Facility directories and HIPAA

Covered entities are allowed to use a facility directory to provide basic information about a patient's location and general condition. The Privacy Rule allows them to include the patient's name, location in the facility, non-specific health status, and religious affiliation.

Patient rights under the Facility Directories Regulations and the HIPAA Privacy Rule

The patient should be notified about the directory information, its disclosure, and the option to limit or decline it. The patient must be informed and make their preferences known, orally or in writing. The facility may provide directory information to anyone who asks for the patient by name except for religious affiliation, which can only be disclosed exclusively among clergy members who have additional access to directory information under the rule.

See also: HIPAA Compliant Email: The Definitive Guide

Is it possible to access directory information in an emergency?

In situations where a patient is unable to give input on the release of information due to emergency treatment or incapacitation, directory details may still be shared at the discretion of the healthcare provider. The information must align with any previous preferences expressed. However, the healthcare provider must promptly notify the patient about this disclosure and present an opportunity for them to indicate their wishes concerning how or whether such data should be released.

Related: What PHI is in a facility directory? 

Directory guidelines

• Patient consent: If the patient provides explicit consent for the hospital to share information about their location and general condition, healthcare providers can do so. Patients must express their preferences and identify individuals allowed to receive this information.
• Directory information: Healthcare facilities can maintain a directory of patient names, locations, and general conditions unless the patient objects.
• Emergency situations: HIPAA allows for the release of information without patient consent when it's necessary to prevent a serious and imminent threat to the patient's health or safety. In these emergency situations, healthcare providers may disclose location and general condition information as needed.
• Minimum necessary standard: Regardless of the situation, the Privacy Rule requires healthcare providers to disclose only the minimum necessary information. Healthcare professionals can share the patient's location and general condition without divulging unnecessary details.