The following are guidelines suggested by the American Hospital Association that are in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The DCH Health System Communication Department adheres to these guidelines when releasing information on patient conditions.
Guidelines for Releasing Information on the Condition of Patients
Hospitals and health systems are responsible for protecting the privacy and confidentiality of their patients and patient information. HIPAA mandated regulations that govern privacy standards for health care information. HIPAA regulations specify the purposes for which information may and may not be released without authorization from the patient. This revised edition of our guidelines ensures that our suggestions are consistent with the final changes to the HIPAA medical privacy regulations published in August 2002, as well as the guidance document released by the Department of Health and Human Services (HHS) in December 2002. These updated guidelines:
focus on how and when to release patient information to the media
contain advice about releasing information to family members, other hospitals, relief agencies and the media in everyday and disaster situations
Condition and Location of Patients
Inquiries that identify the patient by name
Information about the patient’s general condition and location of an inpatient, outpatient or emergency department patient may be released only if the inquiry specifically identifies the patient by name. No information may be given if a request does not include a specific patient's name or if the patient requests that the information not be released. This includes inquiries from the press.
Release of patient’s general condition and location
As long as the patient has not requested that information be withheld, the patient's one-word condition may be provided to individuals who inquire about the patient by without obtaining prior patient authorization.
For the one-word condition, use the terms “undetermined,” “good,” “fair,” “serious” or “critical.” Definitions of patient conditions are listed below:
Undetermined - Patient is awaiting physician and/or assessment.
Good - Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent.
Fair - Vital signs are stable and within normal limits. Patient is conscious, but may be uncomfortable. Indicators are favorable.
Serious - Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.
Critical - Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable.
Note: The term "stable" should not be used as a condition. Furthermore, this term should not be used in combination with other conditions, which by definition, often indicate a patient is unstable.
Death of Patient
The death of a patient may be reported to the authorities by the hospital, as required by law. Typically, public information about a death will be disclosed after efforts have been made to notify the next-of-kin. Information about the cause of death must come from the patient's physician, and a legal representative of the deceased must approve its release. This means that hospitals cannot share information with the media on the specifics about sudden, violent or accidental deaths, or deaths from natural causes without the permission of the decedent’s next-of-kin or other legal representative.
Question: Can the hospital tell the media the patient has died without getting the family’s permission? In other words, is “deceased” a condition that can be disclosed?
Under the HIPAA privacy rule, if a patient has not asked that his or her information be kept out of the hospital’s directory, the hospital may disclose the patient’s general condition to anyone who asks for the patient by name. HIPAA does not define what constitutes a “general condition.” Disclosing that a patient is deceased, however, appears to be a permissible facility directory disclosure as a statement of the patient’s general condition. A hospital may not disclose information regarding the date, time, or cause of death.
Question: For deceased patients, can the hospital provide the media with the date and time of death, as recorded on the death certificate?
No. The hospital may not disclose a patient’s date or time of death to the media. A hospital may disclose to the media only that information maintained in the hospital directory, which is a patient’s name, location in the hospital and general condition, if the media asks for the patient by name. No other information may be provided without individual authorization. In the case of a deceased patient, authorization must be obtained from a personal representative of the deceased.
The patient's location may be included in the hospital directory to facilitate visits by friends and family as well as the delivery of flowers, cards and gifts. However, as a matter of policy, the patient's location should not routinely be given to the media.
Disclosures of Location to the Media
To safeguard patient privacy, we prohibit disclosure of patient location to the media without patient permission. Furthermore, the hospital prohibits the media from contacting patients directly. Instead, the patient’s public relations or other designated representative should handle interviews and calls. We may deny the media access to a patient if it is determined that the presence of photographers or reporters would aggravate the patient's condition or interfere with patient care.
Patient interviews will not be granted if the patient is in the intensive care unit, or listed in serious or critical condition for the following reasons:
Interviews may disrupt patient's recovery
If a patient is in critical condition, they cannot give consent to an interview
A patient in intensive care or in critical condition is too sick to give interviews
A hospital representative will accompany the media at all times while they are in the hospital. At their discretion, hospitals may deny the media access to any area, including (but not limited to) operating rooms, intensive care units, maternity units, emergency departments, psychiatric departments, nurseries, pediatric units, and substance abuse units where all patients present have an expectation of a certain degree of privacy.
Question: Since hospitals can only use one-word patient condition reports, may a hospital disclose that a patient was treated and released?
Yes. Under the HIPAA privacy rule, a hospital may disclose, to individuals who ask for the patient by name, that a patient was treated and released because this only provides the patient’s general condition (that they were treated at the hospital) and the patient’s location (that the patient is no longer at the hospital). No specific health information is provided. Therefore, assuming the other requirements for disclosures of directory information are met, this appears to be a permissible disclosure of directory information under HIPAA.
Question: If the hospital can say that someone has been “treated and released” without getting permission, may the hospital disclose when the patient was released or to where the patient was released?
No. Although a hospital may disclose that a patient was treated and released as information regarding the patient’s location (or lack thereof) in the hospital, it may not release information regarding the date of release or where the patient went upon release without patient authorization. A hospital may release this information, however, to the patient’s family members or friends involved in the patient’s care, so long as the patient has not opted-out of such disclosures and such information is relevant to the person’s involvement in the patient’s care.
Question: Can the hospital tell the media that the patient has been discharged from an inpatient admission without getting the patient’s permission?
Under the HIPAA privacy rule, if a patient has not asked that his or her information be withheld from the hospital’s directory, the hospital may disclose the patient’s location in the hospital to anyone who asks for the patient by name, without the patient’s authorization. If the patient is no longer at the facility, the hospital may disclose that fact in response to such an inquiry.
Question: Are patients who are also public figures handled differenty?
No. Public officials, public figures or celebrities are not subject to different standards than other patients when it comes to hospital policies for releasing information to the media.
Releasing Patient Information in Disaster Situations
In highly charged situations such as disasters, the public may benefit from the release of general information when specific information cannot be released. For example, a Communication Department representative might say, “the facility is treating four individuals as a result of the tornado.” We may state the number of patients who have been brought to the facility by gender or by age group (adults, children, teenagers, etc.). This type of general information can help reduce undue anxiety.
Current information will be made available to the media as soon as possible. If information is not yet available or if next-of-kin has not been notified, all media inquiries will be logged and callbacks made as soon as it is permissible to release information. A location will be provided for all media to gather so that information can be released in a press conference format that does not compromise patient privacy or the health care facility's need for added security in a disaster situation.
Question: If a hospital has a “John Doe” patient and decides to publicize this person’s hospitalization as a method of finding the patient’s family, would that violate the HIPAA privacy standards?
It is unclear whether this disclosure would be permissible under the HIPAA privacy rule. Although a hospital is permitted to notify a patient’s family about the patient’s location in the hospital and general condition, the rule does not permit notification of the general public. We will not release a photograph of the patient without the patient’s authorization, but may be able to release information describing the patient’s general characteristics (e.g., age, gender, height, weight) that would not be considered protected health information under the privacy rule. We will use professional judgment regarding the best interests of the patient with respect to any such publicity on a case by case basis.