Prompted by the mass shooting in Las Vegas, HHS’s Office for Civil Rights issued guidance clarifying when covered entities can share a patient’s protected health information with family, friends and others involved in the patient’s care.
Typically, protected health information is only shared after a patient provides consent. The OCR reminded health care providers that they can disclose protected health information without consent to family members and relatives involved in the patient’s care if in their professional judgment doing so is in the patient’s best interest. Information can also be shared as necessary to locate someone’s family member. In addition, a covered entity may share protected health information with disaster relief organizations like the American Red Cross to coordinate notification regarding the patient. The information shared should be limited to the minimum necessary to accomplish the purpose of transmitting it to family, friends, or others involved in the patient’s care.
Putting it Into Practice: OCR has provided information in the past about when PHI can be shared, however this is a timely reminder that patient consent is not always needed.