Home Health & Hospice Week

Not sure what all counts as protected health information (PHI) for HIPAA purposes? OCR can clear that up when it comes to family history data.

The HHS Office for Civil Rights says that a patient’s family medical history becomes PHI once it’s a part of the medical record. “When a covered health care provider, in the course of treating an individual, collects or otherwise obtains an individual’s family medical history, this information becomes part of the individual’s medical record and is treated as ‘protected health information’ about the individual,” OCR says.

Crucial: Even if a family member is mentioned in a patient’s medical history, the patient — not the family member mentioned — retains the control over who the information can be shared with.

“Thus, the individual (and not the family members included in the medical history) may exercise the rights under the HIPAA Privacy Rule to this information in the same fashion as any other information in the medical record, including the right of access, amendment, and the ability to authorize disclosure to others,” OCR says.

Remember: A covered healthcare provider may also share a family member’s PHI with another provider in the course of caring for a patient. “For example, an individual’s doctor can provide information to the doctor of the individual’s family member about the individual’s adverse reactions to anesthetics prior to the family member undergoing surgery,” OCR reminds. You can use and disclose this type of PHI without written authorization or other agreement.

Psychotherapy notes are the only exception and require written authorization from the individual.