Q&A: HIPAA during natural disasters

Q: When dealing with a natural disaster such as the California wildfires, does the HIPAA Privacy Rule allow information to be shared more easily? What are some examples of changes to the Privacy Rule during these circumstances?

A: When patients are incapacitated or receiving emergency treatment, their information may be included in a facility directory if the disclosure is:

• Consistent with any prior expressed wishes
• In the patient’s best interest, in the provider’s professional judgment

If information is used or disclosed for directory purposes without the patient’s agreement, the patient must be told and given an opportunity to agree or object when it becomes practical. For example, patients who are unconscious when admitted must be told about the facility directory when they are able to communicate.

Directory information may be disclosed to a public or private entity authorized by law or its charter to assist in disaster relief efforts, such as the American Red Cross, to help in notifying family members. The information disclosed should be limited to the minimum necessary.

Editor's note: Mary D. Brandt, MBA, RHIA, CHE, CHPS is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to editor Kevin Duffy at kduffy@hcpro.com.