Which bits of patient information are confidential?

A LHD’s starting assumptions should always be:

• Any individually identifiable information about a patient is confidential; and
• Any individually identifiable health information the LHD has on a person who is not a
patient might be confidential. For example, information in an environmental health
report that identifies a person with a communicable disease is confidential, even if the
person is not a LHD patient and even though the EH report is not a patient record.

There are exceptions to these rules of thumb, but it is best to start with the assumption that
individually identifiable health information is probably confidential and should not be disclosed
except as allowed by HIPAA and other confidentiality laws. Consult the LHD’s privacy official or
an attorney if you think you have a situation that constitutes an exception.

Under the HIPAA Privacy Rule, protected health information (PHI) is confidential. PHI is defined
as information or records in any form (including paper records, electronic records, and oral
communications) that:

• Identify an individual (or can be used to identify an individual), and
• Relate to any of the following:

o The physical or mental health status or condition of the individual,
Moore/December 2011 (revised) Page 3
o The provision of health care to the individual, or
o Payment for the provision of health care to the individual.

Look carefully at the second and third bullet points, and you will see that under the Privacy Rule,
it is not just medical status or treatment information that is confidential–the mere fact that a
person is a patient is confidential (because it relates to the provision of health care), as is billing
information (because it relates to payment for the provision of health care).

GS 130A-12, the main state law that addresses confidentiality of LHD patient records, is
consistent with HIPAA. It provides that LHD records that contain information that is privileged
under state law or protected under HIPAA are confidential.