On Jan. 13, 2009, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released another in its series of Frequently Asked Questions (FAQ) regarding the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. Entitled “Frequently Asked Questions About Family Medical History Information,” the FAQ details in three questions the application of the HIPAA privacy rule to information regarding family medical history provided by a patient or other family member.
The first question asks whether the HIPAA privacy rule can limit an individual’s ability to gather and share family medical history information. The OCR answers that individuals and their family members may gather such information and share it with health care providers and others.
The second question involves the extent to which a health care provider can use or disclose information concerning family medical history under the HIPAA privacy rule. Specifically family medical history disclosed to a health care provider by a patient or the patient’s family, becomes part of the patient’ medical record and thus is treated as protected health information (PHI) under the HIPAA privacy rule. As a result, the patient (and not the family members included in the family history) may exercise the rights afforded individuals under the HIPAA privacy rule. The patient’s health care provider may use or disclose PHI, including family history information, for treatment, payment and health care operation purposes without obtaining the patient’s authorization.
The final question asks whether an individual’s health care provider may disclose PHI to another provider, when such information is requested for the treatment of an individual’s family member. Under the HIPAA privacy rule, the provider may, but is not under any obligation to, provide such information to another provider for the treatment of a family member. The HIPAA privacy rule also provides individuals with the right to request additional restrictions on the use or disclosure of PHI for treatment, payment or health care operations purposes. Thus, the individual patient may request that the provider not use or disclose the family history information to the other provider. The provider may, but is not obligated to, agree to the additional restriction, in which case, absent an emergency, the provider is bound not to provide the information to the other provider.
Read the FAQ