NRPM: Standards for Privacy of Individually Identifiable Health Information. ii. Incapacitated individuals.


If an individual is not able to make determinations as to whether location or status information should be released to family and friends, and had not in the past expressed a preference in this regard, we would leave the decision as to whether to include the individual in a directory to the discretion of the covered entity. Often individuals are unconscious or otherwise unable due to a medical condition to communicate their wishes to the entity and no representative is available to act for them. In these cases, we encourage the covered entity to take into consideration a number of factors when deciding whether or not to include such an individual in the directory:

  • Could disclosing that an individual is in the facility reasonably cause danger of harm to the individual? For example, if a person is unconscious and receiving treatment for injuries resulting from physical abuse from an unknown source, an entity may determine that revealing that the individual is in the facility could give the attacker enough information to seek out the individual and repeat the abuse.
  • Could disclosing the location within the facility of the patient give information about the condition of the patient? If a patient’s room number would reveal the nature of the medical condition, the entity may decide that it is inappropriate to give that information. For example, if one floor of a hospital has been specifically designated as the psychiatric floor, simply saying that a patient is located on that floor discloses some information about the condition of the individual.
  • Is it necessary or appropriate to give the status of a patient to family or friends? Covered entities often need information from family or friends for the treatment of an incapacitated individual. For example, if a patient is unconscious, family or friends may be able to give valuable information that will assist the care giver in making urgent decisions. Family members or friends may be able to give information on drugs or medications that the individual has been taking. On the other hand, it may be that revealing the status of an individual gives more information than the individual would have disclosed if they could make the determination themselves.

If an individual had, prior to becoming incapacitated, expressed a desire not to be included in such a directory and the covered entity learns of that statement of preference, the covered entity would be required to act in accordance with the stated preference.

Individuals who enter a facility incapacitated and then improve to the point of being able to make their own determinations should be asked within a reasonable time period for permission to include information in the facility’s directory.

When the condition of a individual who has opted not to allow protected health information to be included in the facility’s directory deteriorates, and the individual is no longer capable of making disclosure decisions, the covered entity would be required to abide by the individual’s initial decision. However, such a decision should not prevent a provider from contacting the family if such contact is required for good medical practice. A provider could need information from the family to treat a newly incapacitated person. If good medical practice would include contacting family or friends, the individual’s initial request should not prohibit such contact. But the covered entity would still be prohibited from including information about the individual in its directory.