Indiana Acute Hospital Care at Home: Privacy Laws and Compliance Guide

CARE Act Requirements

Indiana’s CARE Act requires hospitals to identify and involve a patient’s chosen caregiver in discharge planning. For Acute Hospital Care at Home, CARE Act compliance extends to the transition from the facility to the home and throughout the at‑home acute episode.

Designate and document a caregiver

Ask the patient to name a caregiver, record the relationship and contact details, and place this information in the medical record. If the patient declines or lacks capacity, document the reason and any legally authorized representative.

Notify and instruct before discharge or home admission

Provide advance notice to the designated caregiver about the discharge timing or the start of the at‑home admission. Deliver clear, task‑specific instruction (e.g., medications, wound care, equipment use) and verify understanding using teach‑back.

Document training and capability

• Note who provided instruction, topics covered, and caregiver competency checks.
• Give written materials and contact numbers for questions or emergencies.
• Update the record if the caregiver’s availability or capability changes.

Integrate the caregiver into the plan

Embed the caregiver’s agreed responsibilities within the written medical plan of care, aligning tasks with patient safety goals and Indiana patient rights.

Patient Rights Communication

Upon enrollment, provide a written notice of rights and responsibilities tailored to the at‑home setting. Explain privacy, dignity, participation in decisions, informed consent, grievance processes, and freedom from discrimination.

What to communicate

• How care will be delivered at home, visit schedules, and who may enter the home.
• Use of telehealth, remote monitoring, and any audio/video devices.
• Access to records, confidentiality, and how to request amendments.

Format and accessibility

Provide materials in plain language, preferred language, and accessible formats. Review verbally, allow questions, and obtain acknowledgment. Document interpreters or auxiliary aids provided.

Grievances and resolution

Explain how to submit complaints, expected response times, and escalation paths. Track grievances to closure and analyze trends for quality improvement.

Privacy and Confidentiality Standards

Apply HIPAA privacy and security rules, plus Indiana patient confidentiality regulations and medical information disclosure laws. Where protections differ, follow the stricter standard.

Safeguards in the home environment

• Hold consultations out of earshot of visitors; confirm patient permission before discussing PHI with others present.
• Use low‑voice and screen‑shield practices; avoid leaving papers, labels, or wristbands visible.
• Control who can view remote monitoring dashboards and alerts.

Data and device security

• Encrypt laptops, tablets, and phones; use multi‑factor authentication and automatic lockouts.
• Transmit PHI only through approved, encrypted channels; prohibit unsecured texting of PHI.
• Wipe and return loaned devices; securely dispose of printed PHI and sharps with labels.

Minimum necessary and special protections

Limit disclosures to the minimum necessary. Apply heightened protections for substance use disorder, mental health, HIV/STD, and genetic information. Train staff on verification of identity before phone updates and on documenting patient permissions.

Medical Plan of Care Protocols

A written medical plan of care is the operational backbone of Acute Hospital Care at Home. It translates physician orders into day‑to‑day actions, clarifies responsibilities, and sets safety thresholds.

Required elements of a written medical plan of care

• Diagnoses, goals, and expected length of at‑home acute care.
• Orders for nursing, therapies, respiratory care, and ancillary services with visit frequency.
• Medication list with dosing, administration method, reconciliation steps, and high‑alert safeguards.
• Monitoring parameters (vitals, telemetry, pulse oximetry), escalation triggers, and on‑call pathways.
• Equipment and supplies, infection‑prevention measures, and safe disposal instructions.
• Laboratory and imaging plan, result follow‑up, and handoffs.
• Caregiver tasks agreed under the CARE Act and any limits to capability.

Orders, oversight, and updates

Maintain active physician oversight with timely order entry, daily review of clinical status, and rapid updates after changes in condition. Revise the plan whenever goals, services, or caregiver availability shift, and complete a thorough discharge summary at episode end.

Remote monitoring and documentation

Define who reviews device data, response times for red alerts, and downtime procedures. Document all assessments, interventions, and caregiver education in the EHR the same day.

Consent for Health Information Release

Healthcare privacy consent governs when you need a signed authorization to share PHI and when disclosures are permitted without it. Build workflows that default to the most protective rule applicable.

When authorization is and isn’t required

• No authorization: treatment, payment, healthcare operations, and disclosures required by law or public health authorities.
• Authorization required: sharing with non‑involved third parties (e.g., employers, schools), media, or for marketing/fundraising beyond limited allowances.

Elevated‑protection information

Obtain explicit, specific authorizations for substance use disorder records, certain mental health notes, and sensitive test results where stricter rules apply. State clearly what information, to whom, for what purpose, and expiration terms.

Capturing and managing consent

• Use e‑signature or validated verbal consent with witness/attestation and time stamps.
• Provide copies to patients; explain revocation rights and how to exercise them.
• Track consents in the EHR, enforce minimum‑necessary disclosures, and review annually.

Caregiver access

Verify the patient’s designation of the caregiver or legal representative before sharing PHI. If the patient limits topics, honor those limits and document them prominently.

Compliance Monitoring and Reporting

Establish a compliance program that aligns policies, education, and oversight across hospital leaders, the at‑home team, and any partners. Make responsibilities and escalation paths unambiguous.

Auditing and metrics

• Chart audits for consent, caregiver documentation, and plan‑of‑care completeness.
• Access‑log reviews and release‑of‑information sampling for minimum‑necessary compliance.
• Device and vendor assessments, including BAAs and data‑flow maps.
• KPIs: grievance turn‑around, breach incidents, training completion, and response times to monitoring alerts.

Incident response and breach notification

Use a written playbook: contain, investigate, risk‑assess, notify under HIPAA and Indiana breach rules, and implement corrective actions. Record root causes and share lessons learned during safety huddles.

Vendor and data‑sharing controls

• Execute business associate agreements, define permitted uses/disclosures, and require encryption at rest/in transit.
• Prohibit secondary use without written approval; set data‑retention and deletion standards.
• Test incident‑reporting channels and backup/recovery for remote monitoring platforms.

Provider Responsibilities

Hospitals and partners must meet home health agency obligations while maintaining inpatient‑level standards tailored to the home. Define who does what, when, and how—then audit to prove it.

Clinical and operational duties

• Screen patients for clinical stability, social supports, geography, and home safety.
• Ensure 24/7 physician or APP availability, rapid nursing response, and clear escalation thresholds.
• Maintain medication safety, including controlled‑substance chain of custody and reconciliation at each touchpoint.

Safety and emergency preparedness

• Establish EMS coordination, transport plans, and weather/power contingency steps.
• Provide PPE, sharps containers, and biohazard disposal instructions tailored to the home.
• Educate on fall prevention, infection control, and caregiver role boundaries.

Documentation and coding discipline

• Capture place of service, daily physician oversight, and all interventions in real time.
• Reconcile equipment and supplies at admission and discharge; secure device returns and data wipes.
• Use standardized checklists to prevent omissions in the written medical plan of care.

Conclusion

By aligning CARE Act compliance, robust patient rights communication, strong privacy safeguards, a complete written medical plan of care, precise consent management, and disciplined monitoring, you can deliver Indiana Acute Hospital Care at Home safely and lawfully. The result is better outcomes, clearer accountability, and trusted, patient‑centered care.

FAQs.

What are the key privacy laws governing Indiana's acute hospital care at home program?

Core rules include HIPAA privacy and security requirements, Indiana patient confidentiality regulations, and applicable medical information disclosure laws for sensitive records. Follow the strictest rule, apply minimum‑necessary standards, and maintain encrypted, role‑based access to PHI.

How does the CARE Act affect patient discharge planning?

The CARE Act requires you to identify the patient’s chosen caregiver, notify them before discharge or home admission, and provide task‑specific instruction. Document training, confirm understanding, and integrate the caregiver’s role into the plan of care to ensure safe transitions.

What consent is required for releasing patient health information?

No authorization is needed for treatment, payment, and healthcare operations or certain required‑by‑law disclosures. For other sharing—such as with employers, schools, or non‑involved third parties—obtain written healthcare privacy consent that specifies what information may be released, to whom, for what purpose, and expiration terms.

How are patient rights communicated in home care settings?

Provide a written notice in the patient’s preferred language and accessible format, review it verbally, and document acknowledgment. Explain privacy, participation in decisions, grievance pathways, remote‑monitoring practices, and who may be present during visits to uphold Indiana patient rights and informed consent.