Does HIPAA Apply to Spouses?
HIPAA does not apply to spouses inasmuch as spouses are not required to ensure the privacy of Protected Health Information disclosed to them by a partner or by a member of a covered entity’s workforce. However, HIPAA applies to when Protected Health Information can be disclosed to spouses, partners, and other family members.
The HIPAA Privacy Rule stipulates when disclosures of Protected Health Information (PHI) are required, permitted, and prohibited without an authorization from the subject of the PHI. Required disclosures are limited to disclosures to individual who is the subject of the PHI and to HHS’ Office for Civil Rights in order to investigate or determine HIPAA compliance. In some states, it is also a requirement to disclose PHI to report child abuse, domestic abuse, or gunshot wounds.
Among the required disclosures, there are scenarios in which PHI could be disclosed to a spouse. The most common example of this is “incidental disclosures”. Incidental disclosures occur when information relating to a spouse’s health condition or treatment for the condition is maintained in the same designated record set as the individual’s PHI. In such cases, when an individual exercises their HIPAA rights to access their own PHI, they may also incidentally access some of their spouse’s PHI.
Permitted Disclosures of PHI to Spouses
In the context of the question does HIPAA apply to spouses, the most common reason for asking the question is to determine whether disclosures of PHI are permitted to wives, husbands, or partners when a patient is receiving medical treatment in a healthcare facility. In most cases, the answer is that disclosures of PHI to spouses are permitted unless the subject of the PHI has objected to a disclosure, or a healthcare professional believes it is not in the best interests of the individual.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Examples of when disclosures of PHI are permitted to spouses also include when a spouse accompanies a patient to an appointment. In such circumstances, a healthcare professional can infer from the circumstances that the patient does not object to their PHI being disclosed to their spouse. However, the healthcare professional also has the option to ask the patient to agree to the spouse being present before disclosing PHI, even when the spouse has power of attorney for the patient’s healthcare.
Most of these scenarios are covered by §164.510 of the HIPAA Privacy Rule – “Uses and Disclosures Requiring an Opportunity for the Individual to Agree or Object”. Healthcare professionals can also disclose PHI to spouses under §164.512(j) of the HIPAA Privacy Rule – “Disclosures to Avert a Serious Threat to Health or Safety”. Because these disclosures are agreed to by the individual, or initiated by a healthcare professional, the verification requirements of §164.514(h) do not apply to these scenarios.
Different Organizations Can Have Different Rules
The HIPAA Privacy Rule provides a federal floor of privacy protections for individually identifiable health information and any related personally identifiable maintained in the same designated record set. States can – and have – introduced laws with more stringent privacy protections that overlay HIPAA. However, organizations can apply even more stringent privacy protections if they feel they are necessary. For example, requiring an individual’s written authorization before disclosing PHI to a spouse.
Other examples of when more stringent privacy protections might be applied by an organization include when PHI relating to an individual’s reproductive health is disclosed to a spouse, or when a spouse with power of attorney requests the transfer of an individual’s PHI to another healthcare provider. Healthcare providers with questions about these scenarios, or who want to know more about when does HIPAA apply to spouses, are advised to speak with a healthcare compliance professional.
