NRPM: Standards for Privacy of Individually Identifiable Health Information. b. Proposed requirements.


We propose that when an individual has the capacity to make his or her own health decisions, providers could disclose protected health information to the individual’s next- of-kin, to other relatives, or to persons with whom the individual has a close personal relationship, if the individual has verbally agreed to such disclosure. Verbal agreement could be indicated informally, for example, from the fact that the individual brought a family member or friend to the physician appointment and is actively including the family member or friend in the discussion with the physician. If, however, the situation is less clear and the provider is not certain that the individual intends for the family member or friend to be privy to protected health information about the individual, the provider would be required to ask the individual. In these cases, when verbal agreement can be obtained, that agreement would be sufficient verification of the identity of the person to meet the requirements of § 164.518(c).

We would also permit health care providers to disclose protected health information without verbal agreement to next-of-kin, to other relatives, or to persons with whom the individual has a close personal relationship, if such agreement cannot practicably or reasonably be obtained and the disclosure is consistent with good health professional practice and ethics. When verbal agreement cannot be obtained, the provider would be required to take reasonable steps to verify the identity of the family member or friend in order to meet the verification requirement under § 164.518(c). Verbal inquiry would suffice; we would not require any specific type of identity check.

We considered requiring a written authorization for each disclosure in these situations, but rejected that option because it is not practicable and does not provide sufficient additional privacy protection to justify the burden it would place on health care providers and individuals. Many of these conversations are unscheduled and of short duration, and requiring a written authorization may impede treatment and detain the individual. Therefore we would allow a one-time verbal agreement and (where required) verification to suffice for disclosure of protected health information relevant to the individual’s care. For example, a health care provider could disclose protected health information about an individual’s treatment plan to the individual’s adult child who is taking the individual home from the hospital, if the provider has verbally requested and individual has agreed to providing the adult child with relevant information about aspects of the individual’s health care. Disclosure also could be appropriate in cases where a verbal agreement cannot practicably be obtained. For example, a pharmacist could be guided by his or her professional judgment in dispensing a filled prescription to someone who claims to be picking it up on behalf of the individual for whom the prescription was filled.

In such cases, disclosures would have to follow the “minimum necessary” provisions of proposed § 164.506(b). For example, health care providers could not disclose without individual authorization extensive information about the individual’s surgery or past medical history to the neighbor who is simply driving the individual home and has no need for this information. We request comment on this approach.

The proposed definition of “individual” addresses related disclosures regarding minors and incapacitated individuals.