HIPAA Disclosures During Mass Tragedies

Articles / Publications

Reprinted with Permission from the Medical Association of the State of Alabama.

In light of the recent incident in Las Vegas, the Office of Civil Rights ("OCR"), the government entity responsible for HIPAA Compliance, issued clarification guidance on the ability of a health care provider to share patient information during such situations. While such incidents are taxing on health care providers in terms of treating capacity and ability, it is important that providers keep in mind the requirements of HIPAA regarding the disclosure of certain information to the public. A summary of OCR's recent clarification is provided below, as it serves as a good reminder regarding what information can be shared under HIPAA in these types of mass-casualty, disaster scenarios.

Disclosures to Family, Friends, and Others Involved in an Individual's Care and for Notification.
You may share health information with a patient's family members, relatives, friends, or other persons identified by the patient as involved in the patient's care. You may also share information about a patient as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient's care, of the patient's location, general condition, or death. This may include, where necessary to notify family members and others, the police, the press, or the public at large.

  • You should get verbal permission from the patient when feasible or otherwise be able to reasonably infer that the patient does not object to the disclosure. If the individual is incapacitated or not available, you may share information for these purposes if, in your professional judgment, doing so is in the patient's best interest.
  • In addition, you may share protected health information with disaster relief organizations that are authorized by law or by their charters to assist in disaster relief efforts (e.g., American Red Cross), for the purpose of coordinating the notification of family members or other persons involved in the patient's care, of the patient's location, general condition, or death. It is unnecessary to obtain a patient's permission to share the information in this situation if doing so would interfere with the organization's ability to respond to the emergency.

Download the full article, "HIPAA Disclosures During Mass Tragedies" written by Kelli Carpenter Fleming.


Jump to Page

Contact Us

About Burr & Forman Cybersecurity & Data Privacy Law

Burr & Forman's experienced team helps clients navigate the complex cybersecurity and data privacy landscape with strategies designed to assess current risks, develop a corrective action plan, implement best practices, and provide immediate and appropriate responses to a cybersecurity breach.

We use cookies to improve your website experience, provide additional security, and remember you when you return to the website. This website does not respond to "Do Not Track" signals. By clicking "Accept," you agree to our use of cookies. To learn more about how we use cookies, please see our Privacy Policy.

Necessary Cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Analytical Cookies

Analytical cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.