View Rule

The proposed rule would modify the HIPAA Privacy Rule to clarify that healthcare providers are presumed to be acting in the individual's best interests when they share information with an incapacitated patient's family members unless there is evidence that a provider was acted in bad faith.

Statement of Need:

HIPAA allows medical professionals to share protected health information with an individual's loved ones in emergency or dangerous situations but misunderstandings to the contrary persist and create obstacles to family support that is crucial to the proper care, treatment, and recovery of people experiencing a crisis situation. Therefore, the Department, through the Office for Civil Rights (OCR) intends to propose regulatory changes to the HIPAA Privacy Rule to clarify that healthcare providers are presumed to be acting in the individual's best interests when they share information with an incapacitated patient's family members, unless there is evidence that a provider acted in bad faith.  OCR by delegation from the Secretary, has broad authority under HIPAA to make modifications to the Privacy Rule, as provided by section 264 of HIPAA (codified at 42 U.S.C. and 1320d-2(note)).

Summary of the Legal Basis:

OCR has broad authority under the HIPAA statute to make modifications to the Privacy Rule, within the statutory constraints of the HITECH Act and other applicable law (e.g., the Administrative Procedures Act).

Alternatives:

The alternative is to not issue a proposed rule.

Anticipated Costs and Benefits:

The proposed rule will not create any new requirements or costs for regulated entities or the public. It will provide assurances to health care providers about their ability to make disclosures that are in the best interests of patients.

Risks:

OCR has not identified any risks associated with this proposal. OCR currently defers to a healthcare provider's professional judgment in these circumstances and has never taken enforcement action against a healthcare provider who shared information in good faith, thus, the proposed regulatory change will not decrease the privacy protections for individuals' protected health information, or significantly alter HIPAA enforcement policy.