Health Information Compliance Alert

Published on Fri Dec 11, 2020 PDF

Question: The physician of a patient’s child requested his protected health information (PHI) for treatment purposes. Are we allowed to share that data? Is it mandated that we do?

Indiana Subscriber

Answer: The answer is complicated, but in a nutshell — yes and no. The HIPAA Privacy Rule allows covered healthcare providers to share patients’ PHI for treatment purposes — and this includes family members’ treatment; however, you must get written authorization first.

Consider this: “For example, an individual’s doctor can provide information to the doctor of the individual’s family member about the individual’s adverse reactions to anesthetics prior to the family member undergoing surgery,” HHS Office for Civil Rights (OCR) guidance says.

But: Even though you are permitted to share this PHI, you don’t have to, OCR suggests. According to the rule, a covered healthcare provider has the option of declining requests for family members’ PHI.

The agency offers genetic testing results as an example of what a provider might choose not to share.

“An individual who has obtained a genetic test may request that the healthcare provider not use or disclose the test results. If the healthcare provider agrees to the restriction, the information could not be shared with providers treating other family members who are seeking to identify their own genetic health risks,” OCR advises.