NRPM: Standards for Privacy of Individually Identifiable Health Information. i. Individuals capable of making decisions.


For individuals who are not incapacitated, this rule would require the covered entity to ask whether information about the individual’s presence in the facility, room number and general condition can be included in the general patient directory. When individuals are capable of making such a determination, their wishes should be respected.

We considered whether also to require covered entities to allow an individual to specify that information can be provided to specific persons but not others. For example, someone may feel that it is acceptable to release information to family members but not to friends. While we would like to respect individuals’ wishes to the greatest extent possible, we are concerned about placing on covered entities the burden of verifying the identify of a person requesting directory information. We are therefore not including this additional requirement, but are requesting comments on current practices and how such requests might be accommodated.

We would not require a formal individual authorization pursuant to § 164.508. A verbal or other informal inquiry and agreement would be sufficient. We require only that individuals be given the choice.