Suppose your mother is a patient in the hospital or Emergency Room. You are her family caregiver and when you ask about her treatment, the doctor or nurse says, “I can’t tell you that because of HIPAA.”
That answer is wrong. But you need to know more. What is HIPAA? Why should you as a family caregiver need to know your mother’s medical information? And what can you do to get the information you need? Here are answers to these and other questions family caregivers ask about HIPAA.
HIPAA (Health Insurance Portability and Accountability Act) is a federal law that sets out rules for sharing personal medical information and protecting it from unauthorized uses. It applies to information collected in hospitals, doctors’ offices, and other places that provide health care as well as to the businesses that help providers manage and store the data. The information may be on paper or in an electronic health record.
The law allows people who are directly involved in the care of a patient or payment for services to see this information. Employers, marketers, fundraisers, or other people who want this information for their own reasons cannot have it.
HIPAA is based on two important ideas in patient care: privacy and confidentiality. Privacy refers to a person’s right to limit who knows what about one’s medical condition. It also refers to the right to have conversations about medical care in places where others cannot overhear. The detailed regulation that covers HIPAA is called the Privacy Rule. Confidentiality refers to a health care professional’s obligation to keep information from being disclosed without the patient’s consent, unless required by law or considered necessary for clinical reasons.
A family caregiver is someone who takes care of a person who has a chronic or serious illness or disability. The caregiver can be a family member, friend, partner, child, parent, or someone else close to the patient. He or she does not need to live with the patient.
Family caregivers need medical information so they can better manage and provide care for the patient. For example, a family caregiver who helps the person communicate with the doctors needs to know what medical problem the person is being treated for. This family caregiver also needs to know the names of the medicines the doctor orders, why the doctor thinks the patient needs them, and what side effects to look out for. A family caregiver who fixes meals or helps with grocery shopping would need to know about the person’s dietary restrictions and other food issues.
Family caregivers may need to be involved in conversations about next steps, such as how an illness is being treated, or what kind of care the person will need at home. Many patients, no matter how independent, benefit from having family caregivers involved in these discussions and decisions; after all, they are getting medical care because they are sick or injured. They may not remember everything because of pain, feeling sick, or medication, and may not be able to make clear decisions.
Doctors and other health care professionals can share medical information with family caregivers or others directly involved with a patient’s care, if the patient is awake, has a reasonable understanding of the situation, and has the opportunity to say no. HIPAA law requires health care providers to use professional judgment to decide what should be shared.
However, if the patient says he or she does not want this information shared with others, then health care providers cannot share information
HIPAA applies to all information, including mental health information, with the exception of psychotherapy notes, which receive special protections because of the sensitive nature of the content. In February 2014, recognizing the special issues that may come up when a patient is being treated for a mental illness, the Health and Human Services’ Office of Civil Rights, which monitors compliance with HIPAA, issued an 11-page guidance (http://bit.ly/mhguidance) about sharing information related to mental health.
The guidance reaffirms the patient’s control of personal health information but recognizes circumstances in which sharing the information may be permissible without the patient’s consent “if the provider has a good faith belief that the patient poses a threat to the health or safety of the patient or others, and the family member is reasonably able to prevent or lessen that threat.” The guidance also states that even if the patient doesn’t consent, “HIPAA in no way prevents health care providers from listening to family members or other caregivers who may have concerns about the health and well-being of the patients, so the health care provider can factor that information into the patient’s care.”
Some hospitals or other health care facilities ask patients to sign written consent forms before doctors discuss medical information with family caregivers. HIPAA does not require written consent for this purpose, but it may be part of the health care facility’s procedures.
Talk with the social worker, patient representative, or privacy officer if you are the family caregiver and have trouble getting your patient’s medical information.
The next time your family member is a patient in the hospital or Emergency Room, tell the doctor or nurse that you are the person’s family caregiver. The best care happens when the doctor or nurse then says, “Let’s talk about the treatment your family member needs and how we all can help.”
Department of Health and Human Services’ Office for Civil Rights website at www.hhs.gov/ocr/hipaa.
Additional information regarding HIPAA and mental health: www.hhs.gov/ocr/privacy/hipaa/understanding/special/mhguidance.html.
Health Privacy Project website at www.healthprivacy.org.
©2014 United Hospital Fund