Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              FAQ
                              2086-Does the HIPAA Privacy Rule permit a doctor to discuss a patient’s health status, treatment, or payment arrangements with a person who is not married to the patient or is otherwise not recognized as a relative of the patient under applicable law?


    

    

    Navigate to:
  Authorizations (30)
          Business Associates (41)
          Compliance Dates (2)
          Covered Entities (14)
          Decedents (9)
          Disclosures for Law Enforcement Purposes (5)
          Disclosures for Rule Enforcement (1)
          Disclosures in Emergency Situations (2)
          Disclosures Required by Law (6)
          Disclosures to Family and Friends (28)
          Disposal of Protected Health Information (6)
          Facility Directories (7)
          Family Medical History Information (3)
          FERPA and HIPAA (10)
          Group Health Plans (3)
          Incidental Uses and Disclosures (10)
          Judicial and Administrative Proceedings (8)
          Minimum Necessary (14)
          Notice of Privacy Practice (20)
          Preemption of State Law (10)
          Privacy Rule: General Topics (12)
          Protected Health Information (2)
          Public Health Uses and Disclosures (13)
          Research Uses and Disclosures (20)
          Right to an Accounting of Disclosures (8)
          Right to File a Complaint (1)
          Right to Request a Restriction (4)
          Safeguards (13)
          Security Rule (24)
          Smaller Providers and Businesses (145)
          Student Immunizations (8)
          Transition Provisions (3)
          Treatment, Payment, and Health Care Operations Disclosures (30)
          Workers Compensation Disclosures (5)
          Limited Data Set (6)
          Marketing (17)
          Marketing - Refill Reminders (16)
          Personal Representatives and Minors (12)
          Right to Access and Research (58)
          Mental Health (35)
          Health Information Technology (41)
          Telehealth (11)Text resize icon

                    




Does the HIPAA Privacy Rule permit a doctor to discuss a patient’s health status, treatment, or payment arrangements with a person who is not married to the patient or is otherwise not recognized as a relative of the patient under applicable law (e.g., state law)?








  
  
    

  
      





Yes. The HIPAA Privacy Rule at 45 CFR 164.510(b) permits covered entities to share with an individual’s family member, other relative, close personal friend, or any other person identified by the individual, the information directly relevant to the involvement of that person in the patient’s care or payment for health care. In addition, HIPAA allows a covered entity to disclose information about a patient as necessary to notify, or assist in the notification of (including by helping to identify or locate), such a person of the patient’s location, general condition, or death. In either circumstance, the person can be a patient’s family member, relative, guardian, caregiver, friend, spouse, or partner. The Privacy Rule defers to a covered entity’s professional judgment in these cases and does not require the entity to verify that a person is a family member, friend, or otherwise involved in the patient’s care or payment for care.

HIPAA permits a covered entity to share PHI withanyonefrom the list of potential recipients, subject to the conditions included at 45 CFR 164.510(b) and described below.  Moreover, the list of potential recipients of PHI under 45 CFR 164.510(b) is in no way limited or impacted by the sex or gender identity of either the patient or the potential recipient.

When making disclosures to the persons listed under 45 CFR 164.510(b), a covered entity should get verbal permission from the patient when possible, or otherwise be able to reasonably infer that the patient does not object to the disclosure, before disclosing information to these persons.  If the patient is incapacitated or not available, a covered entity may share information when, in its professional judgment, doing so is in the patient’s best interest.  Finally, if the individual is deceased, a covered entity may share information with a person who was involved in the individual's care or payment for care prior to the individual's death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

In contrast to the permitted disclosures described above, there are circumstances in which a covered entity is required to disclose information to a family member or other person involved in an individual’s care. Specifically, in some cases, a spouse, partner, or other person involved in a patient’s care will be the patient’s personal representative and thus generally have the authority to exercise the patient’s rights under the HIPAA Privacy Rule on the patient’s behalf, such as the  right to access medical and other health records as provided at 45 CFR 164.524(a). A covered entity must treat all personal representatives as the individual for purposes of the Privacy Rule, in accordance with 45 CFR 164.502(g).  This means a covered entity may not deny a personal representative, as defined in 45 CFR 164.502(g), the rights afforded to the personal representative under 45 CFR 164.502(g) of the Privacy Rule for any reason, including because of the sex or gender identity of the personal representative. For example, if a state grants legally married spouses health care decision making authority for each other, such that legally married spouses are personal representatives under 45 CFR 164.502(g), the legally married spouse is the patient’s personal representative and a covered entity must provide the spouse access to the patient’s records. In this example, a covered entity that does not provide a patient’s lawful spouse with access because of the sex of the spouses would be in violation of the Privacy Rule.  Similarly, if a person has been granted a legal health care power of attorney for an individual that grants the person the authority to make health care decisions for the individual in a state, that person satisfies the definition of personal representative and a covered entity in that state that denies the person personal representative status because of the gender identity of the person would be in violation of the Privacy Rule.

For more information about HIPAA and Marriage, seehttps://www.hhs.gov/hipaa/for-professionals/special-topics/same-sex-marriage/index.html.”. More general information about when HIPAA permits disclosures to family members, friends, and others involved in a patient’s care or payment for care is available athttps://www.hhs.gov/hipaa/for-individuals/family-members-friends/index.html(for individuals) and athttps://www.hhs.gov/sites/default/files/provider_ffg.pdf(for providers).

                    
  


Content created by Office for Civil Rights (OCR) Content last reviewed December 30, 2016Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​