united-states medical hipaa
Do the HIPAA regulations in the United States prevent medical providers from disclosing relevant health information on patient A to patient B?
<p>If a medical provider is aware of some health information on patient A that can affect patient B, do the HIPAA regulations still prevent the medical provider from conveying that information to patient B?</p>

<p>For example, if patient A is patient B's father, and patient A has some genetic disorder that may impact patient B and that is known to the medical provider, do the HIPAA regulations prevent the medical provider from disclosing that information to patient B?</p>

<p>This issue has recently been raised in the United Kingdom:  <a href="https://www.theguardian.com/science/2018/nov/25/woman-inherited-fatal-illness-sue-doctors-groundbreaking-case-huntingtons" rel="nofollow noreferrer">Legal action over non-disclosure of father’s Huntington’s disease could lead to huge changes in patient confidentiality</a> (<a href="http://archive.is/ayTqG" rel="nofollow noreferrer">mirror</a>)</p>

<p>HIPAA <strong>does not</strong> legally protect physicians from disclosing PHI to another party, although there are a few exceptions: <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html" rel="nofollow noreferrer">HHS provides an excellent resource on these</a>, but the regulation most relevant to your question is <strong>Permitted Uses and Disclosures (5) Public Interest and Benefit Activities</strong>, which includes "<strong><em>Required by Law.</em></strong> Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders)." These statues, regulations, and court orders vary from state, but almost all of them refer to STDs and not genetic conditions (<a href="https://www.networkforphl.org/the_network_blog/2014/04/10/437/hipaa_privacy_questions_answered/" rel="nofollow noreferrer">in some states</a>, physicians are required to disclose positive STD test results to known sexual partners, but I can't find similar legislation for genetic tests). <a href="https://www.independenthealth.com/Portals/0/PDFs/Individuals/HIPAADisclosureofPHIAuthorizationForm.PDF" rel="nofollow noreferrer">Here's an example</a> of a <em>voluntary</em> patient information disclosure form – you'll notice that an individual has to specify the parties to whom they're willing to have PHI disclosed. The example you provided is still a violation of the Privacy Rule in the U.S., but this is a very curious grey area in bioethics and law. </p>

<blockquote>
  <p><a href="https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2677756/pdf/nihms-107268.pdf" rel="nofollow noreferrer"><strong>Disclosure of Genetic Information Within Families: How nurses can facilitate family communication. Gallo <em>et al. Am J Nurs.</em> 2009 Apr; 109(4): 65–69.</strong></a> (<strong>Emphasis</strong> mine.)</p>
  
  <h3>HIPAA and Genetic Disclosure</h3>
  
  <p>Does the law affect families?</p>
  
  <p>The privacy rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) went into effect on April 14, 2003. The rule created new requirements for health care providers, third-party payers, and health care clearinghouses to protect the privacy and security of health information, including genetic information, that could identify a person.</p>
  
  <p>A person's decision not to disclose her or his risk of developing a genetic condition to a family member may pose a dilemma for the health care professional, who has to choose between ethical obligations to inform the at-risk party and legal requirements to respect and protect the patient's privacy. The potential for harm to family members often plays a large role in the decision. For example, in rare cases, the use of a certain surgical anesthesia can cause death in people with the mutation that disposes them to malignant hyperthermia. Likewise, strenuous exercise can bring on sudden death in people with hypertrophic cardiomyopathy. In such cases, clinicians should carefully explain the reasons for sharing information with family members, strongly encourage patients to notify at-risk relatives, and offer to help develop a plan for notifying them. <strong>When patients choose not to notify family members, clinicians typically respect the decision. There are situations, however, in which the clinician may consider overriding the patient's preferences</strong> because the family member is judged to be in danger of serious or immediate harm or there is a high likelihood that a dangerous condition will occur that can be either prevented or adequately treated with early recognition. <strong>Clinicians who believe it is necessary to override a patient's wish regarding the notification of family members, should consider consulting an ethics committee or legal council</strong>. In most situations, though, the risk of serious harm associated with nondisclosure is not clearly immediate. For instance, if a woman has tested positive for the BRCA1 or BRCA2 mutation but doesn't want to upset her two sisters by sharing that information with them, the need for disclosure isn't clearly urgent. Each sister has a one in two chance of carrying the same mutation. It would be understandable for the patient to try to learn more about what the mutation means for her and her children and to give careful thought to whether and how she'll share her test results with her sisters.</p>
  
  <p>Clinicians can best help family members by clearly informing patients who test positive for genetic conditions or the mutations that cause them about the risks faced by their family members, discussing the value of disclosure and offering assistance with it.</p>
</blockquote>



<blockquote>
  <p><a href="https://jamanetwork.com/journals/jama/article-abstract/199466" rel="nofollow noreferrer"><strong>The "Duty to Warn" a Patient's Family Members About Hereditary Disease Risks. Offit <em>et al. JAMA.</em> 2004;292(12): 1469–1473.</strong></a> (I can send you the full-text of this if you want it; it contains an excellent overview of cases and their outcomes relating to disclosing genetic information in the U.S. under HIPAA.)</p>
  
  <p>In general, the special nature of genetic tests has been viewed as a barrier to physicians' breaching the confidentiality of personal genetic information. However, the failure to warn family members about hereditary disease risks has already resulted in 3 lawsuits against physicians in the United States.</p>
  
  <p>While the findings of case law and the state and federal statutes that bear on the issue of "duty to warn" of inherited health risk are still being defined, we believe that health care professionals have a responsibility to encourage but not to coerce the sharing of genetic information in families, while respecting the boundaries imposed by the law and by the ethical practice of medicine.</p>
  
  <p>...in considering whether to breach patient confidentiality to warn of risks of a genetic disease, clinicians need to balance the actual risk of that disease, the efficacy of potential preventive interventions, as well as emerging legal considerations and potential liabilities. Overriding patient confidentiality and genetic privacy might very well mean violation of HIPAA and certain state regulations, with attendant civil or criminal liability. At the same time, in one state appellate court decision that has not been overturned, the estate of a physician was held liable for his failure to warn relatives of hereditary disease risk.</p>
</blockquote>
