Covered entities can use a facility directory to provide basic information about a patient's location and general condition. The Privacy Rule allows them to include the patient's name, location in the facility, non-specific health status, and religious affiliation.
Patient rights under the Facility Directories Regulations and the HIPAA Privacy Rule
According to the HHS, “The Privacy Rule permits a covered hospital or other covered health care provider to maintain in a directory certain information about patients – patient name, location in the facility, health condition expressed in general terms that does not communicate specific medical information about the individual, and religious affiliation.” However, the patient must be informed about the directory information, its potential disclosure, and their right to restrict or refuse it. These preferences must be communicated either orally or in writing.
The facility may provide directory information to anyone who asks for the patient by name except for religious affiliation, which can only be disclosed exclusively among clergy members who have additional access to directory information under the rule.
See also: HIPAA Compliant Email: The Definitive Guide
Is it possible to access directory information in an emergency?
In situations where a patient is unable to give input on the release of information due to emergency treatment or incapacitation, directory details may still be shared at the discretion of the healthcare provider. The information must align with any previous preferences expressed. However, the healthcare provider must promptly notify the patient about this disclosure and present an opportunity for them to indicate their wishes concerning how or whether such data should be released.
Related: What PHI is in a facility directory?
Directory guidelines
- Patient consent: If the patient provides explicit consent for the hospital to share information about their location and general condition, healthcare providers can do so. Patients must express their preferences and identify individuals allowed to receive this information.
- Directory information: Healthcare facilities can maintain a directory of patient names, locations, and general conditions unless the patient objects.
- Emergency situations: HIPAA allows for the release of information without patient consent when it's necessary to prevent a serious and imminent threat to the patient's health or safety. In these emergency situations, healthcare providers may disclose location and general condition information as needed.
- Minimum necessary standard: Regardless of the situation, the Privacy Rule requires healthcare providers to disclose only the minimum necessary information. Healthcare professionals can share the patient's location and general condition without divulging unnecessary details.
FAQs
What is a facility directory under HIPAA?
A facility directory is a list of patient information maintained by a healthcare facility, such as a hospital, to assist in identifying the patient’s location or condition. This directory is primarily used to inform family, friends, clergy, or other individuals who ask about a patient.
Can directory information be disclosed to the media?
Only if the patient has agreed to be included in the directory and the media provides the patient’s name when inquiring. Otherwise, HIPAA prohibits such disclosures.
See also: Can healthcare providers allow media in treatment areas?
What happens if a patient becomes unable to communicate their preferences after admission?
Healthcare providers may rely on their professional judgment to decide whether including or disclosing the patient’s directory information is in their best interest, considering the circumstances.