HIPPA Guidelines | HAP


Login to view your account.

Don't have an account? Click here.


Guidelines for Releasing Information on Hospital Patients

The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) includes privacy regulations that govern what patient information may, or may not, be released to individuals outside the hospital, including the media. 

These guidelines are intended to help members of the media and the public better understand the legal issues and rules when seeking patient information from a hospital. 

Hospitals and health systems are responsible for protecting the privacy and confidentiality of their patients and patient information. 

Patients have the right to ask that information be withheld. As long as a patient has not made this request, hospitals can release the following information without obtaining prior patient authorization:

  1. Name—Information can be released to those people (media included) who ask for the patient by name. Information cannot be released to an individual unless that person knows the patient’s name.
  2. Condition—A one-word explanation of the patient's condition can be released.
  3. Location within the hospital—As long as prohibited information is not revealed, such as the patient being treated for substance abuse, the location can be released.
  4. Religion—This information can be released only to clergy on request. Clergy do not need to ask for the individual by name. Hospitals are not obligated to collect this information. If hospitals collect this information, they should inform the patient why they are collecting it and inform the patient that it will be handed over to clergy if requested.

Releasing Information on Condition of Patients

Inquiries that Identify the Patient by Name 

Information about the patient’s general condition and location of an inpatient, outpatient or emergency department patient may be released only if the inquiry specifically identifies the patient by name.

No information may be given if a request does not include a specific patient’s name or if the patient requests that the information not be released. This includes inquiries from the press. 

Patients Can “Opt Out” of Providing Information Altogether 

The hospital has a responsibility to tell patients what information will be included in the hospital directory (name, general condition, location, and religion) and to whom that information will be disclosed (to people, including media, who ask for the patient by name, and to clergy). 

The hospital may inform the patient of this information verbally or in writing. The patient has the option to expressly state that he or she does not want information released—including information confirming his or her presence in the facility.

The hospital may obtain the patient’s agreement or objection verbally or in writing.

Condition Definitions

For the one-word condition, hospitals generally use the terms “undetermined,” “good,” “fair,” “serious,” or “critical.” Definitions of patient conditions are as follows:

  • Undetermined—Patient is awaiting physician and/or assessment
  • Good—Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent. 
  • Fair—Vital signs are stable and within normal limits. Patient is conscious, but may be uncomfortable. Indicators are favorable. 
  • Serious—Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable. 
  • Critical—Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable. 

Information on Children

If a reporter or a member of the public calls a hospital with a child’s name and wants the one-word condition, that information can only be released if the parents have consented, either verbally, or in a written document.

Public Figures

Public persons are not subject to different standards than other patients when it comes to a hospital’s policy for releasing information to the media.

Other Circumstances

Hospitals will not issue statements on sexual assaults, child abuse, suicide or suicide attempts, or cases involving drugs or alcohol.

Death of Patient 

The death of a patient may be reported to the authorities by the hospital, as required by law.

Information about the cause of death must come from the patient’s physician, and a legal representative of the deceased must approve its release. 

This means that hospitals cannot share information with the media on the specifics about sudden, violent, or accidental deaths; or deaths from natural causes, without the permission from the decedent’s next-of-kin or other legal representative.

A hospital may not disclose a patient’s cause of death, date of death, or time of death to the media. 

Releasing Information on Location of Patients

The patient’s location may be included in the hospital directory to support visits by friends and family, as well as the delivery of flowers, cards, and gifts. 

However, as a matter of policy, the patient’s location should not routinely be given to the media, and the patient can direct the hospital to withhold this information. 

If a patient has not asked that his or her information be withheld from the hospital’s directory, the hospital may disclose the patient’s location in the hospital to anyone who asks for the patient by name, without the patient’s authorization. 

If the patient is no longer at the facility, the hospital may disclose that fact in response to such an inquiry. 

Information on patients that are transferred to another hospital must be obtained from the hospital where the patient is currently located. HIPAA regulations do not allow hospitals to comment on patients once they have left the facility.

Under the HIPAA privacy rule, a hospital may disclose, to individuals who ask for the patient by name, that a patient was treated and released because this only provides the patient’s general condition (that they were treated at the hospital) and the patient’s location (that the patient is no longer at the hospital). 

A hospital may not release information regarding the date of release or where the patient went upon release, without patient authorization.

Patient Interview Requests

The following activities require written authorization from the patient: 
  • Drafting a detailed statement (i.e., anything beyond the one-word condition) for approval by the patient or the patient’s legal representative
  • Taking photographs of patients
  • Interviewing patients

If reporters are invited into a hospital by a patient or the patient’s family, the media must contact the hospital public relations representative to make arrangements before entering the hospital.

Public relations staff will always accompany reporters to assure that the privacy of other hospital patients is maintained. 

Hospitals will deny the media access to the patient if it is determined that the presence of photographers or reporters will aggravate the patient’s condition or interfere with patient care. 

If the patient is a minor, permission for any of these activities must be obtained from a parent or legal guardian. 

Under certain circumstances, minors can authorize disclosure of information without parental approval or notification. State laws may vary. 

The HIPAA privacy rule does not speak to individuals who appear in background photos. Under the HIPAA privacy rule; however, hospitals may not release identifiable photographs of patients at the hospital, without the patient’s authorization.

Matters of Public Record

Matters of public record refer to situations that are reportable by law to public authorities, such as law enforcement agencies, the coroner, or public health officers.

While laws and/or regulations require health care facilities to report a variety of information to public authorities, it is not the responsibility of facilities to provide that information in response to calls or other inquiries from the media or other parties. 

Patients who are involved in matters of public record have the same privacy rights as all other patients. The mode of transportation by which a patient arrives at the hospital should have no bearing on the hospital’s approach to releasing information about the patient.

As long as the patient has not requested that information be withheld, hospitals may release the patient’s one-word condition and location to individuals who ask about the patient by name.

« Close