OCR Revises HIPAA Secrecy Law Direction for Healthcare Experts

The Division of Health and Human Services’ OCR has revised its HIPAA Secrecy Law direction for healthcare experts to assist clear up misunderstanding concerning permissible disclosures of PHI to patients’ loved ones, relatives, and spouses.

The bulk of healthcare experts are conscious that the HIPAA Secrecy Law allows them to disclose the PHI of a patient with a loved one or relative. Nevertheless, the 2016 Orlando nightclub firing case exposed that several healthcare experts are uncertain regarding how the HIPAA Secrecy Law – 45 CFR 164.510(b) – relates to same sex pairs.

OCR has verified that the Secrecy Law allows a protected unit to “share [PHI] with a person’s close personal friend, another relative, family member, or any other individual named by the person, the info directly pertinent to the participation of that individual in the payment for health care or patient’s care.” OCR has also verified that protected units are permitted to unveil related information “to alert, or help in the warning of (including by assisting to locate or identify), such an individual of the patient’s death, general condition, or location.”

The receiver can be a “patient’s partner, spouse, friend, caregiver, guardian, relative, or,        family member” but also any other person that is an appointed personal rep of the patient. A personal rep of a patient should, as much as the Secrecy Law is involved, be considered as the person for purposes like using the patient’s Secrecy Law rights, including offering access to their health info. There are partial omissions, which are specified in 45 CFR 164.502(g).

OCR has verified that protected units are allowed to disclose a patient’s PHI with same-sex spouses and clarifies that the list of possible receivers of PHI is never influenced by an individual patient’s gender identity or sex, and neither by the gender or sex of the possible receiver.

OCR also required checking who can be categorized as a personal rep of the patient, stating “the Secrecy Law usually seems to state rules governing which individuals have right to act for a person in making decisions linked to health care.”

For instance, if a state allows lawfully married partners health care decision making power for each other, a protected unit would be in breach of the Secrecy Law if access to the patient’s info was not allowed if requested by a partner, irrespective of the gender of that person.

Although the protected unit must get approval from the patient involved before disclosing information, in situations when the patient is not available or incapacitated, protected units must use their expert finding if the disclosing of info is in the patient’s best advantage. Should a patient be dead, info can be disclosed to an individual who has been engaged in the patient’s treatment or who has made payment for medical facilities before the patient’s demise.

OCR’s Secrecy Law explanation can be found – as well as downloaded – from the HHS on this link.