The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule render clients with important privacy rights with respect to their health information, including essential controls over how their health data is utilized and disclosed by health plans and health care providers. Ensuring powerful privacy protections is important to keep in individual’s trust in their health care providers and willingness to obtain required health care services, and these protections are particularly important where very sensitive information is considered, such as mental health information. The Rule is carefully balanced to allow uses and disclosures of information including mental health information for treatment with appropriate protections.
The HIPAA Privacy Rule permits communications between health care providers and family and friends, in realization of the integral role that family and friends play in a patient’s health care. Where a patient has the able to make health care decisions, health care providers may interact with a patient’s family members, and friends, the patient has involved in his or her health care or payment for care, so long as the patient does not object. The provider may ask the patient’s permission to share information with family members, may tell the patient he or she plans to discuss the information and give them an opportunity to agree or object, or may conclude from the circumstances, using professional judgment, that the patient does not object.
A health care provider may share the patient’s data with family, friends, involved in the patient’s care or payment for care, as long as the health care provider realizes, based on professional judgment, that doing so is in the best sake of the patient, where patient is not present or is incapacitated. Note that, the health care provider must be sure that the patient asked the person to be involved in his or her care or payment for care, when someone other than a friend or family member is engaged.
Disclosures to family members, friends, or other individuals involved in the patient’s care or payment for care are to be restricted to only the protected health information immediately relevant to the person’s involvement in the patient’s care or payment for care.