The HIPAA Privacy Rule protects patients' health information by determining who can access it and how it can be used. While exceptions to the confidentiality rule exist, they are commonly buried in dense legal readings and minimized or excluded from HIPAA training.

The Hippocratic Oath captures the default position that our patients can trust us to keep their personal information private: “whatsoever I shall see or hear in the course of my profession … I will never divulge, holding such things to be holy secrets.” Yet the Hippocratic tradition combined with a cursory understanding of HIPAA can create unrealistic expectations about confidentiality for both clinicians and patients.

Physicians face situations every day in which patient information may need to be shared, but they (and their teams) may not understand when the law permits sharing, or even requires it. Although many of the exceptions to confidentiality are likely detailed in the paperwork patients sign as part of their consent to treatment, physicians may have an ethical duty in certain situations to personally educate patients before they disclose information that may be shared.

This article does not provide legal advice, because every situation is unique. Rather, it offers five categories of exceptions to patient confidentiality (discussed and summarized below) so that family physicians have a structured approach for appropriately disclosing information.