Proposed Standards for Privacy and Individually Identifiable Health Information

7. Disclosure of directory information. (§ 164.510(h))

In § 164.510(h), we propose to permit covered entities to disclose information that could reveal protected health information about an individual for purposes of a facility patient directory, if the individual has indicated consent to such disclosures, or if the individual who is incapacitated had not previously expressed a preference in this regard and a covered entity determines that including such information in the directory would be consistent with good medical practice. Directory information could include only the person’s name, location in the institution, and general condition.

a. Importance of directory information and need for protected health information.

When individuals enter inpatient facilities, they are not always able to contact people who may need to know their whereabouts, want to visit them, or want to send them flowers or some other expression of concern. Today, facilities typically operate patient directories, allowing confirmation of a person’s presence in a facility, providing the room number for visits and deliveries, and sometime providing general information on the patient’s condition. These services cannot be performed without disclosing protected health information. Since most patients find this a welcome convenience, we believe it would be important to allow these practices to continue. However, not everyone may appreciate this service. We are proposing to accommodate the wishes of such people, where possible.

b. Proposed requirements.

In § 164.510(h), we would require covered entities to ask individuals whether they wish to be included in the entity’s directory. For individuals who are incapacitated or otherwise unable to communicate their wishes and who have not previously expressed a preference, the decision would be left to the discretion of the covered entity, consistent with good medical practice. We note that legal representatives could make such decisions on behalf of persons who are incapacitated or otherwise unable to communicate their wishes, consistent with State or other law, since they would stand as the "individual." In the absence of a legal representative or prior expression of a preference by the individual, the decision would be left to the discretion of the covered entity, consistent with good medical practice.

i. Individuals capable of making decisions.

For individuals who are not incapacitated, this rule would require the covered entity to ask whether information about the individual’s presence in the facility, room number and general condition can be included in the general patient directory. When individuals are capable of making such a determination, their wishes should be respected.

We considered whether also to require covered entities to allow an individual to specify that information can be provided to specific persons but not others. For example, someone may feel that it is acceptable to release information to family members but not to friends. While we would like to respect individuals’ wishes to the greatest extent possible, we are concerned about placing on covered entities the burden of verifying the identify of a person requesting directory information. We are therefore not including this additional requirement, but are requesting comments on current practices and how such requests might be accommodated.

We would not require a formal individual authorization pursuant to § 164.508. A verbal or other informal inquiry and agreement would be sufficient. We require only that individuals be given the choice.

ii. Incapacitated individuals.

If an individual is not able to make determinations as to whether location or status information should be released to family and friends, and had not in the past expressed a preference in this regard, we would leave the decision as to whether to include the individual in a directory to the discretion of the covered entity. Often individuals are unconscious or otherwise unable due to a medical condition to communicate their wishes to the entity and no representative is available to act for them. In these cases, we encourage the covered entity to take into consideration a number of factors when deciding whether or not to include such an individual in the directory:

• Could disclosing that an individual is in the facility reasonably cause danger of harm to the individual? For example, if a person is unconscious and receiving treatment for injuries resulting from physical abuse from an unknown source, an entity may determine that revealing that the individual is in the facility could give the attacker enough information to seek out the individual and repeat the abuse.

• Could disclosing the location within the facility of the patient give information about the condition of the patient? If a patient’s room number would reveal the nature of the medical condition, the entity may decide that it is inappropriate to give that information. For example, if one floor of a hospital has been specifically designated as the psychiatric floor, simply saying that a patient is located on that floor discloses some information about the condition of the individual.

• Is it necessary or appropriate to give the status of a patient to family or friends? Covered entities often need information from family or friends for the treatment of an incapacitated individual. For example, if a patient is unconscious, family or friends may be able to give valuable information that will assist the care giver in making urgent decisions. Family members or friends may be able to give information on drugs or medications that the individual has been taking. On the other hand, it may be that revealing the status of an individual gives more information than the individual would have disclosed if they could make the determination themselves.

If an individual had, prior to becoming incapacitated, expressed a desire not to be included in such a directory and the covered entity learns of that statement of preference, the covered entity would be required to act in accordance with the stated preference.

Individuals who enter a facility incapacitated and then improve to the point of being able to make their own determinations should be asked within a reasonable time period for permission to include information in the facility’s directory.

When the condition of a individual who has opted not to allow protected health information to be included in the facility’s directory deteriorates, and the individual is no longer capable of making disclosure decisions, the covered entity would be required to abide by the individual’s initial decision. However, such a decision should not prevent a provider from contacting the family if such contact is required for good medical practice. A provider could need information from the family to treat a newly incapacitated person. If good medical practice would include contacting family or friends, the individual’s initial request should not prohibit such contact. But the covered entity would still be prohibited from including information about the individual in its directory.

[Previous] [Next: Disclosure for Banking and Payment Processes]