4. Disclosures Requiring Opportunity to Agree or Object
HIPAA allows the use and disclosure of PHI when an individual receives oral or written advance notice of the use and disclosure and is given the opportunity to object orally or agree. (In other words they are given an opt-out opportunity.)
The Privacy Rule realizes there are times an individual and covered entity make informal, oral agreements to disclose PHI. This can happen at a hospital when a relative calls a hospital to check on a patient?s health status. The hospital may disclose some information regarding the presence of the patient if there are no prior agreements preventing this. The provider must always give the patient the opportunity to opt out of such disclosures.
In most situations a covered entity may use the patient?s name, location in the facility, general condition and religious affiliation in order to maintain a directory for its facility.
A covered entity may disclose to a relative, close friend or any other person identified by the individual, any PIH that is related directly to person?s involvement with the patient?s care or health care payment. These disclosures do not include detailed information about the patient?s health history.
If a patient is present or available when PHI is to be disclosed to a relative, friend or other third party, the covered entity must give the patient the opportunity to refuse disclosure. If the individual is not present, or the individual cannot object or agree due to circumstances, the covered entity may use professional judgement and infer the patient does not object. An entity may also allow a third party to act on the patient?s behalf by picking up prescriptions, or other forms of PHI.
A covered entity is not required to verify the identity of relatives or other third parties involved in the individual?s treatment. If the individual has not objected to the involvement of third parties the covered entity can infer the individual would not object to the involvement of a third party and further verification is not necessary. All permissions must be evaluated on a case by case basis.
All disclosures must be related to a patient?s current condition but none of the specifics of the medial history. Disclosures should be narrowed to closest relationships of the patient and only information relevant to the condition.