HIPAA Guidelines for Palliative Care Physicians: What You Can Share with Families and the Care Team

HIPAA Privacy Rule and Family Communication

The HIPAA Privacy Rule protects Protected Health Information (PHI) while enabling family involvement in care. In palliative settings, you may disclose information to family members, other relatives, close personal friends, or any person the patient identifies as involved in care or payment.

You can share information when the patient agrees, is given an opportunity to object and does not, or when you rely on professional judgment because the patient is incapacitated or unavailable. In all cases, tailor the health information disclosure to what is directly relevant to the person’s role.

Use reasonable safeguards: verify identity and relationship, be mindful of who can overhear, and limit details to what supports safe, compassionate care coordination. These HIPAA guidelines help you communicate clearly without compromising privacy.

Patient Consent Requirements

For routine updates to family or friends involved in care, Patient Consent may be oral or implied. If the patient is present and does not object to discussion in front of a relative, you may proceed. Written authorization is not required for these care-related disclosures, but you must stop if the patient objects or narrows the scope.

Capture preferences in the chart: who may receive updates, preferred contact methods, topics that may or may not be discussed, and any passcodes. Patients may revoke consent at any time; once they do, cease sharing beyond what the law otherwise permits.

When a personal representative is legally authorized (e.g., health care proxy, guardian), treat that person as the patient for PHI access unless doing so would endanger the patient or conflict with applicable law. For minors, follow state law on parental access and any exceptions protecting the minor’s privacy.

Written authorization remains necessary for uses such as marketing, sale of PHI, most research, and psychotherapy notes kept separate from the medical record. Substance use disorder records subject to 42 CFR Part 2 generally require explicit patient authorization, even when family is involved.

Professional Judgment in Patient Absence

When caring for an incapacitated patient—such as one who is sedated, delirious, or otherwise unable to agree or object—you may disclose information to family or friends involved in care if, in your professional judgment, it is in the patient’s best interests. The same applies when the patient is temporarily unavailable.

Share only what is necessary for immediate decision-making or safety: location, general condition, current problems, treatment plan, and instructions. Avoid unrelated sensitive details. Reasonable inferences from the situation (for example, a spouse at the bedside) can guide your decisions.

Reassess once the patient regains capacity. Explain what was shared, confirm or update their preferences, and document any new limits or designated contacts.

Scope of Shared Information

Generally appropriate to share (as relevant to involvement in care)

• Location and general condition (e.g., stable, comfortable, declining).
• Current diagnosis and key clinical issues affecting decisions and safety.
• Medications, allergies, and care plan elements necessary for home care.
• Goals-of-care discussions and decisions the patient has made or authorized you to convey.
• Practical instructions for symptom management and follow-up.

Information requiring extra caution or specific authorization

• Psychotherapy notes maintained separately from the record.
• Substance use disorder treatment records protected by 42 CFR Part 2.
• Categories restricted by state law (for example, certain mental health, HIV, genetic, or reproductive health details).

Avoid broad record releases to family or friends. Provide focused updates rather than full chart access unless the requester is the personal representative or you have a valid authorization.

Communication with Family Members

Confirm who the patient wants involved and how to reach them. Consider designating a primary contact to reduce conflicting requests and information drift. When feasible, include the patient in conversations and reflect their words and preferences.

Use practical safeguards: verify identity before phone updates, use a callback to known numbers, and employ passcodes if your organization uses them. When leaving voicemails or sending messages, limit details to what is necessary and appropriate.

Distinguish between conversational updates and access rights. Family members may receive relevant updates, but they do not automatically gain the right to obtain the full record unless they are the personal representative or you have authorization.

Disclosure to Non-Family Members

Non-family participants—such as close friends, neighbors, paid caregivers, or clergy—may receive information directly relevant to their involvement in the patient’s care or payment if the patient agrees or you infer permission from the circumstances. If the patient is incapacitated, rely on professional judgment about the patient’s best interests.

Do not disclose PHI to employers, media, or curious acquaintances without explicit authorization or a specific legal exception. Separate rules govern disclosures to public health authorities, Adult Protective Services, law enforcement, and similar entities; share only what those laws permit or require.

Hospital directories and notification of location or general condition are allowed unless the patient opts out. Even then, use reasonable safeguards and avoid unnecessary detail.

Disclosure After Patient's Death

Decedent Information Disclosure follows the same privacy principles. A decedent’s PHI remains protected for 50 years after death. You may disclose to the personal representative of the estate as you would to the patient, subject to any limits the law imposes.

You may also disclose information relevant to the person’s involvement in care or payment prior to death to family or others, unless doing so conflicts with a known preference the patient expressed while alive. Limit disclosures to what is directly pertinent.

Certain parties—such as coroners, medical examiners, funeral directors, and organ procurement organizations—may receive PHI for their duties. When in doubt, share the minimum necessary to fulfill the purpose and document your rationale.

Key takeaways

• Center decisions on the patient’s preferences; obtain and record Patient Consent early.
• When the patient can’t decide, use professional judgment and disclose only what is directly relevant.
• Be precise about scope: updates for care coordination, not blanket access to the full record.
• Watch for heightened protections (psychotherapy notes, 42 CFR Part 2, and state-specific categories).
• For decedents, treat disclosures with the same care, honoring personal representatives and known wishes.

FAQs.

What information can palliative care physicians share with family members under HIPAA?

You may share PHI directly relevant to the family member’s involvement in care or payment—such as condition, treatment plan, medications, and home-care instructions—when the patient agrees, has the chance to object and does not, or when you use professional judgment in the patient’s best interests. Avoid unrelated or overly detailed information and do not release the full record without proper authority.

When can a provider share information without patient consent?

You may disclose without express consent when the patient is incapacitated or unavailable and sharing is in the patient’s best interests, or when laws require or permit disclosure (for example, certain public health, abuse reporting, or law enforcement needs). Limit the disclosure to what is necessary for the situation and document your reasoning.

How should physicians handle information sharing if the patient is incapacitated?

Rely on professional judgment to determine who is involved in care and what they need to know. Provide focused updates that support immediate decisions and safety, then revisit consent and preferences once the patient regains capacity. Continue to respect heightened protections (e.g., psychotherapy notes, 42 CFR Part 2) even in emergencies unless a specific exception applies.

What rules apply to sharing information after a patient's death?

A decedent’s PHI remains protected for 50 years. You may disclose to the personal representative and, as relevant, to family or others who were involved in care or payment before death, provided it does not conflict with the patient’s known wishes. You may also share with coroners, medical examiners, funeral directors, and organ procurement organizations for their duties, while limiting disclosures to what is directly pertinent.