HIPAA Compliance Requirements for Living Kidney Donor Programs

Living kidney donor programs handle sensitive information about two people whose medical decisions and interests may differ: the donor and the transplant candidate. The HIPAA Privacy Rule governs how covered health care providers and their business associates use and disclose protected health information (PHI); transplant programs must also follow applicable Organ Procurement and Transplantation Network (OPTN) requirements and their own policies.

The practical starting point is to keep donor and recipient information confidential by default, share it only for a permitted purpose, and obtain a valid HIPAA authorization when HIPAA requires one. HIPAA is a federal baseline; other laws or hospital policies may provide additional protections.

Which living donor health information is protected under HIPAA?

Information is generally PHI when it identifies a person, or could reasonably be used to identify them, and relates to their past, present, or future health, health care, or payment for health care. The protection applies to information held or transmitted by a covered entity or its business associate in electronic, paper, or oral form. See the HHS summary of the HIPAA Privacy Rule.

For a potential kidney donor, protected information can include referral details, medical and psychosocial evaluation notes, laboratory and imaging results, diagnoses, appointment records, and follow-up information. Recipient records are protected separately. A person’s connection to a donor or recipient does not, by itself, give them access to that person’s health information.

HIPAA applies to covered entities and business associates, not automatically to every person or organization that encounters health information. However, transplant programs should treat identifiable donor and recipient information handled in their clinical operations as confidential and follow applicable privacy, security, and OPTN requirements.

When is authorization required to share donor or recipient information?

A covered entity generally needs a valid HIPAA authorization to disclose PHI when the disclosure is not otherwise permitted or required by the Privacy Rule. A general statement of consent is not necessarily enough: an authorization must meet HIPAA’s content requirements and describe the information, purpose, recipient, and expiration or expiration event. HHS explains the distinction in its guidance on consent and authorization.

As a practical rule, a transplant hospital should not give a recipient candidate a potential donor’s test results or other identifiable medical information without the donor’s permission, unless a specific legal basis permits or requires that disclosure. HRSA’s Living Donation FAQs explain that donor medical information and test results are confidential and cannot be shared with the candidate without permission.

HIPAA permits covered providers to exchange PHI with other health care providers for treatment without authorization. That exception is not a general license to share one person’s records with another person: the recipient must be an appropriate provider, and the disclosure must be for treatment. The HHS authorization guidance describes the treatment exception. If a program plans to exchange identifiable information directly between a donor and recipient, it should obtain a valid authorization from the person whose information will be disclosed and define what may be shared.

An authorization can be limited to selected information rather than an entire record. A donor and recipient may each choose whether to authorize sharing and may set different preferences. HIPAA authorizations can generally be revoked in writing, although revocation does not undo disclosures already made in reliance on the authorization. See HHS guidance on authorizations and revocation.

How can donors withdraw confidentially from evaluation or donation?

A potential donor may stop the evaluation or donation process at any time before surgery. OPTN Policy 14.3 requires the recovery hospital to provide an opportunity to discontinue the consent or evaluation process in a way that is protected and confidential. The policy also requires donors to be told they may decline donation. See OPTN Policy 14, Living Donation.

Programs should give donors a private way to contact the donor team or Independent Living Donor Advocate (ILDA), without having to explain their decision to the recipient. The program can use a neutral explanation—such as saying the donor is not able to proceed—without disclosing the donor’s reason, if consistent with the donor’s wishes and applicable law. HRSA’s informed-consent guidance says a donor’s decision not to proceed should not be disclosed without the donor’s prior consent.

Confidential withdrawal is not a promise that every fact can remain undisclosed in every circumstance. For example, some health conditions may have to be reported to public health authorities under applicable law. Programs should explain these limits during informed consent, avoid unnecessary disclosure to the recipient, and document the donor’s communication preferences. Withdrawing from evaluation and revoking a separate HIPAA authorization are distinct actions; staff should help the donor address each if needed.

How should separate donor and recipient teams manage information?

Separate donor and recipient teams help protect each person’s privacy and keep the donor’s evaluation focused on the donor’s welfare. Programs should make clear which team is responsible for each person, route donor questions and results through the donor team, and avoid giving recipient-team members access to donor records unless their role and a permitted purpose justify it.

OPTN policy requires an ILDA to advocate for the donor and sets requirements for that role. An ILDA is not a substitute for privacy controls, and the donor’s advocate should not disclose donor information to the recipient team without an appropriate basis. See OPTN Policy 14.2.

For electronic records, programs can use role-based access control, unique user accounts, access reviews, and audit logs to align access with job duties. The HIPAA Security Rule requires access controls for electronic PHI; HHS notes that role-based access is one possible approach and that unique user identification helps track access. See HHS’s summary of the Security Rule and its guidance on unique user identification.

When information must be used or disclosed for a purpose subject to the minimum necessary standard, the program should limit it to what is reasonably needed and define access according to workforce roles. The standard does not apply to provider-to-provider disclosures for treatment or disclosures made under a valid individual authorization. See HHS guidance on the minimum necessary standard.

What safeguards apply to information shared between donors and recipients?

When both parties want to exchange information, the program should obtain and document each person’s written authorization before sharing that person’s PHI. It should specify the information allowed—such as a general health update, a message, or selected background details—and the people authorized to receive it. A donor’s authorization does not authorize release of the recipient’s information, or vice versa.

Share only within the agreed scope, through a controlled and private process, and with staff trained to handle transplant-related disclosures. A program can offer a checklist so each person can choose which categories to share, and should confirm preferences again if circumstances change. HRSA’s Guidance for Donor and Recipient Information Sharing recommends keeping nonsharing as the default and using authorization when information is exchanged.

Tell each person that information disclosed to another person may be redisclosed and may no longer be protected by HIPAA in the recipient’s hands. A program should not promise that an authorized disclosure can be taken back after it has occurred. If either person withdraws an authorization, stop future disclosures under it as required, while recognizing that the revocation cannot undo prior disclosures made in reliance on that authorization.

What are the privacy rules for nondirected kidney donation?

Nondirected donation means the donor does not select a particular recipient. Because the donor and recipient may not know each other, programs should protect both identities and avoid revealing identifying details through conversations, scheduling, records, or informal messages. HRSA’s ethical guidance on living non-directed donation describes anonymity as an important safeguard while cautioning that anonymity can be difficult to guarantee.

That HRSA resource is ethical guidance, not itself an OPTN policy. Programs should distinguish recommendations in guidance from binding requirements, and follow current OPTN policy, HIPAA, and applicable law. If the donor and recipient later ask to exchange identifiable information, the program should assess each person’s wishes separately and obtain the necessary authorizations before facilitating disclosure.

For paired donation or a donation chain, explain in advance how matching and allocation work, what information may be shared, and what privacy limits apply. Avoid implying that a donor must continue in a chain because others are depending on it; the donor retains the right to withdraw from the process before surgery.

What HIPAA considerations apply to living-donor follow-up?

Follow-up information about a donor remains that donor’s PHI when it identifies the donor and is held by a covered entity or its business associate. Keep follow-up records separate from the recipient’s record where appropriate, restrict access by role, and disclose information only for a permitted purpose. Sharing donor follow-up details with the recipient is not automatically allowed just because the recipient received the kidney.

OPTN Policy 18.4 sets a minimum two-year follow-up period for living donors. Policy 18.2 identifies follow-up collection around the six-month, one-year, and two-year anniversaries, within the specified reporting window. This transplant program follow-up reporting is separate from sharing information with the recipient. Programs should use the current OPTN requirements and document the applicable HIPAA basis for each disclosure. See OPTN Policies 18.2 and 18.4.

Programs should tell donors what follow-up involves, how the information may be used or reported, and how to keep receiving appropriate care after donation. Follow-up data collected for the program or required reporting should not be treated as permission to share identifiable details with the recipient. HIPAA compliance depends on the disclosure’s purpose and legal basis, while sound program practice also depends on clear donor communication, separate access controls, and respect for each person’s sharing choices.

FAQs

Can a transplant hospital share a donor’s test results with the recipient candidate without permission?

Generally, no. Donor test results are the donor’s confidential health information, and the hospital should not disclose them to the recipient candidate without the donor’s permission unless a specific legal basis permits or requires disclosure. HRSA’s Living Donation FAQs confirm that a hospital cannot share donor medical information or test results with the candidate without permission.

Can a donor choose which evaluation information to share?

Yes. A donor may authorize sharing only specified information, rather than all evaluation records. The program should document the scope and recipient of the authorization, respect any limits the donor sets, and explain that information already disclosed may be redisclosed.

How can a donor stop the evaluation process confidentially?

The donor can contact the donor team or ILDA privately and say they do not wish to proceed. OPTN policy requires a protected and confidential opportunity to discontinue evaluation or consent before surgery. The program should not disclose the donor’s decision or reason to the recipient without permission, subject to applicable legal reporting duties.

Can living kidney donors and recipients choose what identifiable information to exchange?

Yes. Each person can decide whether to share identifiable information and what categories to authorize. The program should obtain each person’s valid written authorization separately, share only within its scope, and maintain nondirected donation anonymity unless the required permissions and applicable rules allow an exchange.