Confidentiality

[Arghn]

I was under the impression that if someone calls and asks if "X" is at the hospital, you cannot confirm or deny.

I was told the other day that we can acknowledge if a patient is on the unit, but no info (unless they offer the password associated with the patient). However, we cannot acknowledge if a patient is admitted if they are a VIP.

F

I always thought no info can be shared over the he phone unless the caller knows a password.

[JustBeachyNurse, LPN]

No directory info is public information unless a patient/family opts out or is in a restrictive unit such as psychiatric where revealing presence would revealing confidential info.

Does the HIPAA Privacy Rule permit hospitals and other health care facilities to inform visitors or callers about a patient's location in the facility and general condition?

Answer:

Yes. Covered hospitals and other covered health care providers can use a facility directory to inform visitors or callers about a patient's location in the facility and general condition. The Privacy Rule permits a covered hospital or other covered health care provider to maintain in a directory certain information about patients – patient name, location in the facility, health condition expressed in general terms that does not communicate specific medical information about the individual, and religious affiliation. The patient must be informed about the information to be included in the directory, and to whom the information may be released, and must have the opportunity to restrict the information or to whom it is disclosed, or opt out of being included in the directory. The patient may be informed, and make his or her preferences known, orally or in writing. The facility may provide the appropriate directory information – except for religious affiliation – to anyone who asks for the patient by name. Religious affiliation may be disclosed to members of the clergy, who are given additional access to directory information under the Rule.

Even when, due to emergency treatment circumstances or incapacity, the patient has not been provided an opportunity to express his or her preference about how, or if, the information may be disclosed, directory information about the patient may still be made available if doing so is in the individual's best interest as determined in the professional judgment of the provider, and would not be inconsistent with any known preference previously expressed by the individual. In these cases, as soon as practicable, the covered health care provider must inform the patient about the directory and provide the patient an opportunity to express his or her preference about how, or if, the information may be disclosed. See 45 CFR 164.510(a).

Source: 483-Does HIPAA permit health care facilities to inform visitors about a patient’s location | HHS.gov

[MunoRN, RN]

HIPAA specifically allows hospitals to confirm that someone is a patient there, with the exceptions of mental health or patients that have either requested Do Not Announce (DNA) or are DNA by default (ie victim of gang violence). I'm not sure how it would really work otherwise, I would think police departments would get pretty annoyed with all the missing person reports.

[nurse2033, MSN, RN]

Your impression is incorrect. The directory of the hospital is NOT protected by HIPAA unless the patient chooses to be confidential. Any further information about them, except their general condition, is protected.