HIPAA privacy rule permits disclosures to loved ones

The Office of Civil Rights has issued a new FAQ clarifying that  the HIPAA Privacy Rule permits disclosures to loved ones regardless of whether they are recognized as relatives under applicable law. The FAQ, while applicable in a variety of circumstances, was developed in large part to address confusion following the 2016 Orlando nightclub shooting about whether and when hospitals may share protected health information with patients’ loved ones.  In particular, the FAQ makes clear that the potential recipients of information under the relevant permissive disclosure provisions of 45 CFR 164. 510(b) are not limited by the sex or gender identity of the person.

In tandem, OCR is updating its existing guidance on several provisions within the HIPAA Privacy Rule that recognize the integral role that a spouse often plays in a patient’s health and health care.  Consistent with the Supreme Court decision in Obergefell  v. Hodges, the OCR is issuing updated guidance that makes clear that the terms marriage, spouse, and family member include, respectively, all lawful marriages (whether same-sex or opposite-sex), lawfully married spouses and the dependents of all lawful marriages, and clarifies certain rights of individuals under the Privacy Rule.

OCR’s updated guidance and FAQ may be found at:  https://www.hhs.gov/hipaa/for-professionals/special-topics/same-sex-marriage/index.html and the FAQ is also available at https://www.hhs.gov/hipaa/for-professionals/faq/2086/does-hipaa-privacy-rule-permit-doctor-discuss-patient-s-health-status.html