On September 16, 2008, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) issued two brochures, one for patients and the other for providers, that offer guidance under HIPAA regarding when healthcare providers may communicate about a patient with the patient's family, friends, or others involved in their care (hereinafter collectively referred to as "OCR Guidance"). Formatted as a list of commonly-asked questions about HIPAA, the OCR Guidance could be construed as "common sense" answers to questions that typically arise when the HIPAA privacy rule is interpreted so literally as to cause providers to unnecessarily withhold a patient's healthcare information from family and friends.

The OCR Guidance clarifies that a provider may discuss a patient's healthcare information with a family member, friend, or other person involved in the patient's care or payment for such care, when the patient is present and either agrees, or when given the opportunity, does not object to the disclosure. For example, an emergency room doctor may discuss a patient's treatment in front of a patient's friend if the patient asks that the friend come into the treatment room; or a doctor may give information about a patient's mobility limitations to a family member who is driving the patient home from the hospital.

Providers are reminded by the OCR Guidance that they may share or discuss only the information that the person involved needs to know about the patient's healthcare or payment. Additionally, in circumstances where a patient is not present or is incapacitated, a provider may share information which the provider determines, in his or her professional judgment, is in the best interest of the patient.

Healthcare providers are not required to document a patient's decision to allow the provider to share information with family or friends who are involved in the patient's care. When a provider is allowed to share information as described above it may be shared over the phone, face-to-face, or in writing. If over the phone, HIPAA does not require proof of identity.

Finally, the OCR Guidance (1) clarifies that a family member, friend, or other person may pick up a filled prescription, medical supplies, X-rays, or similar forms of patient information for the patient, and (2) addresses instances when a provider must share information with an interpreter for communicating with patients or their families, friends, or others involved in their care or payment for care.