Hospitals generally cannot release patient information without explicit patient authorization. The legal framework:
HIPAA Privacy Rule (45 CFR 164)
- Covered entities (hospitals, providers, health plans) must protect PHI (Protected Health Information).
- Disclosures require written authorization unless a specific exception applies.
Key Exceptions (No Authorization Required)
- Treatment, Payment, Healthcare Operations (TPO) – Sharing among treating providers, billing, quality improvement.
- Public health reporting – Notifiable diseases, vital statistics, FDA safety events.
- Law enforcement – Limited circumstances: court order, warrant, subpoena, imminent threat, victim identification.
- Health oversight – Audits, investigations, licensure surveys.
- Judicial/administrative proceedings – Court order or subpoena with safeguards.
- Decedents – To coroners, medical examiners, funeral directors.
- Organ donation – To procurement organizations.
Patient Rights
- Access own records (copy, electronic, summary).
- Request amendment.
- Accounting of disclosures.
- Restrict certain disclosures (right to request; not absolute).
- File complaint with HHS OCR.
Family members have no automatic right to information—only with patient consent or as a legally authorized representative.
