In 1996, Congress passed a law that provides guidelines for the privacy and security of certain health information. Formally called the Health Insurance Portability and Accountability Act of 1996, it is better known as HIPAA. While HIPAA helps protect patients’ private and sensitive information, it can also sometimes be a barrier to family caregivers being aware of information they need to know.

As our aging population increasingly relies on family caregivers, it is important to understand how to appropriately share information with those caregivers. A recent study showed that many family caregivers accompany their loved ones to medical appointments, and most report generally positive interactions with clinicians. But 29% report occasions when clinicians were not willing to share patient information with them. Clinicians should understand the HIPAA rules and guidelines, and be sure that they make every effort to speak to the older patient alone to assess their wishes, and then integrate family caregivers into important medical discussions and share information when appropriate.

HIPAA has clear rules stating that irrelevant medical and other sensitive information should not be shared with family caregivers. For example, information about a history of falls and guidance on how to avoid them would generally be relevant and appropriate to share. On the other hand, a previous syphilis diagnosis should not be shared with a caregiver of a patient being treated for a broken hip (though it could be shared if the caregiver is the patient’s legal guardian or if the patient authorizes it).

Many cases are simple and straightforward. Others require clinicians to exercise professional judgment. It is important to recognize that what seems straightforward to the provider may not be so for the patient. For example, using the scenario above, a patient may not want to disclose a history of falls to a caregiver because of the fear that it may lead to nursing home placement. Importantly, older adults frequently experience communication barriers in a busy clinical setting (due to hearing impairments, health literacy issues, or mild cognitive impairment, for example) limiting their meaningful participation, and thus clinicians are strongly encouraged to carefully elicit patient preferences regarding shared information.

Straightforward Cases

A. Patient Permission Can Be Obtained

If a patient is awake, alert, and capable of consenting, and the patient consents to have a clinician share medical information with a caregiver, either immediately or in the future, the clinician should share the information. This permission may be explicitly granted when a patient specifically requests or agrees to information sharing.

In addition to explicit consent, HIPAA rules allow clinicians to assume tacit permission for the information to be shared if the patient is capable of consenting and does not object to disclosure when given an opportunity to object in a private discussion as discussed above (i.e., when the caregiver is not present). If the patient does not object, the clinician can go ahead and discuss the information in the caregiver’s presence.

Explicit consent, however, is the best way to assure that the patient’s information is appropriately protected. If a clinician has any suspicion that a patient may not be comfortable sharing the information but may not want to say so in front of the caregiver, the clinician should make every possible effort to ask the patient in private.

B. Caregivers With Legal Rights to Information

Unless clinicians fear abuse, neglect, or endangerment, they must share relevant information when the caregiver has a legal right to it. For example, if the patient has a guardian, the guardian has a legal right to all information sharing to the same degree as the patient.

Some legal rights to information are more limited. If instead of guardianship, the patient has given a power of attorney to an adult child, only information related to the topic of the power of attorney must be shared. The power of attorney for health care, in general, does not go into effect unless and until the patient is incapacitated. But, the caregiver may still be eligible for information sharing through patient permission or the clinician’s professional judgment, even if the patient is not incapacitated.

For example, if the power of attorney only covers deciding on the use of a feeding tube at end-of-life, that power of attorney does not require sharing of information related to a broken wrist. In cases where the right to information is based on a legal claim such as a power of attorney or guardianship, clinicians should verify that person is who they say they are, and have the authority they claim to have. State laws will determine what documents can serve as proof.

Cases Requiring Professional Judgment

Not every situation is so straightforward. Sometimes, HIPAA requires or allows clinicians to use their professional judgment to decide what information, if any, to share.

A. Concern About Abuse, Neglect, or Endangerment

If the clinician, using professional judgment, fears abuse, neglect, or endangerment that would make sharing information not in the best interest of the patient, the clinician can opt not to disclose information, even if the disclosure would be otherwise legally required. Warning signs of abuse can include unexplained injuries, delay in seeking treatment, missed appointments, caregivers refusing to allow the clinicians to see the older adult alone, or threatening, belittling, or controlling behavior from the caregiver. Another edition of Elder Care outlines warning signs of elder abuse.

B. The Patient is Unconscious

If a patient is unconscious or otherwise incapacitated, clinicians should use professional judgment to determine if sharing information with caregivers is in the patient’s best interests. For example, a nurse may determine that it is appropriate to share information with the sister of a patient who is unconscious in the emergency department after a stroke.

C. The Patient is Not Present

If the patient is not present and has not otherwise given explicit permission about what information should be shared, the clinician should use professional judgment to determine if sharing information is in the best interest of the patient. For example, a physician may provide medical records to a patient’s adult child so the records will be available for a visit with a consultant the patient will be seeing.

D. Other Circumstances

Clinicians may also determine that information sharing is in the best interest of the patient in other circumstances when the clinician reasonably determines, based on the circumstances and using professional judgment, that the patient would not object to the information sharing. There may also be times when clinicians might feel sharing information with family members is important, and might encourage a patient to allow sharing even if a patient doesn’t initially request such sharing. Note that in all of these situations, it is important to recognize that clinicians must make a judgment call about whether they should share information. It is not a HIPAA requirement that they share the information.

State Laws

This edition of Elder Care focuses on the federal HIPAA law and is not state-specific. States may have additional laws or regulations that affect privacy and information sharing, and professional rules of ethics and conduct may also apply. When questions arise, clinicians should consult an attorney and/or their professional association’s guidelines for additional guidance.