The HIPAA Privacy Rule protects patients' health information by determining who can access it and how it can be used. While exceptions to the confidentiality rule exist, they are commonly buried in dense legal readings and minimized or excluded from HIPAA training.

The Hippocratic Oath captures the default position that our patients can trust us to keep their personal information private: “whatsoever I shall see or hear in the course of my profession … I will never divulge, holding such things to be holy secrets.” Yet the Hippocratic tradition combined with a cursory understanding of HIPAA can create unrealistic expectations about confidentiality for both clinicians and patients.

Physicians face situations every day in which patient information may need to be shared, but they (and their teams) may not understand when the law permits sharing, or even requires it. Although many of the exceptions to confidentiality are likely detailed in the paperwork patients sign as part of their consent to treatment, physicians may have an ethical duty in certain situations to personally educate patients before they disclose information that may be shared.

This article does not provide legal advice, because every situation is unique. Rather, it offers five categories of exceptions to patient confidentiality (discussed and summarized below) so that family physicians have a structured approach for appropriately disclosing information.

PUBLIC HEALTH RISKS AND MANDATORY REPORTS

Statutory laws require the disclosure of patient information in the interest of protecting public health and vulnerable populations.

Infectious and other diseases. Specific infectious diseases, bioterrorism agents, foodborne outbreaks, and certain non-infectious diseases (e.g., lead poisoning 5 μg/dL or greater) can all pose public health risks and must be reported to state health officials.^1,2 State health departments determine these standards and can implement additional guidelines outlined by the Centers for Disease Control and Prevention (CDC) for contact tracing and disease surveillance.² (See an example of one state's reportable infections.)

Suspected abuse of vulnerable populations. All 50 states require clinicians to report suspicion of child abuse or neglect to state authorities.³ Most states also require clinicians to submit vulnerable adult reports to state officials.³ For state-specific information, view the American Bar Association's summary of “Adult Protective Services Reporting Laws” or visit your state's child or adult protective services website.

DECISION-MAKER REQUIRED

When patients cannot make medical decisions on their own behalf, physicians may disclose patient information to a substitute decision-maker.⁴

Pediatric exceptions. Generally, patients under 18 are considered minors, although this can vary by state.⁵ Under HIPAA, parents or guardians of minors are considered their “personal representatives”⁶ and have the right to make decisions on their behalf and access their health care information. But HIPAA also includes some protections for minors and gives deference to stateor other laws. Exceptions under HIPAA include instances when pediatric patients seek confidential services (e.g., family planning services or mental health treatment),⁵ are designated as legal adults due to emancipation,⁶ or have a parent who may pose a danger to them.⁶ (See the table.) Conversely, clinicians may use their professional judgment to disclose confidential information to parents when they feel it is necessary for the health or safety of the child, such as if the patient may be a threat to self. Because pediatric disclosure policies vary by state^7–8 and are often case-specific, a thorough exploration of pediatric confidentiality exceeds the scope of this article.

Substitute judgment due to an adult patient's lack of capacity. Informed consent requires full disclosure, capacity, and voluntariness. When the “capacity” element is missing, the patient may require a surrogate decision-maker. Capacity means the patient understands and appreciates the risks and benefits of an intervention to the level of the community standard and can therefore make decisions about their own care.⁹ This standard is determined by what clinicians generally accept as sufficient in similar circumstances. In order for the surrogate to determine what the patient would have wanted, clinicians must disclose the relevant health information. This is not a blanket disclosure but a limited disclosure of only the necessary information.

THIRD-PARTY INTERESTS

When a clinician sees a patient on behalf of a third party (e.g., U.S. Department of Transportation), the clinician may disclose a patient's health information to that party. These cases are unique in that clinicians serve an additional interest beyond the patient's best interest. To fulfill their responsibility to the third party, clinicians often must complete certain requirements or fulfill specific requests, including disclosing patients' health information limited to legitimate interests.

Department of Transportation (DOT). Under federal DOT regulations, medical assessments for commercial vehicle drivers must be performed by Certified Medical Examiners who report to the Federal Motor Carrier Safety Administration.¹⁰ Additionally, drug and alcohol testing may be performed by Certified Medical Review Officers¹¹ who report to the employer and DOT if drivers “likely pose a significant safety risk” when performing their responsibilities.^12–13 Such disclosures do not require patient consent.¹² A similar arrangement exists for the Federal Aviation Administration.

Workers' compensation. Subject to state and local laws, HIPAA allows clinicians to disclose patient information to employers, workers' compensation insurers, or other authorized third parties in evaluations of workplace injuries.¹⁴ Unlike DOT evaluations, workers' compensation evaluations do not typically involve clinicians being retained by a third party and require no special certification. As such, workers' compensation evaluations are usually done in the course of regular clinical practice. Clinicians should carefully negotiate the agenda with patients at the outset of visits involving workers' compensation evaluations to ensure that they discuss only health information germane to the work-related injury.

Sports team physicians. Physicians often serve as volunteers in the locker room or on the sidelines for high school and college sports teams. Whether compensated or uncompensated, volunteers covering amateur sports should make it clear to players that, as the “team physician,” they are primarily responsible to the team. Team physicians are expected, but not legally bound, to disclose to the coaching staff information relevant to a player's ability to safely and effectively participate (e.g., concussion history). Notably, team physicians can keep confidential all health information not relevant to a player's ability to play (e.g., mental health history). The legal standard is different for physicians who treat professional athletes. When a team physician provides medical services to a paid professional athlete at the request of the athlete's employer (e.g., their team), the information the clinician obtains is legally categorized as an employment record, rather than patient information, and HIPAA does not apply.^15,16

Immigration physicals. Medical examinations required as part of the immigration process must be conducted by a clinician certified as a “civil surgeon” by the Department of Homeland Security (DHS).¹⁷ To become a civil surgeon, clinicians must have a medical degree (MD or DO), a current medical license, and at least four years of clinical practice experience following an accredited residency. During immigration physicals, civil surgeons are legally required to follow the examination guidelines outlined by DHS, refer patients elsewhere for any health-related needs beyond the scope of the exam, and fully disclose all information obtained in the visit to DHS.^18–19 In turn, DHS may share patient information with authorized government or law enforcement personnel.¹⁹

Government functions, including military exams and correctional facility care. Clinicians performing medical examinations for active military members must disclose patient information about medical suitability for military employment or for activities their command deems necessary for the execution of specific military functions or missions.¹⁴ Clinicians providing medical care to an incarcerated person may disclose patient information to the correctional facility or designated law enforcement official if necessary for the patient's health and safety or for coordinating care at the facility. Clinicians may also disclose patient information without patient consent if necessary to protect the safety of staff or others at the correctional facility.¹⁴

ADMINISTRATIVE AND OPERATIONAL DISCLOSURES

Practices may disclose patient information without the patient's knowledge or consent for several other common administrative and operational reasons. Some of these are exceptions to confidentiality, while others are simply instances that may surprise patients.

Insurance (including Medicare and Medicaid). HIPAA permits disclosure of patient information for payment and insurance policy processes.^6,20 This includes notifying insurance companies to assess coverage options and coordinating with internal billing departments. If a patient is not the insurance policyholder, the policyholder may receive a bill and an explanation of benefits (EOB), which includes protected health information such as a description of the health care services provided, and HIPAA permits this even in the absence of specific authorization from the patient.²¹ Additionally, Medicare and Medicaid may exchange patient information to identify candidates that qualify for both programs.²²

Regulatory agencies. The Occupational Health and Safety Administration (OSHA), the Joint Commission on Accreditation of Hospitals (JCAHO), and other regulatory agencies can have access to patients' information during investigations, audits, and accreditation procedures.^6,14

Members of the health care team. HIPAA permits sharing information with other clinicians and staff, even outside your organization, for purposes of coordinating care (e.g., lab work or referrals).^6,20 This permission applies only to individuals involved with a specific patient's care. Some states have more restrictive laws requiring patient consent. Such consent is typically obtained upon initial registration via a general consent form. However, because clinics cannot practically confirm who is a member of the patient's care team, it is common to have patients to sign specific releases of information (ROI) when clinicians share information with anyone outside of what a reasonable patient would expect.

Family Educational Rights and Privacy Act (FERPA). FERPA applies to all federally funded schools and serves to protect the privacy of student information, including student health information.²³ Like the above HIPAA exception for members of the health care team, FERPA allows patients' health care teams and FERPA-covered health care professionals (e.g., school nurses) to share patients' health information for the purposes of coordinating care.²³

Family member and caregiver allowances. HIPAA specifically permits some activities that share necessary information under the umbrella of “common practices in patients' best interests,”⁴ such as caregivers picking up filled prescriptions, medical supplies, x-rays, or other health-related items. Pharmacists regularly dispense medications to family members or caregivers under the presumption of patient consent.²⁴

Research and quality improvement. A detailed examination of patient information disclosure in research and quality activities exceeds the scope of this paper. However, patients and clinicians should be aware that their health information may be disclosed for research purposes as federally regulated and subsequently adjudicated by the Institutional Review Board.¹⁴ HIPAA also allows patients' health information to be shared with internal and external parties for quality improvement analyses.^6,20

Health care professional exposures. Under the Ryan White HIV/AIDS Treatment Extension Act of 2009, health care employees involved in the emergent care of an individual must be notified of exposures to potentially life-threatening infectious diseases.²⁵ In 2020, this law was expanded to include COVID-19.²⁵

Disaster relief efforts. Patient information may be shared between disaster relief organizations and covered entities (e.g., FEMA — the Federal Emergency Management Agency) for the purposes of assisting in disaster relief efforts, such as coordinating care or reporting.⁴

Death. HIPAA applies to a patient's information for 50 years post-death.⁶ However, clinicians may share patient information with coroners, medical examiners, funeral directors, law enforcement (if foul play is suspected), and public health officials (for infectious disease and vital event monitoring).¹⁴ Additionally, patient information may be shared with and monitored by organ procurement organizations and other entities involved in an organ donation and transplantation process.¹⁴

Unintentional disclosures. Clinicians must take reasonable precautions to avoid unintentional disclosures of patient information. This includes not discussing patient information in shared settings, such as elevators, hallways, or social gatherings. As mentioned previously, other health care providers within your organization are not automatically part of a patient's health care team and should not be privy to extraneous patient information. Although clinicians and health care entities must reasonably ensure compliance with HIPAA, unintentional disclosures can happen. Databases can be hacked, documents can be shared with the wrong clinician, one patient's information can be mixed up with another's, and people can overhear conversations even when reasonable efforts are made to maintain confidentiality. Patients must be notified of such disclosures if they meet HIPAA's definition of a breach.²⁶ However, breaches exclude unintentional disclosures of protected health information by a health care worker acting in good faith when the information is not further used or disclosed.²⁶

RARE BUT IMPORTANT EXCEPTIONS

Once in a career, a clinician may encounter a confidentiality exception requiring urgent attention. Knowing when and what to disclose before these situations arise can be helpful.

Duty to warn/protect. The 1976 Tarasoff case in California set a national precedent through case law. The case established that psychologists have a duty to warn individuals about potentially imminent danger, but it is generally accepted that this duty applies to clinicians more broadly. HIPAA permits clinicians to disclose patient information to prevent imminent danger to others.^14,27 Some states require disclosing imminent dangers posed to potential victims, while other states permit (but do not require) such reporting, and a few states declare no duty on behalf of a clinician to warn others. For state-specific information, see the National Conference of the State Legislatures' map. A more common occurrence of upholding the safety of others involves reporting at-risk drivers. (For more on this, see “Safe Driving for Patients With Dementia: Tips for Better Discussions at Every Stage.”) In some states, physicians are mandated to report at-risk drivers to motor vehicle authorities, whereas other states permit (but do not require) the disclosure of such information.²⁸

Court orders. Although uncommon, clinicians may share specific patient information as outlined in a court order if authorized by court or administrative tribunal authorities.¹⁴ Given the infrequency and unique nature of responding to a court order, physicians should consult their administrative colleagues, legal teams, or malpractice carriers in such situations.

KEEPING PATIENTS INFORMED

Maintaining patient confidentiality is a cornerstone of effective clinical care. We should strive to never surprise our patients with an unwanted disclosure of their information, although this is not always feasible. Up-front communication about expectations and exceptions to confidentiality can strengthen patients' trust in our ability to keep their secrets. Becoming comfortable with common exceptions can strengthen our ability to recognize them at the point of care and identify when it would be wise to clearly document our justification for disclosure and inform patients.