Protecting the privacy and confidentiality of patients and patient information is an increasingly important responsibility of hospitals and healthcare facilities. The Department of Health and Human Services (HHS) has issued the final rule on medical privacy pursuant to the Health Insurance Portability and Accountability Act (HIPAA). This rule specifies the purposes of which information may and may not be released without authorization from the patient. It is important to be aware that healthcare facilities also must comply with state laws regarding patient privacy and confidentiality. The information on this site is consistent with these regulations.
Without patient authorization, the only information that may be released is the patient’s one-word condition.
As long as the patient has not requested that information be withheld, after next-of-kin has been notified, the hospital may disclose the patient’s general condition using the terms indicated below. This is the only information that can be released about a patient’s condition without obtaining the patient’s permission. Note that these one-word conditions can be determined only by a physician; a physician is the only person who can determine the patient diagnosis and/or prognosis, and representatives from Marketing, Emergency Department (Clinical Manager or Charge Nurse) or House Administrator are the only individuals authorized to release information.
Inquiries must contain the patient’s name.
Information about the condition and location of an inpatient, outpatient or emergency department patient may be released only if the inquiry specifically contains the patient’s name. No information is to be given if a request does not include a specific patient’s name.
Terms to describe patient condition:
- Undetermined: Patient awaiting physician and assessment.
- Good: Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent.
- Fair: Vital signs are stable and within normal limits. Patient is conscious but may be uncomfortable. Indicators are favorable.
- Serious: Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.
- Critical: Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable.
- Treated and Released: Patient received treatment but was not admitted.
- Treated and Transferred: Patient received treatment. Transferred to a different facility.
Condition of Patients: When information will not be released
Patients can “opt out” of providing information altogether.
The patient has the option to expressly state that he or she does not want information released - including confirmation of his or her presence in the facility.
Information that could embarrass or endanger patients.
Sometimes it’s not advisable to report information about patients, even if they have not asked to opt out. Spokespeople should not report any information that may embarrass a patient. Also, where knowledge of a patient’s location could potentially endanger that individual, (i.e., the hospital has knowledge of a stalker or abusive partner), no information of any kind should be given, including confirmation of the patient’s presence at the facility.
When release of information violates federal or state laws.
There are often laws on the books that prohibit even the acknowledgment of a person’s presence in the hospital. Federal privacy protection laws of patients admitted for psychiatric treatment, for substance abuse and certain other conditions prohibit even confirmation that a particular patient is receiving treatment in the hospital.
Exercising good judgment in situations where patients can’t express a preference.
In some cases, a patient will not have had the opportunity to state a preference about having his or her information released. For example, a patient’s medical condition may prevent hospital staff from asking about information preferences upon admission. In those circumstances, condition information should only be released if, in the hospital’s professional judgment, releasing such information would be in the patient’s best interest. Then, when the patient recovers sufficiently, the hospital must ask for his or her preference. The hospital has developed policies and procedures to guide staff in making these judgments.
Matters of Public Record
What is a matter of public record?
Matters of public record refer to situations that are reportable by law to public authorities, such as law enforcement agencies, the coroner or public health officer. While laws and/or regulations require healthcare facilities to report a variety of information to public authorities, it is not the responsibility of facilities to provide that information in response to calls or other inquiries from the media or other parties. Instead, such calls should be directed to the appropriate public authority.
Are public records cases different from other cases?
Patients who are involved in matters of public record have the same privacy rights as all other patients, as far as the hospital is concerned. The mode of transportation by which a patient arrives at the hospital should have no bearing on the hospital’s approach to releasing information about the patient.
Releasing Patient Information in Disaster Situations
Notify next-of-kin first is the guiding principle. In disaster situations involving multiple casualties, just as in all other situations, patient information should not be released until the next-of-kin has been notified.
When appropriate, general information may be released to help dispel public anxiety.
In highly charged situations such as disasters, the public may benefit from the release of general information when specific information is not yet releasable. For example, the hospital might say that “the facility is treating four individuals as a result of the explosion.” We may state the number of patients who have been brought to the facility by gender or by age group (adults, children, teen-agers, etc.) This type of general information can help reduce undue anxiety. Information which could lead individuals to ascertain the individual identity of a patient will not be released without notification of next-of-kin or the patient’s permission.
Working effectively with the media.
Current information will be made available to the media as soon as possible. That means AFTER RELEASE OF INFORMATION APPROVAL IS OBTAINED FROM THE PATIENT OR NEXT-OF-KIN. If information is not yet available or if next-of-kin has not been notified, all media inquiries will be logged and callbacks made as soon as information can be released. A location has been provided for all media to gather so that information can be released in a news conference format that does not compromise patient privacy or the healthcare facility’s need for added security in a disaster situation.
These guidelines were provided by:
Society for Healthcare Strategy and Market Development of the American Hospital Association
One North Franklin
Chicago, IL 60606