When may LHDs disclose confidential patient information?

With the patient’s (or personal representative’s) permission: A LHD may disclose information if the patient or the patient’s personal representative³ gives permission for the disclosure. The permission must be in the proper form. In most cases, the permission must be in writing on an authorization form that complies with the HIPAA Privacy Rule.

The first thing to ask when there is a question about whether a disclosure may be made is, “Should I seek the patient’s permission to disclose this information?” Patient permission is often the simplest way to resolve a disclosure question. Of course, it doesn’t always make sense to seek permission. For example, if a DSS employee is asking for information about a child who is the subject of a child protective services report, the LHD is required by law to disclose the information. It does not need permission for the disclosure and it probably shouldn’t seek it.

Without the patient’s (or personal representative’s) permission under certain circumstances that are specified in law: There are several circumstances in which a LHD may disclose patient information without permission. I will not attempt to address all of them in this outline. The following list describes three circumstances that arise very frequently in North Carolina LHDs.

• Treatment, payment, and health care operations: Since July 2004, North Carolina LHDs
have been permitted to disclose information without the patient’s permission when the
purpose of the disclosure is to provide for the patient’s treatment, to obtain payment
for treatment, or to carry out health care operations. The terms “treatment,”
“payment,” and “health care operations” are defined in the HIPAA privacy rule. See the
definitions section on the last page of this handout.

• Required by law: LHDs are permitted to disclose information without a patient’s
permission when the disclosure is required by another law, such as a state law. For example, in NC, a LHD must disclose PHI in the following circumstances, and it does not
need the patient’s permission to do so:

o To make a report to child protective services or adult protective services.
o To make communicable disease reports to the state or another LHD.
o To a medical examiner who requests it.
o To report a diagnosis of cancer to the state cancer registry.

This is not a complete list. For more information, see the handout, “Disclosures of Protected Health Information that are Required by North Carolina Law.”

• Court orders and subpoenas: LHDs may disclose information without a patient’s
permission pursuant to a proper court order. A subpoena is a form of court order, but in
North Carolina, a subpoena alone is not sufficient to permit a LHD to disclose patient
information or provide access to or copies of patient records. LHDs should take great
care with subpoenas. It is essential for a LHD to have a carefully written policy on
responding to subpoenas, and it is a good idea for a LHD that has received a subpoena
to consult with an attorney as well.⁴

There are several other circumstances in which a disclosure of information may be made without the patient’s permission, provided certain criteria are met. Consult the LHD’s privacy official or an attorney if you need to know whether a LHD may disclose information without patient permission in a particular circumstance.