HIPAA and Family Members: What Staff Can Tell the Daughter on the Phone

The phone rings at the office. "This is Maria, Mrs. Alvarez's daughter. The aide said Mom fell this morning. Is she all right?" The scheduler answers, "I'm sorry, I can't discuss that because of HIPAA." Maria, who drives her mother to every appointment and pays the bill, hangs up furious and calls a competitor that afternoon.

The scheduler was not following HIPAA. She was following a myth about it. HIPAA family members rules allow most of these conversations, within limits that are easy to teach. This guide sets out what the Privacy Rule permits, the difference between family members and personal representatives, when staff must say no, and a phone script your office can use today.

Does HIPAA Apply to Your Agency?

The Privacy Rule applies to covered entities. HHS's guide for providers, Communicating With a Patient's Family, Friends, or Others Involved in the Patient's Care, notes that it applies to health care providers that transmit health information electronically in connection with standard transactions such as claims. Medicare-certified home health and hospice agencies almost always qualify, and so do most agencies billing Medicaid. A private-pay-only personal care agency may not be a covered entity, but state privacy laws, licensing rules and client contracts still apply. Treating every client's information to the HIPAA standard is the simpler policy.

The HIPAA Family Members Rule: 45 CFR 164.510(b)

The permission is in 45 CFR 164.510(b). A covered entity may disclose to a family member, other relative, close personal friend, or any other person the individual identifies, the information directly relevant to that person's involvement with the individual's care or payment for care. How depends on whether the patient is available:

• Patient present and able to decide. Share if the patient agrees, or is given the chance to object and does not, or if staff reasonably infer from the circumstances, using professional judgment, that the patient does not object.
• Patient not present, incapacitated or in an emergency. Staff may use professional judgment to decide whether sharing is in the patient's best interest and, if so, share only what is directly relevant to the person's involvement.
• After death. Staff may share with family and others who were involved in care or payment before the death, information relevant to that involvement, unless doing so conflicts with a prior expressed preference the agency knows about.

The same section allows notifying a family member, personal representative or other person responsible for care of the patient's location, general condition or death.

What HHS Says About Phone Calls and Proof

The HHS guide answers the questions office staff actually ask:

• The phone is fine. Where sharing is allowed, it may be face-to-face, by phone or in writing.
• No proof of identity is required by HIPAA when a caller says they are a family member or friend, or involved in care or payment. Providers may set their own verification rules. For someone who is not family or a friend, the provider must be reasonably sure the patient asked that person to be involved.
• No documentation is required of the patient's agreement or lack of objection, though a provider may note it in the record.
• Objections must be honored. The guide's example: a nurse may not discuss a patient's condition with her brother after the patient has said she does not want her family to know.
• Only what is relevant. A nurse may not tell a friend about a past medical problem unrelated to the current condition.
• Sharing is permitted, not required. If the patient is unavailable, a provider can choose to wait until the patient can agree.

The guide's examples fit home care closely: a provider may discuss a patient's bill with an adult son who calls about his mother's account, and may give dosage information to a patient's health aide who calls with questions about a prescription.

Family Member or Personal Representative: Not the Same Thing

A personal representative stands in the patient's shoes. Under 45 CFR 164.502(g), if applicable law gives a person authority to make health care decisions for an adult, such as a health care power of attorney or a guardian, the covered entity must treat that person as the individual for information relevant to that authority. That includes rights such as access to records, not just a conversation.

A daughter who helps with care has the limited permission in 164.510(b). A daughter who holds a health care power of attorney that is in effect may be a personal representative. Your intake record should say which, with a copy of the document.

The rule includes a safety valve. Under 164.502(g)(5), a covered entity may decline to treat someone as a personal representative if it reasonably believes the patient has been or may be subject to domestic violence, abuse or neglect by that person, or that treating them as the representative could endanger the patient, and professional judgment says it is not in the patient's best interest. In home care, where the person on the phone may also be the person a nurse is worried about, staff need to know this exists and who decides.

Verification rules differ too. Under 45 CFR 164.514(h), covered entities must verify identity and authority of a person requesting information when unknown, except for disclosures under 164.510. A request for the full record from a claimed power of attorney is not a 164.510 conversation and needs the document.

Applying It: The Call From Maria

Run the opening call through the rule.

1. 1.Is Mrs. Alvarez able to decide, and has she said anything? The record shows she named Maria as involved in her care and did not object. Staff may share.
2. 2.What is relevant? The fall, any injury, what the agency did, and what happens next. Not her unrelated history.
3. 3.Is Maria who she says she is? HIPAA does not require proof. Agency policy may ask her to confirm a detail already on file, such as the client's address, before discussing anything.
4. 4.What if the record says Mrs. Alvarez objected? Staff say they cannot discuss her care and offer to pass on a message, without confirming or denying details.

Now the harder version. A man calls, says he is the client's nephew, and asks what medications she takes and when the aide arrives each day. He is not in the record, and the client lives alone. Visit times and medication details could put her at risk. The right answer is to take a message and check with the client before saying anything, which the HHS guide expressly allows.

A Phone Script and Policy for the Office

1. 1.Check the record first. Is the caller listed as involved, as a personal representative, or as someone the client does not want informed?
2. 2.If listed and no objection: "Thank you for calling. I can share what you need to know about her care today." Share only what relates to their role.
3. 3.If not listed and the client is available: "Let me check with her, and I'll call you back." Ask the client and note the answer.
4. 4.If not listed and the client cannot decide: share only what professional judgment says is in her best interest and relevant, and route the decision to a clinician or supervisor.
5. 5.If the client objected: "I'm not able to discuss her care, but I can take a message for her."
6. 6.Never give out schedules, door codes or visit times to anyone not verified in the record.
7. 7.Note the conversation in the record: who called, what was shared, and why.

At intake, ask every client three questions and record the answers: who may we talk to about your care, who may we talk to about billing, and is there anyone we should not share information with. Collect any power of attorney or guardianship documents then, not during a crisis.

Where Systems Help

The call goes wrong when the person answering cannot see who the client has involved. Nuraflow is being designed with a client and family portal that shows only what each authorized person's relationship and permissions allow, and unified communications that keeps family calls and messages in the client's record with consent and channel preferences attached.

This article is general information, not legal advice. Confirm your privacy policies with counsel, and check state laws that may be stricter than HIPAA, especially for mental health, substance use and HIV information.