Release of Patient Information

Guidance regarding Release of Patient Information

Hospitals and health systems are responsible for protecting the privacy and confidentiality of their patients and patient information.  The Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandated regulations that govern privacy standards for health care information.  HIPAA regulations specify the purposes for which information may and may not be released without authorization from the patient.

The following guidance for release of information was developed by the Alabama Hospital Association from information obtained through the American Hospital Association.  This information updates the 2001 Guidelines for Releasing Information on the Condition of Patients.  This revised edition ensures that the guidelines are consistent with the final changes to the HIPAA medical privacy regulations published in August 2002, as well as the guidance document released by the Department of Health and Human Services (HHS) in December 2002.  Each hospital should take this guidance and consult with legal counsel before finalizing any policy on the release of patient information and incorporate it into its own policies. In fact, if a hospital has policies that are more stringent than these guidelines, the hospital may certainly maintain its own policies for release of patient information.

Condition and Location of Patients: What You May Release and to Whom

Inquiries that identify the patient by name
Information about the patient’s general condition and location of an inpatient, outpatient or emergency department patient may be released only if the inquiry specifically identifies the patient by name. No information may be given if a request does not include a specific patient’s name or if the patient requests that the information not be released.   This includes inquiries from the press.

As of April 14, 2003, all hospitals must tell patients upon admission what information will be included in the hospital directory and who has access to that information. At this point, patients can request that the hospital not release any information about them to the media or to others, even family and friends. This request for privacy can include total anonymity, meaning the hospital cannot confirm that the patient is even in the facility.

Inquiries from clergy
The HIPAA privacy regulations expressly permit hospitals to release the patient’s name, location in the hospital, general condition and religion to clergy members, unless the patient has asked that the information not be released.  Clergy do not need to ask for the individual by name.  For example, clergy could request information regarding patients of a particular religion.  However, hospitals are not required to ask about patients’ religious affiliations, and patients do not have to supply that information.

What Information Can Hospitals Release?
In an effort to protect the privacy of patients, HIPAA mandates that hospitals and other providers only release the minimum information necessary for the effective care of the patient. Therefore, if the patient has not requested anonymity and the reporter has provided the full name of the patient (a description of the patient and/or the situation will not be sufficient), the hospital may release a one-word description of the patient’s condition and location to individuals who inquire about the patient by name or to clergy, without obtaining prior patient authorization. Many hospitals will take the added step of requiring that the next of kin be notified before releasing any information.

The condition descriptions are as follows:
Good – Stable vital signs, good prognosis, patient is conscious and comfortable
Fair – Stable vital signs, good prognosis, patient is conscious, but may be uncomfortable
Serious – Unstable vital signs, prognosis is questionable, and patient is acutely ill
Critical – Unstable vital signs, major complications exist, and the prognosis is not favorable
Undetermined – Patient is awaiting physician and/or assessment.

* The word “stable” should not be used to describe a patient’s condition.

Death of Patient 
The death of a patient may be reported to the authorities by the hospital, as required by law.  Typically, public information about a death will be disclosed after efforts have been made to notify the next-of-kin. Information about the cause of death must come from the patient’s physician, and a legal representative of the deceased must approve its release.  A hospital cannot share information with the media on the specifics about sudden, violent or accidental deaths, or deaths from natural causes without the permission of the decedent’s next-of-kin or other legal representative.

Can the hospital tell the media the patient has died without getting the family’s permission? In other words, is “deceased” a condition that can be disclosed?
Under the HIPAA privacy rule, if a patient has not asked that his or her information be kept out of the hospital’s directory, the hospital may disclose the patient’s general condition to anyone who asks for the patient by name.   HIPAA does not define what constitutes a “general condition.”   Disclosing that a patient is deceased, however, appears to be a permissible facility directory disclosure as a statement of the patient’s general condition.  A hospital may not disclose information regarding the date, time, or cause of death.

For deceased patients, can the hospital provide the media with the date and time of death, as recorded on the death certificate?
No.   The hospital may not disclose a patient’s date or time of death to the media.   A hospital may disclose to the media only that information maintained in the hospital directory, which is a patient’s name, location in the hospital and general condition, if the media asks for the patient by name.  No other information may be provided without individual authorization.  In the case of a deceased patient, authorization must be obtained from a personal representative of the deceased.

The patient’s location may be included in the hospital directory to facilitate visits by friends and family as well as the delivery of flowers, cards and gifts.   However, as a matter of policy, the patient’s location should not routinely be given to the media.

Disclosures of Location to the Media
Although HIPAA does not expressly prohibit disclosure of patients’ room location to the media (because the media are accorded the same access to information as other callers who ask for the patient by name), this omission was not intended as a loophole to give journalists access to celebrity or other patients who do not wish them to have it.  To safeguard patient privacy, it is recommended that the hospital adopts or maintains policies prohibiting disclosure of patient location to the media without patient permission.  Furthermore, the hospital should not enable media to contact patients directly.  Instead, the patient’s public relations or other designated representative should handle interviews and calls.  A hospital may deny the media access to a patient if the hospital determines that the presence of photographers or reporters would aggravate the patient’s condition or interfere with patient care.

A hospital representative should accompany the media at all times while they are in the hospital.  At their discretion, hospitals may deny the media access to any area, including (but not limited to) operating rooms, intensive care units, maternity units, emergency departments, psychiatric departments, nurseries, pediatric units, and substance abuse units where all patients present have an expectation of a certain degree of privacy.

For obstetrical patients, can the hospital confirm that the patient is in labor and delivery or has been released from labor and delivery?
No. Disclosing the fact that a patient is in labor provides more information than the patient’s general condition.  A hospital may not disclose that a patient is in labor or has been released from labor and delivery without individual authorization, unless the disclosure is to family members or friends involved in the patient’s care or payment for the patient’s care.

What if the Patient Shares Additional Information?
Even if the patient gives a reporter more information than the one-word description, the hospital cannot confirm or deny any information beyond what is covered in HIPAA.

What about Notable Patients?
Patients who are well-known in the community (government official, celebrity, etc.) will be treated exactly like all other patients with regard to the release of information.

Can Media Representatives Obtain Patient Interviews/Photos?
As always, any media requests for patient interviews should be made through the hospital, and a hospital representative must be present during the interview. This ensures not only the privacy of the patient, but also that of other patients and families nearby. Such interviews will only be granted with the patient’s written authorization.

What About Minor Patients?
In general, hospitals cannot release information about minors (primarily considered to be those under the age of 19) without the consent of their parents or legal guardians.

Since hospitals can only use one-word patient condition reports, may a hospital disclose that a patient was treated and released?
Yes.  Under the HIPAA privacy rule, a hospital may disclose, to individuals who ask for the patient by name, that a patient was treated and released because this only provides the patient’s general condition (that they were treated at the hospital) and the patient’s location (that the patient is no longer at the hospital). No specific health information is provided. Therefore, assuming the other requirements for disclosures of directory information are met, this appears to be a permissible disclosure of directory information under HIPAA.

If the hospital can say that someone has been “treated and released” without getting permission, may the hospital disclose when the patient was released or to where the patient was released?
No.  Although a hospital may disclose that a patient was treated and released as information regarding the patient’s location (or lack thereof) in the hospital, it may not release information regarding the date of release or where the patient went upon release without patient authorization.   A hospital may release this information, however, to the patient’s family members or friends involved in the patient’s care, so long as the patient has not opted-out of such disclosures and such information is relevant to the person’s involvement in the patient’s care.

Can the hospital tell the media that the patient has been discharged from an inpatient admission without getting the patient’s permission?
Under the HIPAA privacy rule, if a patient has not asked that his or her information be withheld from the hospital’s directory, the hospital may disclose the patient’s location in the hospital to anyone who asks for the patient by name, without the patient’s authorization.   If the patient is no longer at the facility, the hospital may disclose that fact in response to such an inquiry.

Should the hospital obtain consent from individuals who appear in the background of photos taken in a public place such as the hospital lobby?
The HIPAA privacy rule does not speak to background photos.  Under the HIPAA privacy rule, however, hospitals may not release identifiable photographs of patients at the hospital, without the patient’s authorization.

Condition & Location:  When you should not release information

Patients can “opt out” of providing information altogether
The hospital has a responsibility to tell patients what information will be included in the hospital directory (name, general condition, location, and religion) and to whom that information will be disclosed (to people, including media, who ask for the patient by name, and to clergy).  The hospital may inform the patient of this information verbally or in writing. The patient has the option to expressly state that he or she does not want information released—including information confirming his or her presence in the facility.  The hospital may obtain the patient’s agreement or objection verbally or in writing.  If a patient opts-out of the hospital directory, information still may be disclosed to family and friends who are involved in the patient’s care or payment for care.  In such case, only information directly relevant to the person’s involvement in the patient’s care or payment may be released.

Do not release information that could embarrass or endanger patients
Spokespersons should not report any information that may embarrass a patient.   Situations where room location information could embarrass patients include (but are not limited to) admission to a psychiatric or substance abuse unit; admission to an obstetrics unit following a miscarriage, ectopic pregnancy or other adverse outcome; or admission to an isolation room for treatment of an infectious disease.   In addition, where knowledge of a patient’s location could potentially endanger that individual (i.e., the hospital has knowledge of a stalker or abusive partner), no information of any kind should be given, including confirmation of the patient’s presence at the facility.

Consider other applicable federal laws
Be aware that federal laws prohibit hospitals from releasing any information regarding a patient undergoing treatment for alcohol or substance abuse.  These include the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act of 1970; the Drug Abuse Office and Treatment Act of 1972; and 42 CFR Part 2, 188.

Exercise good judgment in situations where patients can’t express a preference
In some cases, patients will not have had the opportunity to state a preference related to the release of their information.   In those circumstances, condition and location information should be released only if, in the hospital’s professional judgment, releasing such information would be in the patient’s best interest.  As soon as the patient recovers sufficiently, the hospital must ask about information preferences.  Each hospital should develop policies and procedures to guide staff in making these judgments.

When a patient has opted-out of the hospital directory, what should the hospital say? 
Under the HIPAA medical privacy rule, a hospital is permitted to release only directory information (i.e., the patient’s one-word condition and location) to individuals who inquire about the patient by name unless the patient has requested that information be withheld.  In response to a media inquiry about a patient who has opted-out of the directory, therefore, the hospital should respond by stating that the federal medical privacy regulations allow the hospital to release to the media only the information in the hospital’s directory and that the hospital does not have any information about the person in its directory.

If a patient opts to make directory information available, but does not want information released to the press, how can the hospital assure that directory information is not provided to reporters who provide the patient’s name?
The hospital is obligated to ensure that no impermissible disclosures are made.  Therefore, at a minimum, the hospital will be required to ask for additional information from anyone inquiring about a patient in an attempt to determine whether the person making the inquiry is with the press.

Matters of Public Record

What is a matter of public record
Matters of public record refer to situations that are reportable by law to public authorities, such as law enforcement agencies, the coroner or public health officer. While laws and/or regulations require health care facilities to report a variety of information to public authorities, it is not the responsibility of facilities to provide that information in response to calls or other inquiries from the media or other parties, including law enforcement officials. Instead, such calls should be directed to the appropriate public authority.

Are public record cases different from other cases
No. Patients who are involved in matters of public record have the same privacy rights as all other patients, as far as the hospital is concerned.

There are numerous state statutes addressing reporting of incidents ranging from child abuse to gunshot wounds.  The fact that a hospital has an obligation to report certain confidential information to a governmental agency does not make that information public and available to news reporters.  In fact, state laws may provide enhanced privacy protection for some reportable information, such as HIV status; sexually transmitted diseases; child, spouse or elder abuse; and reportable genetic anomalies.

Refer media questions to the public entity (such as the coroner’s office, police, fire or health department) that receives such reports.  The public entity will be guided by the applicable statute as to whether it can release any or all of the information received.

Release of Information in Disaster Situations
In highly charged situations, such as disasters, the public may benefit from the release of general information when specific information cannot be released. For example, the hospital could confirm that it is treating a number of individuals as a result of a bus wreck. The hospital might also provide information on the age or gender of the patients to help reduce undue anxiety. However, the hospital cannot release any information that would identify a specific person.

When feasible, notify the next-of-kin first
While it is desirable to notify next-of-kin before releasing patient information, in disaster situations involving multiple casualties, it may be necessary to share patient information with other hospitals and/or rescue/relief organizations before the next-of-kin has been notified.

Don’t hesitate to cooperate with other hospitals or relief agencies
You may release patient information to other hospitals, health care facilities and relief agencies in situations where multiple facilities are receiving patients from one disaster.  Public relations representatives from different facilities are encouraged to cooperate and facilitate the exchange of information regarding patients’ location and status.  Specifically, you may disclose patient information to a public or private organization assisting in relief efforts for the purpose of notifying family members or others responsible for a patient’s care about the patient’s location, general condition or death.

Work effectively with the media
Current information should be made available to the media as soon as possible.  If information is not yet available or if next-of-kin has not been notified, all media inquiries should be logged and callbacks made as soon as it is permissible to release information.  A location should be provided for all media to gather so that information can be released in a press conference format that does not compromise patient privacy or the health care facility’s need for added security in a disaster situation.

If a hospital has a “John Doe” patient and decides to publicize this person’s hospitalization as a method of finding the patient’s family, would that violate the HIPAA privacy standards?
It is unclear whether this disclosure would be permissible under the HIPAA privacy rule.  Although a hospital is permitted to notify a patient’s family about the patient’s location in the hospital and general condition, the rule does not permit notification of the general public.  A hospital should not release a photograph of the patient without the patient’s authorization, but may be able to release information describing the patient’s general characteristics (e.g., age, gender, height, weight) that would not be considered protected health information under the privacy rule.  A hospital should use its professional judgment regarding the best interests of the patient with respect to any such publicity.

As per HIPAA Privacy Guidelines
Revised April 2013

For more information contact Rosemary Blackmon, Alabama Hospital Association, (800) 489-2542.