their family’s desire to communicate with the doctor. So what can be done?
First of all, as a family member, remember that you are not a “covered entity.” So whether or not a doctor is permitted to disclose information to you, HIPAA does not prevent you from contacting your parent’s doctor and relaying any concerns or information you have.
You can even ask questions; the doctor probably won’t answer them, but it’s good for your parent’s doctor to know what kind of questions your family has.
Otherwise, if your parent has specifically told his doctor to not talk to you, then there are a couple of angles you can consider:
- Consider the possibility of incapacity. HIPAA does permit doctors to disclose information to family when a patient is incapacitated or otherwise unable to consent to the disclosure.
- If you think your parent might be incapacitated by cognitive decline, delirium, or another medical problem, ask the doctor to consider this.
- You can start by voicing concerns in a phone call, but it’s best to eventually put them in writing, because your letter will normally end up scanned into your parent’s medical chart. Be sure to include information on concerning behaviors of incidents that you have observed (such as any of these: 8 Behaviors to Take Note of if You Think Someone Might Have Alzheimer’s).
- You can learn more about incapacity here: Incompetence & Losing Capacity: Answers to 7 FAQs
- Has anyone been designated as durable power of attorney for healthcare? HIPAA allows a patient’s representative to request health information.
- Check any durable power of attorney documentation to see under what circumstances the agent has authority to act. Most documents require the older person to be incapacitated, but some allow the agent to act right away.
Of course, even if you are legally permitted to seek information about your parent’s health, your parent is likely to be angry about your doing so. The decision to override an older person’s decision or preferences is a serious one, and should only be considered under special circumstances.
If you have good reason to believe your parent’s insight and judgment are impaired, then it may be ethically reasonable to override their preference for privacy and take actions that will help them achieve their health and safety goals. Just be sure to think through the benefits and risks of your available options carefully, before you proceed.
Of course, what is better is that older adults plan ahead and tell their children what they should do if their older parent ever seems to be ill or mentally impaired, and refuses assistance. But as most seniors don’t get around to doing this, family caregivers do sometimes have to consider some difficult trade-offs when it comes to privacy versus health, safety, or other goals.
Relevant HIPAA FAQs and other information:
Incompetence & Losing Capacity: Answers to 7 FAQs
4. Does a power of attorney for healthcare give me the right to access my parent’s health information?
HIPAA gives a patient’s authorized “personal representative” the right to access information. A personal representative is defined as a person authorized, under State or other applicable law, to act on behalf of the individual in making health care related decisions.
So yes, if you are the durable power of attorney for healthcare, then you will have a right to access your parent’s health information, provided you are currently authorized to act.
A power of attorney document should specify under what conditions the agent can act. Some are “springing,” which means the agent can only act if the “principal” (the person signing the document) is incapacitated.
But other durable power of attorney documents may allow the agent to have authority to act right away. In this case, you can act unless there is a conflict with what the principal says (assuming the principal has not been deemed incapacitated).
For more information:
Guidance: Personal Representatives
Individuals’ Right under HIPAA to Access their Health Information
Addressing Medical, Legal, & Financial Advance Care Planning
5. My parents want their doctors to share health information with me. How can we make sure the doctors do this?
The best approach is for your parents to bring this up with their doctors and ask what should be documented, to ensure this.
Even though HIPAA itself does not require patients to provide written authorization in order to disclose information to family, clinicians usually feel more comfortable disclosing information if the patient has put something in writing. Many clinics have forms available for this purpose.
Another thing to consider is having your parents designate you as durable power of attorney for health. Consider having your parent indicate that your authority is effective immediately, rather than upon incapacity. (This is an option on health POA forms in California.) This will confirm your status as their “personal representive,” when it comes to requesting access to their medical information.
For more information:
Super Useful HIPAA Resources
I’ve tried to cover the practical basics for caregivers in this article, but of course, there’s a lot more to HIPAA and medical privacy.
Here are some of my favorite resources.
HIPAA Resource List
A Patient’s Guide to the HIPAA Privacy Rule: When Health Care Providers May Communicate About You
with Your Family, Friends, or Others Involved In Your Care
HIPAA FAQs for Professionals: Disclosures to Family and Friends
California Civil Code (regarding disclosures to family): CHAPTER 2. Disclosure of Medical Information by Providers
Individuals’ Right under HIPAA to Access their Health Information (Includes FAQs)
Next Step in Care Guide: HIPAA: Questions and Answers for Family Caregivers
Final Tips
Here are a few final tips for you to keep in mind, if you ever want to talk to a doctor about a relative’s healthcare.
- Plan ahead if possible.
- Older people should consider how their family might be able to communicate with doctors in the event of an emergency, or even in the event of developing memory or thinking problems.
- Find out how your family’s usual doctors and health providers will be most comfortable disclosing health information. Complete release of information forms ahead of time if possible.
- Every older person should complete a durable power of attorney form for healthcare. Consider giving the agent authority to act immediately; this will enable the agent to request medical records even if the older person has not been proven to be incapacitated.
- Consider researching your state’s laws governing disclosure of health information to family and friends.
- Many states have laws similar to HIPAA, but some may impose additional restrictions.
- Be prepared to politely help inform clinicians of what HIPAA permits. Some clinicians may not realize that HIPAA does allow them to talk to you about your relative’s health, depending on the circumstances.
- Consider printing out a copy of the relevant HHS HIPAA FAQs for Professionals: Disclosures to Family and Friends.
- For a good NPR story confirming that hospital employees and health providers often do NOT understand your access rights: It’s Your Right To See Your Medical Records. It Shouldn’t Be This Hard To Do.
- Remember that although HIPAA permits clinicians to disclose information under many circumstances, such disclosures are not required. Clinicians are only required to disclose health information when a patient — or authorized representative — requests this, based on the patient’s right of access.
[Update May 2020: The federal Office of Civil Rights has issued recent guidance related to HIPAA during the COVID-19 pandemic. You can see the latest guidance here: HIPAA and COVID-19.]
This is really helpful information!!! So many times personnel hide behind the HIPAA rules without knowing what is permitted and what is required. I live in a CCRC and am going to bring this into a program for our seniors here. We might even do a TV program on our closed network and make it available on our streaming service.
Thank you.
Glad you found this useful. If you live in a CCRC, it might be a helpful to approach the management and ask them to clarify what their CCRC policy is, regarding allowable disclosures of information. This way you’ll be able to start finding out if the personnel are “hiding” behind HIPAA rules based on their individual preferences and understandings of the rule, versus based on their employer’s policies and directives. Good luck!
My son Doctor office will not give me his medical records can I take legal action?
This sounds like a stressful situation. I think the success of any legal action would depend on a lot of things like the age and health conditions of your son, and whether or not he is capable of consenting for you to see the records. I hope you can find a way to help your son with access to his records or not.
Is there a HIPAA rule where it states that a Verbal authorization (only to be able to speak about treatment) should be signed separate from a Disclosure Authorization?
Thank you.
Hm…I’m not sure what you mean by a “verbal authorization.” Technically HIPAA distinguishes between getting a patient’s consent for disclosure, versus getting an authorization for disclosure. You can learn more through this HHS.gov FAQ: What is the difference between “consent” and “authorization” under the HIPAA Privacy Rule?
Providers do have a lot of leeway in how they can obtain and document a patient’s consent to the provider talking with family or others.
I didn’t know very much about HIPAA before finding this article. It’s good to know that the American Bar Association mentioned you should know your rights of access to health information. I think this is true. You should always understand what HIPAA includes beforehand. You want to make sure you know how to access a family member’s information when you need to.
quite so, thank you.
We have a family member that is severely mentally ill and paranoid. We want to send a detailed letter to his physician to explain his condition but do not want him to know that we have done so. He is manipulative and can alter his behavior long enough to get his meds filled but then quickly lapses back into his violent and disfunctional behavior. Is the physician obligated to tell the patient that family members have submitted a letter describing the disturbing behavior? Our only motivation is to help this family member get treatment but we are afraid if the physician discloses that we have done this, family members will be in danger due to the patients serious paranoia and anger issues. Thank you!
I’m not an attorney or expert on the law. My understanding is that clinicians have no obligation to tell patients that family members have provided a letter or other information. If you are very clear in stating your request that the clinician not disclose your letter and you add that this is due to a safety concern, then I think most clinicians will not mention the letter to the patient.
Now, patients do have the right to request their medical record. In many cases, letters or other information from family members gets scanned and is added to the patient’s medical record. So if the patient subsequently requests to view or get a copy of their medical record (which they have a right to do), a family member’s correspondence to the clinician could be found at that point.
There is one exception to patient’s right to their health record, and that is that they don’t have the right to “psychotherapy” notes, which are special notes kept by mental health professionals, which complement the record. (More on those here.)
In my experience, patients rarely ask to view or get copies of their medical records, but some do. If you think this is a possibility, I suppose you could send a letter to the health provider and ask that it not be added to your relative’s medical record. The clinician presumably doesn’t have to honor your request but perhaps would…they would have to decide what they felt made sense given the circumstances.
I do think you are right to try to notify your relative’s health provider, and hope you find a way to do so. Good luck!
What amount or kind of information can I give to my son’s mental health practitioner that the practitioner does not have to disclose to the patient or client that this information has been transmitted? My son has mental health issues and I know things that could help the therapist to understand his illness. Part of the illness is son’s denial of this health condition. I want to send the therapist written information (articles). Does the therapist have to tell my son that I sent them this information? It’s pretty benign – is this entirely up to the therapist or is therapist legally bound to disclose to patient that I sent this?
I just addressed similar issues in a recent comment. My understanding is that the therapist does not have to disclose this type of information to a patient. Whether this information could be found if your son requests his medical record, that would depend on whether it fell into the medical record versus the provider’s psychotherapy notes.
You could try contacting the therapist just to ask this question. I would think that this comes up often in mental health treatment. It might also help to let the therapist know about your preference that your son not know you’ve contacted his therapist. Good luck!
Hello,
My sister in law works at a va medical center as a RN. She has provided on several occasions information on my treatmens, labs and diagnosed health issues ive have had over the past year. To my spouse. Has she violated my privacy? Has she violated HIPPA. I have told my spouse that she has no right to do that.
Am I correct. How do I get her to stop.
Hm. It sounds like you are a patient at the VA where your sister-in-law is an RN.
I’m not an attorney and the following is not legal advice, it’s just my understanding of the principles related to your comment.
In general, healthcare professionals and employees of the medical center can access most patients’ individual medical records, but we are not supposed to do so unless we have a legitimate reason for viewing that information, e.g. the patient is under our care.
If we do have legitimate reasons for viewing and accessing a person’s protected health information (PHI), then we are not supposed to disclose it to family or friends or others unless the patient gives consent. (As I explain in the article, there are some exceptions and loopholes: clinicians can disclose PHI without consent if the patient is impaired and if they think it’s necessary and in the best interest of the patient.)
Per HIPAA a patient can give consent verbally, but some institutions have policies specifying how clinicians have to document consent. I’m not sure what the VA’s policy is regarding this.
In terms of the situation you describe, whether your sister-in-law committed privacy violations presumably depends on whether she initially had a legitimate reason to view or obtain your medical information. “I’m related to him and work here” probably isn’t legitimate, whereas “I’m the nurse assigned to work with his primary care doctor and have to regularly view his chart” might be. If she did have legitimate reasons to access your information, then the next question would be whether the VA had your consent to disclose information to your spouse, or whether there were other legitimate reasons to justify the disclosure.
You can view a VA patient privacy brochure here: Privacy and Records Management Respecting Veterans Privacy
I think if you are concerned or think she should stop, you should contact the VA Medical Center. They each have a Privacy Officer, that is probably the person to report the concern to.
My mother has been in the hospital for 3 weeks. For the most part she has been unresponsive. How can I collect her medical records if she is unable to give consent?
Sorry to hear about your mother’s hospitalization, it sounds serious. It also sounds like she did not complete a durable power of attorney for healthcare form. (Or if she did, she didn’t name you as the agent.)
If no person is the durable power of attorney for healthcare and a person is unable to make medical decisions, most states have some kind of process for allowing the next of kin to make necessary medical decisions. So healthcare providers would be able to disclose at least some medical information to family, especially that which is necessary to make the needed medical decisions. However, I don’t know how much access this gives family members to the medical records. It’s possible that to get the full record, you might need to petition the court for at least temporary guardianship. An elder law attorney should be able to advise you regarding your state’s laws and what your options are.
The hospital should also be able to advise you as to your options for overseeing your mother’s medical care in the short term. Of course, if there are several close family members involved or wanting to be involved, things can get complicated. Good luck!
Hi. I recently facilitated placing my 91 yr old uncle with NO previous hx of dementia or decline in health, in a rehab facility following an acute episode of delirium secondary to kidney nephrosis, uremic toxicity. Once there, because he had no advance directives, the facility excluded me from participating in his care. I am his only local relative, the only other relative being my mother (his sister and his durable POA,) she has also been excluded. His doctor there refuses to speak with us, even though my uncle couldnt give consent either way. His delium is starting to clear but he still thinks someone is trying to kill him, and that he is already dead, that all his friends have died, that someone has taken all his money, etc. He told me yesterday he is afraid of the place and the people there. The facility had him sign a DNR two days ago, informed me after the fact. I have challenged the DNR, because i do not believe he has capacity, and I fear he was coerced. The facility assured me he read and understood what he was signing, but he didnt even have his glasses, and doesnt read much anymore because a stroke 20 yrs ago made it difficult to always comprehend what he was reading. He has for 20 yrs had his sister/ POA take care of all his bills, legal, and financial affairs. Am I correct to be concerned about him initiating DNR at this time? He has significant financial resources.
Hm, this sounds like a sticky situation. If you think he’s been delirious, then it certainly sounds questionable for them to have him sign legally binding paperwork, as he may not currently have the decision-making capacity for this.
I have more on decision-making capacity here: Incompetence & Losing Capacity: Answers to 7 FAQs
Some possible ways to proceed:
– Put your concerns regarding his capacity to make these decisions in writing. Explain why you are concerned that he may not have capacity to oversee his health at this time or to engage in advance care planning. Spell out your reasoning and also spell out that his family has previously overseen his care. Ask for them to meet with your family to discuss a better way forward. You may or may not want to hint at the possibility your family might consider filing a complaint or legal action if your concerns aren’t addressed.
– Consider contacting the long-term care ombudsman for your location. There should be one in every state.
You basically need to be polite but persistent. Ask to talk to supervisors and management. Be clear about why you’re concerned about your uncle and why they should allow your family to be involved. Good luck!
This article is very interesting. I do have a question:
If a wife requests an eyeglass prescription for her husband, is this allowed to be given without his permission? I relate it to a relative picking up a medical Rx at the drug store, which is allowed???
I think this would be allowed under HIPAA, based on this FAQ:
HIPAA FAQ 535-Can a patient have family pick up a filled prescription?
However, just because HIPAA allows something doesn’t mean the provider has to do it, it just means the provider is allowed to decide. The provider is also usually expected to use good judgment and have reasons for believing that the disclosure (or allowing a family member to pick up meds) is not something the patient would object to and/or is in the best interest of the patient.
My father has passed away and my sister was the executor of the estate. i am in need of my fathers medical records as i have a claim to file with the division of Energy Employees Occupational Illness Compensation. is there any other way to obtain my fathers medical records other than through my sister?
I am not sure what your options are, I think it will depend on several things, including whether you were your father’s power of attorney, the laws of the state where you are, and more. These two resources can help you:
HIPAA FAQs: Decendents
Accessing Deceased Patient Records—FAQ
My brother was my mother’s medical POA. My mother ( although recently has passed away) was on a type of medication which I ( and many others) would consider dangerous for the elderly with dementia. I only found out about this medication by accident , because her medication dispenser was out on the counter top and the home health aide decided to be forthright with me. When I called the Pallitive Care Company to discuss the evaluations/exams/events that had led up to the prescribing of this medication, I was told I wasn’t on the HIPPA release so she could not give me any information. My brother had purposely excluded me and the rest of my siblings from the ” friends and family” listing. My question: Can my brother actually leave us off and is it legal? Can he actually withhold medical information regarding my mother’s behavior/health /medications from the rest of us siblings? Do I not have any rights to investigate why she was prescribed this dangerous medication?
Sorry to hear of your situation. I believe that while an older person is alive, the POA is not obligated to allow other family members to access health informtion (assuming the older person didn’t otherwise provide the other family members with a HIPAA release, which he or she could’ve opted to do).
I believe things may be slightly different once a person is deceased. I would recommend looking through the FAQs on accessing a deceased person’s information, which I have linked to in a comment posted earlier this month. You may also want to consult with an experienced attorney familiar with the relevant state laws. Good luck!
I work at a medical clinic and I have family members that are patients, all of them signed a release of information form stating that I could assist in their care and have access to their EMR. Two years ago I asked my manager at the time if an ROI is signed and on file, is it legal for me to room them, give vaccines to them, send messages to the provider for them etc. My manager contacted our compliance department and was told yes as long as the family member signed and wanted me involved then it was not a problem. Approximately 3 months ago I was given a promotion and am now the manager of one of our locations. My adult son called me and wanted to know if some recent lab results had come in since he hadn’t heard anything yet. I pulled up his chart and looked and informed him that yes the results were in, however, the provider had not reviewed them yet and I would send her a message stating that he was inquiring about the results and to please contact him with those results.
A week later, I get called into my manager’s office along with the head of our HR department and questioned about it, apparently, the provider thought it was a HIPAA violation and reported to them. I told them yes that I had accessed it and what I had told my son, they then told me it was a HIPAA violation and I could be terminated for it. I explained to them that 2 years ago I was told I could do this as long as I had permission and written consent from the family member to do so. They then told me that my “scope of practice” changed when I was promoted and my new role is different and does not require direct patient care any longer and so I should not have accessed his chart. I then told them that if this was the case then they should have told me that at the time of the promotion and I would not have done so. In the end they did not fire me, however, they did give me a “documented verbal” warning that now stays in my personal file forever. I have never been in any trouble and I strive to be an exemplary employee, my family is upset and now wants to transfer care due to this.
My question is; Do I have a right to access their chart and send messages to providers with written consent from the patient?
Sorry to hear you got called into the manager’s office, especially since it sounds like you were quite conscientious about checking with your manager and the compliance department prior to your promotion.
Honestly, I have not researched HIPAA as it pertains to workers accessing the medical records of clinic patients. Many organizations do have policies in place that forbid workers from accessing patient information unless the worker is involved — in a work capacity — with the patient’s care. I am not sure how most organizations would handle someone in your position, who has family that has signed releases and wants your involvement with their medical information. I agree that the organization should’ve done a better job clarifying their position to you.
It’s also possible that the provider, separate from suspecting a HIPAA violation (which it would be, if your son didn’t want you involved in his results) may have been unhappy about your ability to convey results before the provider deemed them ok to release to the patient. For some abnormal results, providers want to bring the patient into the office to disclose them and discuss them.
In terms of your specific question, I think whether you have a right to use your position as an employee to access your son’s medical chart is going to be up to your organization to decide. Even if it’s not a HIPAA violation, they do get to set their own rules for how employees access the system.
Here is a related article:
https://www.foxgrp.com/hipaa-compliance/employee-medical-records-in-the-ehr-environment/
Good luck!
Hello, my question: Does my sister who is my mother’s power of attorney have the right to tell me a family member/ supportive member that I can’t let other family members and friends know my mother’s diagnosis once she tells me. My sister is upset that I informed my mother’s sisters to let them know she has stage 1 leukaemia. My mom has Alzheimer & dementia she would if she remember to let them know. My sister now is using her power of attorney privileges to control what I’m can /can’t disclose saying I have no right to let family and friends know. My sister is very upset as she has become a private person. I feel she is using her own personal feelings than acting to what my mother would want to share to her sisters their children and friends. There was no verbal confidential told to me that I couldn’t share our mother’s new diagnosis. Now she is informing me that I have no right to do this. She says she’s my mother’s power of attorney & is now restricting me with privacy law that she can invoke towards me that I’m not allowed to share our mother’s diagnosis. She says I can only talk generalities. Can she do this?
As far as I know, just being power of attorney doesn’t give the POA the right to forbid other family members from disclosing medical information.
Family members are not “covered entities” the way that health providers are, and so a patient or POA cannot invoke HIPAA in these cases.
Now, if she didn’t want you to share the medical information, she should’ve made that clear to you. You may want to discuss this with her, so that expectations can be more clear next time around. You still don’t have to legally follow her directive, and she probably should know that, but of course, it’s good for the relationship and family dynamics to be respectful of these types of requests, and only disregard them if you have a compelling reason to do so. Good luck!
could I ask you,
in Maryland am I allowed to call a doctors office for my brother-in-law and make an appointment for him without discussing any personal information just getting a date and time for a doctor visit with out being listed on his HIPAA form as being authorized
I would recommend addressing this question to the doctor’s office in question. They would be more familiar with the laws and conventions in your area, and may also have office policies related to this.
Eg only (none of this may be true): a physician uses the same emr system that their pediatrician for their daughter (10 yo) uses. The parent physician occassionally prescribes minimal doctoral care to their child when they can’t get into to see the pediatrician right away but do not document in the record. However, the parent physician accessed the EMR record of the daughter to obtain information to submit to a school for registration and the due date was the next morning. The physician parent obtained consent from the other parent (married to the physician parent) and the child prior to access and then obtained their immunization and last physical. The compliance officer for the EMR has called the physician parent for possible violation of HIPAA violation. Was this a HIPAA violation? If so what sort of violations/penalties could the parent physician be responsible for?
Hm, honestly I am not sure if this would be a HIPAA violation, as I did not research this type of situation.
I don’t really see why it would be a HIPAA violation, because a parent is generally an authorized representative of the minor child and I don’t think it would be a HIPAA violation for a physician to use the workplace EMR to view his or her own patient data. But you could check the HHS.gov HIPAA FAQs, to see if this scenario is addressed.
Now, what may have been violated would be the organization’s policies on how employees use their EMR access. Many larger organizations DO have policies related to how employees are allowed to use their EMR access to view their own health records or those of family.
One thing that could be tried would be to ask the compliance officer to point to the section of the HIPAA code relevant to this alleged violation.
I don’t research or comment on penalties, I am not an attorney or HIPAA compliance officer.
If a family member signed a Hippa release for me to receive her medical information from a provider, am I allowed to give that information to a subsequent healthcare provider without additional consent by the family member?
Note that I am not an attorney. My understanding is that HIPAA does not prevent you from providing medical information or other information to a provider, because you are not a covered entity. (Of course, there may be state laws that are applicable, regarding what you can disclose, and you might certainly upset a family member by disclosing information without their permission.)
Also, if your family member made you durable power of attorney for healthcare and your authority is effective, you have the standing to request that a health provider send medical information to another provider. But if you only have a HIPAA release, you may not be able to request that one medical provider release information to another provider.
My daughter was 5150 in California I brought her back to NJ. Is there any way I can find out what what medications she is being prescribed? She is psychotic
Sorry to hear of your situation, it must be very hard to have a family member get 5150ed and held involuntarily for psychiatric reasons. Unfortunately, I don’t know the answer to your question; I am not sure under what circumstances California families can obtain information about a close relative, and also am not sure how things might change if now your daughter is no longer in California. I would recommend looking for an online support group for families dealing with mental illness. This is probably a common issue that comes up and there must be many other parents who have already looked into this. Good luck!
A nurse and catching up on progress notes with my colleagues in the same room. She then laughingly said to them Mr so and so dementia is getting the best of him .because he went to the dining room with his pants down. Is she in violation of HIPPA ? Please, thanks .
I haven’t researched HIPAA as it pertains to workplace issues such as this. In most healthcare work environments, employees are subject not only to HIPAA regulations but also to the organization’s policies regarding disclosure of sensitive health information and behavioral expectations. If you were concerned by what the nurse said, I would recommend bringing it up with a supervisor or possibly contacting the organization’s compliance officer to find out more.
My brother has a court appointed medical guardian who will not keep me updated on his condition per a court order, other to say he is doing ok. He has progressive frontal lobe dimentica which is fatal. Along with a stroke he had, causing dimentia, he can’t be doing the same after a year. Can the memory care facility provide me with any general information to his well being without violating HIPA laws?
Hm, I actually don’t know whether a memory care facility would be considered a “covered entity” under HIPAA or not. If you allowed or able to visit your brother, I imagine that the staff working there would be able to tell you how he’s doing in general, although they may not be able to disclose medical specifics. Good luck!
If I have my son under my Heath insurance (25) and I have outstanding balance can the healthcare tell him my balance n refused service on him
I’m afraid I can’t answer your question, I have only researched the options that families have for obtaining information from health providers. Privacy and disclosures as relates to health insurance is beyond my knowledge. Health insurers ARE covered entities; whether they are allowed to disclose your balance to a dependent on your plan, that I don’t know. good luck!
I was hospitalized for depression and was seeking help for suicidal thoughts and my spouse and I got into a argument at the hospital about what we thought was the correct care I needed. She was asked to leave and she left but was verbally loud as she was leaving. The hospital reported that my daughter was being dragged out of the hospital and a abuse claim was reported. Upon my discharge CPS came to my home and had full knowledge of all my medical information and everything I spoke to my doctors about. My question is was my rights violated under hippa laws since the claim to CPS was my spouse was being rough with my daughter as they were exiting the hospital and not my mental health in question or my parenting ability? I don’t understand why my medical information was given while I was in a hospital bed seeking help for my depression.
Sorry that this has happened to you, it does sound upsetting. I am not an attorney or a HIPAA compliance expert, so I’m afraid I can’t answer your question. I have not researched the circumstances under which a hospital might disclose (or be required to disclose) information to a social services agency such as CPS.
My sister has cancer but won’t disclose what kind. My biggest concern is that our mother died from cancer in her 70s; my sister is in her 70s; I will be in my 70s in a few short years. It seems I have a right to know for my own health what type of cancer she has, but I don’t know what steps to take to get that information.
I’m sorry to hear of this cancer history in your family, I can see why you’d be worried.
Unfortunately, although I understand your desire to know about your sister’s cancer, my understanding is that you don’t have any legal right to obtain that information. So to find out, your sister would need to agree to tell you.
I imagine you’ve already asked your sister and she’s refused to answer. In that case, you may need to reconsider your approach to discussing this with her. Many books on communication offer helpful suggestions; I like Difficult Conversations in particular. Otherwise, you could see if she’d agree to a conversation facilitated by a therapist or mediator. Good luck!
My brother has placed our mother in a Memory Care facility but will not disclose the name or location. Another family member has given me that information but when I called the facility to confirm my mother’s location, I was told that they could not confirm or deny her as a resident due to Hipaa Laws. I just want to know if she is a resident or not. As her daughter am I entitled to that information?
Sorry to hear of your situation. I’m not sure you are entitled to that information, unless you are her power of attorney. You could try contacting your local Area Agency on Aging to see if they know more about this type of situation. Of course, the best would be to improve communication with your brother, but if already he’s refusing to disclose information, that’s presumably easier said than done.
For help resolving sibling issues related to aging parents, you could try consulting with a geriatric care manager or elder mediator. good luck!
This would be another good issue to raise with the Long Term Care Ombudsman in your area, because – at least in California – isolating an older adult may be considered a form of elder abuse. Anyone can find the Long Term Care Ombudsman in their area by going to https://theconsumervoice.org/get_help
Linda Beck
I was an in-home caregiver for a local company. I had various clients, a few of them are spouses of well known business people in my area. I no longer work for the company, but sometimes will see my former clients in town. One came up to hug me and say hello, but a friend from church saw this and spread around church that must of been one of my former clients. Then they started to say things about what the client looked like, so they thought they knew what her issues were, so they come to me looking for answers and verification of their thoughts. I keep telling them it is a breach of privacy (Hipaa and just general manners regarding privacy) for me to be discussing this so I refuse to answer anything. They say I am just hiding behind Hipaa. Does their knowledge of them seeing me with her put me in any breech? I have always been protective of them when I worked for the agency, and still am, it isn’t anyone else’s business. The same client is a personal friend of my dentist. He too might ask if I was her caregiver, in general talk as I have been seen in the waiting room with her just last month. Now I have to go see him, and hope no one asks, oh, weren’t you her caregiver? Since they too have to comply under Hipaa, I am guessing they know better to ask, but this is a small town, and sometimes this sort of thing comes up in innocent conversations. Thanks for any suggestions, I know you can not give legal advice.
Kudos to you for being so professional and protective of your clients’ privacy. Honestly I’m not sure exactly how HIPAA would apply here. You certainly aren’t the one revealing anything if a former client’s family comes to hug you and others draw conclusions, so I wouldn’t worry about that.
In regards to people wanting more information from you, you could politely tell them that as a matter of principle, you don’t answer questions about former clients and you don’t feel comfortable even discussing whether or not someone was a former client, because you feel it’s important to maintain people’s privacy regarding these issues.
I am not sure you even need to bring up HIPAA…people might understand more if you just state it as part of your personal and professional code of conduct.
Hope this helps, good luck!
I have an employment Mediation and I was a nursing Supervisor. I completed nursing supervisor visits and nursing assessment. We have 70 client 36 HHA and 12 nurses that I supervised. I worked from monthly list and we knew who needed a timely 62 day visit.
MY question is that this mediation is done with lawyers for both side and the mediator. I need to use those list that have the clients,staff and nursing employees.
Can I use the client list if I no longer work there and is it allowed to give this information. When the cases
were open the client signed a release for the agency to receive all medical,billing and other information.
I’m not an attorney or compliance expert, and so I don’t know the answer to your question. I would recommend consulting with someone whose primary line of work is HIPAA compliance.
My understanding is that as employees of covered entity, we are only supposed to access that protected information held by the entity while doing our work. So if you are no longer employed as a nursing supervisor with the agency, I would think you are not allowed to keep the list, much less use it for other purposes. But that is just my guess. Be sure to look into this further. Good luck!
I live in MN. Are adult parents (age 75) permitted to request medical record information (medical diagnosis, treatment and prescriptions, etc) for their deceased adult children (age 55) if there is no surviving spouse?
There is a HIPAA FAQ covering access to health information of decedents here: HIPAA FAQ – Decedents
Also see this comment above.
My niece went into the ER for attempted suicide on Saturday. I tried seeing her multiple times in the night with a different excuse from nurses each time. I basically went home with nothing and left a note that they got to her. She called me and I got to talk to her briefly. She had no idea what was going on and basically had been left to sit in an ER room for 7 hours. The next day she got transferred to another hospital. I have been calling them constantly to at least find out where and maybe what is going on with her and they are refusing any information. There is a good chance I am probably on her HIPAA form. But if I am not, are they required to keep that information? Another thing is, is that I don’t know what kind of shape she was in mentally and if she was even able to understand what she was signing if she did or if they even made her sign anything. Is this different when you get taken in VIA ambulance? Do you still sign papers?
I’m so sorry to hear of your niece’s suicide attempt. Honestly, I don’t know the answers to your questions. My personal experience almost entirely related to older adults who may have lost capacity due to dementia or serious illness. There are probably different conventions in how HIPAA is interpreted and applied, when it comes to suicide attempts in younger adults. Also, the laws related to involuntary hospitalizations are state-specific, and may be playing a role in this.
I would recommend looking for a support group or non-profit supporting family members of people who have attempted suicide. A group based in your state will be familiar with your state’s laws, which should be helpful. good luck!
My ex-wife is always talking about clients personal information from where they live to who they are, to what they got. Who do I need to talk to, to put a stop to her working in the medical field period?
Probably the best thing to do would be to talk to her employer, as they would be able to determine if her activities are in breach of their office policies or regulations, or of HIPAA. Here’s an answer from Dr. Kernisan to a similar question. If the employer doesn’t take any action, there is probably nothing more that you can do.
So my question is can a child cancel a parent’s appointment if he or she is not on the privacy practices form?
I would guess that it would not be possible to cancel an appointment on an elder’s behalf without express authorization from the elder.
I work at a hospital and went into my sons records to get a percentage of a eczema cream that we use because the Dr. Couldnt find it in my records. Now my job may want to fire me be a cause of this. The Dr. Is standing with me but do I have a chance
Hi Katherine. I understand your concern in this current climate of privacy awareness. In my experience, privacy breaches are taken seriously by hospitals, and the best course of action is often to be honest about your intentions and demonstrate a commitment to avoid breaches in the future. We did have an employee in our office who was repeatedly looking at medical records of family members and she was reprimanded and moved to another position, but she remained employed (I wasn’t involved in managing her role and I wasn’t aware of these breaches, they were found by the information technology department). I would hope that your employer would take an educational rather than punitive stance, especially if you have a good job performance record.
Hello,
My older sister has POA of our Father, who has Alzheimer’s disease. He is in a memory care facility in Maryland. She is currently working out of the country for an unspecified period of time. In the event she were unavailable, I am authorized to act and step in her place. However, should I have certified copies of this documentation, such as his financial POA, health proxy/ hippa release form in my possession? Additionally, my sister and I have a strained relationship, and only communicate when needed.
Thank you for your help.
Hi Dal. I think it is a good idea to have copies of these documents, but I don’t know that they need to be certified. It can save time in an emergency to be able to produce such important paperwork. I hope you never need to use it.
Can an Administrator from a personal care home suddenly tell my mentally ill son’s doctors not to give out any info. to his mother? I had a discussion with her the day before about putting him in a home closer to me so I can assist in his care. It appeared that she did not like the idea and wants to hang on to that money from the government she would be losing. The M.D.office said that the home called and said it has to do with the Hipaa law. This issue never came up in all the 30 years he has been sick. In fact I still was able to talk to his M.D a couple of weeks ago. They always would inform my ex and me when he was sick in the hospita.l I was able to freely speak with his M.D. there. I’m on a fixed income and can’t afford lawyer fees to get my rights back. No one has legal guardian ship or power of attorney. We just never a problem before.
Hi Suong and sorry to hear about the difficulties you are having. It sounds like a complicated situation and I don’t think I have enough information, or expertise to give you any education. Most of the issues with consent and capacity that I work with are in older adults who have had changes in cognition due to dementia. I hope you can find some guidance and be able to participate in your son’s care.
Can a covered entity sign my name on a records release in order to get outside medical records on me and be held accountable for this? The information they requested when signing my name to get it was probably information they could have legally received with out my consent, but I was told that I signed the consent forms in person in the release of information office, when I did not sign any of them.
If I am understanding you correctly, a healthcare provider signed your name on a release form to get some health information? And claimed that you actually signed the forms? That does not sound right, and I wonder if there is a misunderstanding. Sometimes an entity can sign a form that indicates that verbal consent has been received from an individual, but they should not be signing the individual’s name, they should be signing their own name and indicating that consent was obtained verbally. Sounds dubious to me, from the way you describe it, although I am not an expert in HIPAA.
Thank you for this informative website.
I am in a crisis situation with my mother who is 86 and most recently developed a kidney infection complicated by sepsis. She was in hospital 4 days after which my daughter discharged her and took her to a rehab facility and refused to tell me where she was. At this moment I don’t know if my mother is still at the facility because I’m not on the emergency list.
I am next of kin to my mother, her eldest child and for the past 16 years her primary caregiver. I live with her in order to take care of her.
How does my daughter have the ability to keep me non-informed along with healthcare providers who refuse to disclose my mom’s location after she left the hospital?
Unfortunately, I could never convince my mom to file a Medical Power of Attorney years ago and due to her diminished state she cannot make her own decisions and is now being influenced by what someone else is relaying to her.
Now I fear my daughter has relocated her again.
If you have any advice to offer I would greatly appreciate it.
Thank you for your time.
Hi Debra. That must be a very distressing situation for you. I’m not a lawyer and my practice is in Canada, but here in Canada, if a person is capable, they can decide whether to leave hospital or not. If not capable, then an attorney named in a legal power of attorney would make decisions on the person’s behalf, superseding any other potential substitute decision maker. If there is no power of attorney established, then there is a decision maker hierarchy which places a spouse first, then a parent or child.
Is it possible your mother is capable? Or that she has given POA to your daughter? Sorry I can’t be more helpful, but it sounds like you may need to contact a lawyer to get the answers you need.
I am not incapacitated at all (not that old and in great health) and my oldest son wants to know when my appointments are. If he calls the clinic, and asks if I am a patient at that clinic and wants a record of my appointments, will the clinic give this information to him?
Well, information about your medical appointments is considered personal health information, so they can’t disclose that, even to your son, without your consent.
Riddle me this. A frustrated patient/Wife asks employee of a “covered entity” who is also her Husband to find out why she NEEDED to have a follow up appointment with the Dr at the Husbands place of employment ie. “covered entity”. Husband (who frequently handles questions of this type from patients) consults the patient/Wife’s chart, but is unable to discover the reason why from a quick review. The Husband then consults another employee at the “covered entity” who works with the Dr regarding the patient’s care, but is still unable to determine why. The Husband then consults the Dr and relays the relative information on to the patient/Wife. A week later the Husband, in lieu of the fact that the patient/Wife was frustrated, follows up with the employee that he spoke with previously to be sure the patient/wife had had a positive outcome at her follow up appointment. Is there any violation of HIPAA privacy laws here. If there is one, would any offense here be deemed a firable offense. Please Help with your advise.
That’s quite a riddle and I’m not sure I follow you…
It sounds like A is the wife of Dr B, who works at Clinic C with Dr D.
A is a patient of Dr D.
Dr B looks at his wife’s chart, talks to employee E (another health professional?) and finally talks to Dr D, about Dr. B’s wife A.
A has her appointment with Dr. D, and then Dr B asks employee E how it went.
If I have that all correct, then according to HIPAA, Dr. B can’t look at A’s chart (or his own chart, even at Clinic C where Dr B works), and Dr.D and employee E can’t disclose health information about A, even to her husband, without A’s consent.
This type of thing happens very frequently and whether or not it is an offence that would lead to someone being fired depends on the policy of the clinic, as well as the regulations of Dr. B’s professional governing body. In my experience, Dr. B, and anyone who disclosed health information about A would probably get a censure from their administrator and have to review the privacy regulations at their workplace.
You have it all correct except Dr B isn’t a Dr and instead simply works in patient services. I don’t think this changes your reply though. From what I can gather, you are saying simply because its Dr B’s wife he cannot view the chart, but if it were any other patient he could?
Let me recap just to be sure because this seems like a real gray area to me, “Dr B” (not a doctor, just patient serviceman) in this case receives a request from the patient/his wife (she calls the clinic and he answers) to view the patient/his wife’s chart to determine why she needed a follow up. Now you are saying because it is his wife, he cannot look at the chart to determine why, but if it were not his wife he could. Is this correct? If so could you please reference the law that states that if a patient is immediate family to an employee their chart cannot be viewed by said employee even though the employee is acting in within their capacity as an employee in the care of the patient (who just happens to be immediate family). Thanks for helping me to clarify this question.
Hi John. You can review the regulations here, and they do contain a lot of legal terms, but there isn’t a specific section about looking at a family member’s records if you work in the clinic.
However, the HIPAA Privacy Rule indicates that personal health information should only be accessed on a “need to know” basis, that is if the information is needed to provide care, payment, for research, or other functions. So, if B was just doing his job, answering the phone and looking at the chart as he would for any other patient, then it may be that he did “need to know” about the health information in question. It probably depends on the clinic’s privacy policy as to whether the situation you describe is an infraction.
The wife could also provide a written statement to the clinic indicating that she is OK with having her PHI shared with B, or give permission orally, preferably with a witness to keep it all above board.
My husband’s dad recently had a massive stroke, which has left him incapacitated. In a nutshell his girlfriend, which we didn’t know existed, has not listed him as being a family member that can get updates on his condition. Does he not have the right to be able to get updates on his status being his only son? We do not know if a power of attorney exists.
That sounds like a difficult situation and I’m sorry to hear about your father in law’s stroke. If your father in law’s girlfriend has a power of attorney, she may be able to decide on his behalf who can access his health information.
In most hospitals, health information isn’t shared unless the hospitalized person gives the family member a “privacy code” or at least a verbal consent. I would call the hospital’s privacy office to find out what their policy is and how to try to obtain information.
I received word from several confirmed sources that my sister, who was an addict, living in the streets and estranged from the family for years, has passed away. I have been advised that there are several sources who have attested to this. I was also told that her body was in the morgue waiting to be identified. I called the city medical examiner and they told me that they have no one fitting her description there and advised me to check with local hospitals and suggested filing a missing person report. I checked with the hospital in the area she was known to frequent and they tell me they can’t give me any information due to HIPPA. How can I go about locating my sister’s body in an effort to claim it and give her a proper burial?
I’m sorry to hear about your sister’s passing. I am not a lawyer but my understanding is that when a person has died, it is usually up to the spouse (if there is one) and then the parents or children (if there are any) to claim the person’s body. If there are no such relatives then you may be entitled to claim her remains. Filing a missing persons report might be helpful if that is what the medical examiner recommended. Hope it works out.
Hello! I have a father who we believe has some form of dementia. He has previously signed a form at his primary care physicians office granting me access to all his medical information. Recently there was an accident and he was taken to the hospital and his mental health has taken an enormous decline and he is not able to communicate his consent to release information to me. Will the form that he signed at his primary care physicians office cover me for anywhere or just cover me for information through the primary care physician?
It’s not unusual for someone living with dementia to have a decline when they are admitted to hospital, and I can understand how difficult that must be for you.
The form in the doctor’s office will probably not apply to another setting, but it would certainly be helpful to demonstrate your dad’s wishes when he was capable of assigning that trust to you. I would ask the hospital if getting a copy of that form would help.
My father was diagnosed with dementia in November 2019. Suspicious activity has occurred since then. His house was sold and a new house bought in his wife’s name only. Not one month after he ends up in the hospital with broken bones in his face and a hematoma at the front of his brain. I spoke to two nurses by phone. They gave me 2 different stories of how he got hurt. One was told he bent down to pick up ball and fell and another was he was walking the dog and fell. So at this point I’m thinking someone is lying and those are major injuries for just picking up a bat. Keep in mind he’s always been physically strong and healthy and was bowling weekly with his 58 year old son. His wife, power of attorney forbids the hospital to give information to anyone but her and her daughter. He’s moved to nursing home during pandemic. I’m eldest living child. I called and talked to him. He can say yes but attempts to speak sentences. I dropped off candy to be delivered to him. Next I hear the wife changed the will and forbids the nursing home from letting us talk to him. Their excuse hippa act based on power of attorney. I told them that doesn’t apply to calls and visits only medical information. They’re using the hippa act to deny his eldest living children visits and calls. Is that legal?
It sounds like a very difficult situation. It seems like a bit of a stretch to say that due to HIPPA a hospital could not accept gifts or visits, although accepting the gift would imply divulging that he is in the hospital…which is a piece of health information. In my experience, it’s usually better for families to try to find a compromise amongst themselves rather than involving lawyers and mediators but sometimes that can’t be helped. If there is a way to request a meeting with his doctor, or with staff at his home, that may be a way to begin.
I have shared with my friend who is my doctors wife about a chronic condition in the past but then she started working in his office and now has been too much in my buisness and twisting things I say and questions I ask him related to that condition. He was always very conscious of not saying information in front of her without my permission but now I suspect they are talking about me behind my back. Is he allowed to talk to her about my case because she works there now? Do I have the right to inform him that I want info to her kept at a minimum?
I think it depends on the wife’s role in the office. If she is part of your health care team (like a nurse or pharmacist) then she may have a need to know your medical information. Otherwise, health information should not be shared. It’s a little tricky if the information is something that you have shared with her in the past. If you are uncomfortable, you may be able to put additional privacy safeguards on your clinic chart, and the office manager may be able to help you with that.
My husband and I go to the same chiropractor, who is also a friend of my husbands. Recently the office manager called my husband regarding my bill, instead of contacting me. I’m upset by this and did not give consent. Is this a HIPPA violation ?
Billing information from a health encounter can be considered health information so yes, this sounds like a breach to me. Many office managers would probably assume that it’s OK to discuss such information with your husband but they really shouldn’t do so without at least your verbal consent.
Hi I just signed a health care power of attorney over to my husband so he can begin now making my health care choices does he need to be with me for every visit
Good for you for getting your Power of Attorney organized. As long as you’re still capable of making health care decisions for yourself, you can attend medical appointments on your own, and your husband can step in if that changes. Again, if you’re capable you can decide who can attend your medical appointments and know your personal health details.
My husband has been a paranoid schizophrenic for the last 18 years. He has been very good in signing the papers for me to speak with his caretakers in the psychiatric hospitals, but the last few times he has decided he will not allow me access to the doctors. My husband is a great actor and he will do whatever it takes to get out of the hospital- take his meds, go to groups, keep well and groomed. Once out of the hospital, he throws all his medications in the toilet and we have to start all over again. He is usually hospitalized 3 times a year. He is 70 now and is extremely paranoid and psychotic. I could write a book about what he has done and how reckless he is with money and his life. I would love to go on about his behavior, but it would take me 3 days to write. About 5 years ago, he had a patient advocate in a state hospital who told him to get my name off of the HIPPA release because all I want to do is keep him in the hospital. He removed my name, and I was unable to be a part of the team, go to court hearings and know when he was being released. I have been married to this man for over 40 years and to be treated like this is appalling, especially since I am the only one in his family that takes care of him. This year I filed for being his payee, which I received after much paperwork, but with plenty of documentation. Although I go to see him, the social worker will not call me back, tell me anything about his treatment or even who his doctor is. I have spoken to the social worker and told him about his history- but they are still giving him medication that does not work for him. He also no longer “acts” and he literally lives in another world in his head. I am a vision- not his wife when I go to visit, and he tells me he is married to Britney Spears (for many years). His brother has the ability to speak to the team- Michael authorized him to do that. I am trying to get guardianship for My husband, but I need 2 letters from 2 doctors- one being the attending doctor in the hospital (I already have another doctor from the PACT program he is involved with). The doctor refuses to sign an affidavit that my husband is incapable of taking care of himself and I am beyond words as to how to handle this. I have been trying to get guardianship for many years and have always gotten the run- around from the doctors. Since my brother-in-law is able to speak with the team, can’t he demand the doctor to provide him with his medical information for me to submit to a judge? All I want to do is give this man a quality of life for as long as I can, but the HIPPA, doctors and government agencies, along with the lawyers just turn their backs on me and treat my husband as if he is just another lunatic. My husband can’t even remember what he had for lunch, but has more rights than I do, except when it comes to having to pay the bills. Any advice would be greatly appreciated.
Karen, I can’t imagine the stress of caring for your husband, who sounds as though he has been very ill. You have probably learned a lot about the privacy rules and regulations when there are people who have severe mental health issues, and I daresay you know more about it than most physicians!
It’s encouraging that your brother-in-law has a connection to your husband’s care team and if I were counselling someone in your situation, I would say that you’re on the right track trying to leverage his contact with the professionals. The brother probably has to follow what he thinks would be your husband’s wishes, so if he has been adamant about keeping you out of the loop, he might not be comfortable sharing information with you. I don’t know if you can legally apply to get the records you need, but a lawyer might.
Your situation sounds heart-breaking and I would suggest getting legal advice about the best way forward.
Thank you so much for taking the time to reply to my comment. I have been on the phone literally all day long trying to find an attorney for my case situation, which is unique. My brother-in-law is more than happy to share all the information he gets because he really does not want to get too involved with Michael’s illness. But out of all his siblings, he is the only one who has been taken some interest in his brother. This is why Michael signed over on the HIPPA to him. My husband was told by a patient advocate in a state hospital to get me off the list because all I want to do is to keep him in the hospital. I actually wrote letters to the facility for this mans misconduct, and although nothing there was no discipline to the advocate, this statement has stuck in my husbands head and he treats me now as if I am his enemy.
I am the only one who visits him, calls him and tries to help by calling the social worker telling him things like he does not swallow his pills (they finally realized this today when they finally caught him “cheeking” the pills- I told the social worker about this problem many times over the months he has been in there and yet they just caught it. I’m sorry- but it is good sometimes for me to vent and I very much do appreciate your advice. I will not let up on him- everyone else has. But I feel I took a vow in church and although I was a school teacher for 40 years, was not able to have children. I also strongly feel that God gave me this mission to take care of Michael and although it is now becoming a real struggle, I will see it through. I just wish the doctors would work with me and the law would not be so difficult on the caretaker. I am also getting professional help due to the depression this has all taken on me. Again, thank you for taking time out to respond to me. Karen M.
I’m so glad you find this site helpful and that you’re being persistent. Make sure to look after yourself too, as you care for your husband.
I have the EXACT same problem as you.
First the doctor allowed me to tell him about the behaviors.
Now I am blocked from speaking at all and he is intercepting bills and hiding them.
The homeowners insurance was paid a month late with a ton of fees.
He still thinks he paid it on time, and actually wrote that on the CANCELLATiON NOTICE.
I took that to his doctor and they said to file a restaining order & nthen they will take him in and deal with it.
That sounds pretty extreme when a battery of memory tests would solve this without so much money or drama attached.
Mentally ill are allowed more rights than those whose lives are turned upside down, trying to deal with it.
My name is on the house, and my credit is going to go in the toilet over his DENIALS.
“He has to self report his illness”, is the dumbest thing any doctors office could say to me.
If they call saying something happened, I will now say, “I have no authority to deal with him, he removed my name, but feel free to “phone a friend,” since you enabled this.
BYE.
That sounds so frustrating and I’m sorry that you’re hitting all of those roadblocks.
In some regions, family members can ask for a capacity assessment from a private or government capacity assessor (at their expense). This assessor can hone in on whether there are decision-making problems, regardless of any medical issues. Adult Protective Services can be helpful in cases of self-neglect or abuse as well.
I hope you can find some help.
Can a power of attorney prevent someone (whose POA has been activated) prevent the patient from adding someone to his Hippa? There are many extenuating circumstances but i want to keep it brief.
Hi Robert and thanks for keeping it brief! I’m not a lawyer, but based on my understanding of HIPAA, it might depend on what the person’s POA document says, and how incapacitated the person is.
If a person isn’t capable of consenting to have a doctor disclose medical information, then their attorney can probably make that decision for them. But if they are capable, it’s up to them who they want to know their information. I always like to assume that a person is capable unless they are very incapacitated or at least assess if they are, before automatically deferring to the attorney.
The last hippa form I signed was when I was 16. Aren’t doctors legally required to have you update a hippa form once you turn 18? I’m a bit confused on this.
I’m afraid I don’t have much experience with HIPAA issues in younger adults. If someone was capable of signing a HIPAA form when they were 16, it may still be valid but I don’t know for sure.
Hello. I came across your article while trying to find an answer to my question. I briefly scanned the questions posted but didn’t see anything similar – if I missed one, I apologize. I have an adult son who is mentally disabled – schizoaffective/mixed bipolar. I am his advocate, Rep Payee, and General Durable POA. I am NOT his guardian. He receives multiple services including Mental Health Skill Building Services. My son has signed a release so that they can speak to me. I have struggled with many of the skill builders and found some to be dishonest – for example, reporting more hours than given, so I try to keep good tabs on hours, progress, etc. One problem that I often run into is they do not communicate issues that I’ve requested – such as when my son cancels his meeting times with them. When I question this, I am told ‘your son told me not to tell you/or, not to speak to you’. My son denies this but it is quite possible that he is being dishonest or, with his short-term memory issues, does not remember doing so. What I am wondering is, which trumps which – does his verbal direction override the signed release on file? This is very difficult because I don’t know who to trust at times. Thank you for any advice you can offer.
Hi Sandee and thanks for sharing your experience. It sounds like you’re a very diligent care partner to your son!
I’m not a lawyer, and the answer to your question may depend on the wording of the signed consent, but my understanding of health privacy rules is that a person can withdraw consent at any time. So his verbal instruction to the provider may be an example of withdrawing consent, if temporarily.
Thanks again for visiting the website!
Hi. My sister is in Delaware in a medically induced coma as she had to be intubated due to pneumonia complications. I live in Maine and have called the hospital to check on her progress. I was denied information on my 3rd call due to HIPPA. She had completed the standard form and elected her husband and daughter to receive information. Unfortunately neither party is of much common sense or educated in any way and do not understand half of what they are told. They do not have the ability to ask pertinent questions about my sister’s care or to convey information to others. Although my sister and I have a strong bond, her husband and I do not get along. He is using this ‘new found power’ to vex me instead of thinking of my sister’s care and what is best for her. How can I get basic information regarding her progress?
Of course, when/IF she survives this, her & I will have a conversation about adding me to her list of authorized persons. What can I do now?
Thank you
I’m so sorry to hear about your sister and I hope she recovers soon. That must be very frustrating to not be able to get information about her health right now.
I don’t know how you can circumvent the consent issues while your sister is unable to speak for herself, but you can certainly share your concerns with the hospital team. You could also share your list of questions with the husband and daughter, and it might help them to navigate the discussions that they have with the team. You could also ask them to write down the conversations they have with the health care team and share those with you.
I agree that it’s a good idea to talk to your sister about this when she’s well.
I had gone to a doctor and had a procedure completed; I had issues after the procedure and needed to go to another doctor. I was not happy with the first office I had gone to talked to doctor B about it. I found out, through reading my medical notes, that doctor A talked to doctor B and wrote letters to doctor B. Neither doctor ever told me they spoke; The medical records doesn’t note what was discussed, only that they had talked and I don’t have a copy of the letter. Is it standard practice for, let’s say, Doctor A to reach out and initiate conversations with Doctor B? I did let doctor A know I was going to Doctor B but it felt a little weird now knowing that their were conversations…perhaps innocent and well intentioned, but is that kind of thing permissible? I had signed an “Organized Health Care Arrangement” when I first started with Doctor A so may be he was allowed to do this? Is it standard practice? I just wasn’t aware that the conversations ever happened until I got my medical records months later.
Sorry to hear about your difficulties. I’m not an expert on HIPAA, but it sounds like an Organized Health Care Agreement would allow providers in your circle of care to talk to each other and share PHI (Personal Health Information).
It’s usually a good thing when health care providers share information with each other, and I know that the information I get from a referring physician is extremely helpful. Reading a copy of the Organized Health Care Agreement might be helpful in this case.
Thanks you!
Hello, my mother has given me full poa and recently her pain doctors office (office manager) has implemented a rule of only patients allowed back even though my mother wants me in the exam room because she knows she is forgetful. Can they ignore her request and poa?
I suppose a private office can have a policy like the one you describe, but in my practice, as long as it’s OK with the patient, they can have whomever they want in an appointment. It may be an infection control issue right now?
I would explore, in a cheerful and co-operative way, whether an exception could be made for your mom. It would probably help to have you there and would make the provider’s job easier.
I was told I needed someone there to drive me home and she volunteered. I expected her to wait in the waiting room not to come in the back where they discuss things I decided to do with my body.
I went to the doctors today we were brought in by the nurses and sat down and nurse comes up to us, never asked if I wanted any of my information shared or kept private and now my mom knows I’m on birth control. Due to religious belief were told not to have sex before marriage and my parents are really big on that. I had to excuse myself to the restroom and I cried. I don’t know how to handle this. I dont feel like I can face my family after that and I’m really angry about this. How do I handle this.
Hi Aurora and I need to tell you that I usually work with older adults where the issue of birth control rarely comes up.
In the region where my practice is located, minors can consent to treatment, including birth control, without the parent’s consent. Minors may also be protected under HIPAA, but some clinics have a process to allow parents to have access to the minor’s file (usually with a written consent). or they may treat the parent as the minor’s representative and automatically share.
If you’re not a minor, then your parent can’t have access to your personal health information without your consent. It may be that if your mom came into the room with you, the nurse assumed you had given consent for her to be there and share in the information.
In terms of facing your family, it’s not my area of expertise, but people can be on birth control for reasons other than contraception, which your mom might not be aware of. If your school or work has counselling, they may be able to offer you some advice about how to talk to your family about issues that are awkward or painful.
my daughter’s partner of 26 years walked into hospital and left for long-term care because he is now incapacitated. Since they were not married she can’t get medical records in the state of Oklahoma. he just turned 46 this July. Everything is so overwhelming for her. She can’t get medical power of attorney since they were never married. Her son is 22 so we are hoping we can do is, as soon as we figure out what hoops we have to jump through. Do we get an attorney do we just go to the court house and get a judge to rule, but we need medical records to show proof. All this trouble because when he was in ICU no one checked his Oxygen levels, no oxygen to the brain caused major damage to this poor man
I’m so sorry to hear about your daughter’s partner’s brain injury. That’s so unexpected in a person his age, and it’s not uncommon that someone his age would not have arranged a POA.
In older adults, if there’s no legal POA, it would most likely go to the children. If this man has living parents, they may be the first ones that the “system” would recognize though. I’m not sure if you need a lawyer, or could go to court yourself.
The social worker at the hospital should be able to help navigate the steps needed to get POA organized, and I would talk to them as soon as possible. Following that, it should be easier to get medical records.
Sorry I can’t give more specific advice, and best of luck.
Hi, over the course of 3 months, my mom has been going to this clinic that her job is making her go to. Typically, my older sister and I usually go with my mom and enter the exam room with her. Previous clinics or offices allow one of us to enter the exam room with no problem. This is due to my mom not really understanding the medical situation cause of the language barrier hence why my sister and I will go with her. However this clinic is refusing to allow either of us to come with my mom. She expressed how the translator and doctor make it hard for her to understand and really would like one us to be there in the exam office and explain/translate. I feel like this something not right because they use HIPPA as in excuse but I never heard of it being used like this
That doesn’t sound right to me – I almost always allow patients to bring someone in with them if they choose (as long as I have the space for them).
I would ask the manager of the clinic about their policy on allowing clients to have an accompanying family member which can be important for cultural and language reasons. As long as your mom provides express consent, there should be no barrier!
My father told me this week he is dying. That nothing can be done, and he’s living on borrowed time. He told us last year that his neck arteries were clogged and he needed a operation. He refused and never had one. We do not know if that is his medical problem, or if it is something else. He refuses to tell us anymore information. We don’t have a time line, we do not know what illness he is dealing with, we know only what he said, he is dying.
Is there anything we as his family can do to get the information we need to help him, or at least prepare our family for whatever it is to come? Please help!!!!
I’m so sorry to hear that your dad is suffering, and I can understand feeling frustrated that you don’t have more information.
If your dad isn’t telling you about his health, there probably isn’t another way to get that medical information, as long as he’s mentally capable.
Often, people need time to share serious medical information with their family members. Probably the best thing to do is let the family member know that you’re there for them if they want to tell you more. They may eventually fill in the details of what’s going on, and let you know how you can help.
Hi,
I understand the HIPAA laws but one thing it doesn’t address that I feel it should is, can a FORMER employer or employee of any medical profession (doctor, nurse, medical assistant, cna, pa, np, etc.) discuss a patient’s medical records of the practice they were employed at with another medical professional or anyone for that matter without the patients consent? I’m not talking about taking their actual records with them, just discussing information. Is that a HIPAA violation?
After all the former employer or employee has personal knowledge of a patient’s medical information that a patient has a right of privacy to.
Thank you
From an ethical and moral point of view, it wouldn’t be right to disclose medical information after leaving a job that required access to personal health info, but it may not be subject to HIPAA if they are no longer working in that domain.
I couldn’t find an article that specifically addressed this situation, but this website had some helpful answers to FAQ about HIPAA.
Thank you for your response and help. It would be nice if HIPAA would specifically address this. I feel once you work in any type of medical facility under any capacity and have access to patient’s private medical records/info you should be bound under HIPAA to protect patients rights to privacy even after leaving the facility. Protecting a patient’s medical privacy is protecting a medical patient’s privacy. It’s not like once you leave you forget a patient’s info. There’s no difference.