Category: Uses and Disclosures

Disclosures to Family and Friends

Also known as: Disclosures to Family Members and Friends, PHI Disclosures to Persons Involved in Care

Simply put

Under the HIPAA Privacy Rule, a healthcare provider or health plan may in certain situations share a patient's health information with a family member, relative, or close personal friend who is involved in the patient's care or payment for that care. Generally, only the information directly relevant to that person's involvement is shared. When the patient is present and able to make decisions, the provider typically relies on the patient's agreement, opportunity to object, or reasonable inference that the patient does not object.

Formal definition

A permitted disclosure category under the HIPAA Privacy Rule at 45 CFR 164.510(b) allowing a covered entity to disclose to a family member, relative, close personal friend, or other person identified by the individual, the protected health information (PHI) directly relevant to that person's involvement in the individual's care or payment related to care. Where the individual is present and has capacity, the covered entity may generally make such a disclosure if it obtains the individual's agreement, provides an opportunity to object and the individual does not object, or reasonably infers from the circumstances, using professional judgment, that the individual does not object. Where the individual is not present or is incapacitated or in an emergency, a covered entity may exercise professional judgment to determine whether the disclosure is in the individual's best interests and disclose only PHI directly relevant to the person's involvement. This permission is distinct from a written HIPAA authorization, which is a separate mechanism by which a patient affirmatively authorizes disclosures to named individuals; readers should note the exact conditions, minimum-necessary considerations, and any state-law requirements that may impose additional or stricter limits, and should verify the current regulatory text at 45 CFR 164.510(b).

Why it matters

Disclosures to family and friends are among the most common day-to-day situations covered entities encounter, yet they are also a frequent source of confusion and complaints. Clinical staff routinely field questions from spouses, adult children, and close friends who want to know about a patient's condition, treatment, or discharge plans. Because this permission depends on professional judgment and the specific circumstances of each interaction rather than a single documented consent, staff need a clear understanding of when sharing is permitted and how much may be shared. Misapplying the rule in either direction, refusing to share relevant information with someone genuinely involved in a patient's care, or over-sharing with someone the patient would not want informed, can undermine care coordination or result in an impermissible disclosure.

Who it's relevant to

Privacy Officers

Privacy officers are responsible for developing policies and training that help clinical and administrative staff apply the 164.510(b) permission correctly. Because this category relies heavily on professional judgment rather than documented consent, clear internal guidance on when to share, how to gauge patient objection, and how much information is directly relevant is important. Privacy officers should also account for any state-law provisions that may impose stricter limits than HIPAA.

Clinical and Frontline Staff

Physicians, nurses, and other frontline staff are the ones who typically apply this permission in real time, deciding whether a patient present in the room agrees to a family member hearing an update, or exercising professional judgment when a patient is incapacitated. Understanding that only PHI directly relevant to the person's involvement may be shared, and that this is distinct from a signed authorization, helps staff avoid both under-sharing and over-sharing.

Health Plans

The permission at 45 CFR 164.510(b) applies to health plans as well as providers, allowing disclosure to family members or friends of information directly relevant to their involvement in the individual's care or payment for care. Plan staff handling member inquiries should understand when a caller involved in payment or care may receive relevant information versus when a written authorization is more appropriate.

Patients and Their Families

Patients benefit from understanding that they can indicate who may be informed about their care, and that providers may share relevant information with those involved unless the patient objects. Families and close friends involved in a patient's care should understand that the information shared is generally limited to what is directly relevant to their involvement, and that a written HIPAA authorization is available when broader or more formal access is desired.

Inside Disclosures to Family and Friends

Permissive Disclosure Under the Privacy Rule

Disclosures to family, friends, or others involved in a patient's care are governed by the HIPAA Privacy Rule, which generally permits (but does not require) a covered entity to share PHI relevant to that person's involvement in the individual's care or payment for care. Because this is a Privacy Rule provision, it applies to PHI in all forms, not only ePHI.

Relevance Limitation

The information shared is generally limited to PHI that is directly relevant to the family member's or friend's involvement in the patient's care or payment for that care, rather than an unrestricted release of the entire record.

Patient Present and Able to Agree

When the patient is present and has the capacity to make health care decisions, a covered entity may typically disclose to those involved in care if the patient agrees, does not object when given the opportunity, or the provider reasonably infers from the circumstances that the patient does not object.

Patient Not Present or Incapacitated

If the patient is not present, is incapacitated, or an emergency exists, a covered entity may use professional judgment to determine whether the disclosure is in the patient's best interest, sharing only PHI relevant to the person's involvement in care.

Involvement in Care vs. Notification

The provision generally covers both persons involved in the patient's care or payment and, in some cases, disclosures to notify or assist in notifying a family member or other person responsible for the patient of the individual's location, general condition, or death.

Right to Object and Restrict

Patients retain the ability to object to such disclosures, and covered entities must honor a patient's expressed preferences where required. Patients may also request restrictions on disclosures, which interact with these permissive provisions.

Common questions

Answers to the questions practitioners most commonly ask about Disclosures to Family and Friends.

Does HIPAA prohibit sharing a patient's health information with their family members?

No. This is a common misconception. The HIPAA Privacy Rule generally permits a covered entity to disclose PHI to family members, relatives, close personal friends, or others identified by the patient, provided the information disclosed is directly relevant to that person's involvement in the patient's care or payment for care. HIPAA is not a blanket prohibition on family communication; it establishes conditions under which such disclosures are permitted. Note that state law or facility policy may impose additional restrictions beyond HIPAA, so you should verify against applicable requirements.

Do you always need the patient's written authorization before talking to a family member about their care?

Not in most cases. Another common misconception is that written authorization is required for any disclosure to family or friends. Under the Privacy Rule, these disclosures generally may be made based on the patient's agreement, or by giving the patient an opportunity to object, or by reasonably inferring from the circumstances (using professional judgment) that the patient does not object. A separate written authorization is typically not required for this category of disclosure. Written authorization is generally reserved for other categories of use and disclosure. Confirm the specific requirements against the current regulatory text.

How should staff handle disclosures when the patient is present and able to make decisions?

When the patient is present and has the capacity to make health care decisions, the covered entity should generally obtain the patient's agreement, give the patient an opportunity to object, or reasonably infer from the circumstances that the patient does not object before disclosing relevant PHI to family or friends. For example, if a patient brings a friend into the exam room and raises a health matter in front of them, it may be reasonable to infer the patient does not object. Professional judgment applies, and staff should document their approach consistent with facility policy.

What can be disclosed when the patient is incapacitated or not present?

When the patient is not present or is incapacitated or in an emergency, a covered entity may, in the exercise of professional judgment, determine whether disclosure is in the patient's best interest and disclose only the PHI that is directly relevant to the person's involvement in the patient's care or payment. This is a judgment-based standard rather than an automatic entitlement, and the disclosure should generally be limited to what is relevant to that individual's involvement. Facilities should train staff on how to apply this standard and document decisions where appropriate.

How much information can be shared with a family member or friend under these provisions?

Disclosures in this category are generally limited to the PHI that is directly relevant to the person's involvement in the patient's care or payment for that care. This reflects the Privacy Rule's minimum necessary orientation for many uses and disclosures, though certain disclosures have specific standards. The provision does not authorize sharing a patient's complete record with anyone who asks; it is scoped to relevant information tied to that person's involvement. Staff should confirm the scope against current regulatory guidance and facility policy.

Can a covered entity refuse to share information with family even when disclosure would be permitted?

Yes. The Privacy Rule generally permits these disclosures but does not require them, so a covered entity may decline to share information based on professional judgment, patient objection, or applicable policy. In addition, a patient may object to disclosures to particular individuals, and the covered entity should honor a clearly expressed objection where practicable. Because state law, facility policy, and other frameworks may impose stricter limits, staff should follow organizational procedures and verify against current requirements when in doubt.

Common misconceptions

HIPAA prohibits providers from ever discussing a patient's condition with family members.

HIPAA generally permits, and does not prohibit, sharing relevant PHI with family or friends involved in the patient's care when the patient agrees, does not object, or the provider reasonably infers no objection, and in certain situations when the patient is incapacitated or absent. It is a permissive framework, not a blanket prohibition.

A signed HIPAA authorization form is always required before speaking with a patient's family.

In most cases involving persons directly involved in the patient's care, a formal written authorization is not required. The Privacy Rule allows disclosure based on the patient's agreement, lack of objection, reasonable inference, or professional judgment when the patient cannot agree. Written authorization is a separate mechanism used in other situations.

Once disclosure to family is allowed, the provider may share the patient's entire medical record.

The permission is generally limited to PHI relevant to that person's involvement in the patient's care or payment for care. It is not authorization for a full, unrestricted release of the record.

Best practices

Before disclosing, determine whether the person qualifies as someone involved in the patient's care or payment, and limit the information shared to what is relevant to that involvement.

When the patient is present and has decision-making capacity, obtain agreement, offer a clear opportunity to object, or document the reasonable basis for inferring the patient does not object.

When the patient is incapacitated, absent, or an emergency exists, document the professional judgment used to conclude the disclosure is in the patient's best interest.

Honor and record any patient-expressed objections or requested restrictions on disclosures to specific individuals.

Train staff to recognize that this is a Privacy Rule provision applying to PHI in all forms, and that permissive disclosure does not mean unlimited disclosure of the full record.

Verify current requirements against the applicable regulatory text, and check whether state law, the HITECH Act, or organizational policy imposes additional or more stringent requirements before relying on these permissions.