September 24, 2020

Volume X, Number 268

September 24, 2020

Subscribe to Latest Legal News and Analysis

September 23, 2020

Subscribe to Latest Legal News and Analysis

September 22, 2020

Subscribe to Latest Legal News and Analysis

Sharing Family Medical History Disclosed by Patients Without Consent of Family Doesn't Violate HIPAA According to Feds

Imagine that you are a health care provider covered by the HIPAA privacy rule. Also imagine that your patient shares with you certain aspects of her family’s medical history which may be relevant to your treatment of the patient. Finally, imagine that another health care provider later asks you to disclose all or some of that patient’s family medical history for purposes of treating one of those family members.

Once you have this family medical history in your records, are you allowed to disclose it in the same manner, and under the same circumstances, that you’d be free to disclose the patient’s personal “protected health information” without first obtaining the consent of the family members whose medical history now rests in your records? Well, apparently you can. So says the U.S. Department of Health and Human Services’ Office of Civil Rights (“OCR”) in a new HIPAA “Frequently Asked Questions” (“FAQ”) document released on January 7, 2009.

The HIPAA privacy rule limits how covered health care providers may use or disclose protected health information (“PHI”) of their patients. However, under that rule, a provider may disclose PHI (except psychotherapy notes) to third parties for purposes of treatment, payment and certain health care operations purposes, without obtaining the consent of the patient to the PHI disclosure. According to OCR, when a covered health care provider obtains a patient’s family medical history, that information becomes part of the patient’s medical record, and his PHI. Thus, any HIPAA privacy rights in that information belong to the patient, not his family members. OCR also says that the privacy rule’s authorization to disclose PHI, without consent of the patient, for purposes of “treatment” extends to treatment of others besides just the patient who provided the information, including members of his family. So, a provider may disclose a patient’s family medical history to another health care provider for purposes of treating the patient’s family member without consent of the patient or the family member.

© 2009 Poyner Spruill LLP. All rights reservedNational Law Review, Volume , Number 229


About this Author

Kenneth L. Burgess, Health Care Litigation Attorney, Poyner Spruill Law firm

Ken is a health care attorney with more than 28 years of experience advising clients on a wide range of regulatory, reimbursement, litigation, compliance and operations issues.  His practice has focused heavily, but not exclusively, on issues affecting long term care providers.  He has advised them on a wide variety of legal planning issues arising in the skilled nursing facility setting, assisted living setting, hospice, home health and other spheres of long term care. He also frequently represents ancillary service providers (pharmacy, DME, therapy and similar...