Exchanging information with family members

Q: As FPs, we often gain valuable information from patients' family members who call to alert us to early signs of dementia, substance abuse, or other kinds of behavioral problems. How should we respond to such calls in a HIPAA-compliant manner?

A: Under HIPAA, you may receive as much medical information as a family member is willing to give you. The reason is simple: Although the law limits the use and disclosure of protected health information by "covered entities" (most doctors, all healthcare payers, clearinghouses, and sponsors of Medicare Part D drug plans), it doesn't limit what noncovered entities may do-in this case, a family member. But, as a doctor, you may not disclose any information to a family member without your patient's authorization. If you anticipate that such an exchange might take place, ask the patient to designate in writing which family members may receive her protected health information. Some practices incorporate this kind of authorization in a "contact form," in which patients identify family members who may be left messages regarding things like appointment times and test results.