Health care practitioners have a duty to keep personal medical information confidential. Communication between the patient and doctor is strictly confidential. For example, doctor-patient medical discussions should occur in private, or a patient might ask a doctor to call their cell phone rather than home. Even well-meaning family members are not necessarily allowed to have information about a person's medical condition. All people are entitled to confidentiality unless they give permission for disclosure or they clearly can no longer express a preference (for example, if they are severely confused or comatose). A federal law called the Health Insurance Portability and Accountability Act (HIPAA―Health Information Privacy) applies to most health care practitioners and sets detailed rules regarding privacy, access, and disclosure of information. For example, HIPAA specifies the following:
At the same time, HIPAA rules should not be read to create barriers to normal communications with a patient's family or friends. The rules permit doctors or other health care practitioners to share information that is directly relevant to the involvement of a spouse, family members, friends, or other people identified by a patient. If the patient has the capacity to make health care decisions, the doctor may discuss this information with the family or others present if the patient agrees or, when given the opportunity, does not object. Even when the patient is not present or it is not practical to ask the patient's permission because of emergency or incapacity, a doctor may share this information with family members or friends when, in exercising professional judgment, the doctor determines that doing so would be in the best interest of the patient.
Health care practitioners are sometimes required by law to disclose certain information, usually because the condition may present a danger to others. For example, certain infectious diseases, such as human immunodeficiency virus (HIV) infection, syphilis, and tuberculosis, must be reported to state or local public health agencies. Health care practitioners who notice medical signs of child, adult, or elder mistreatment (elder abuse) or neglect normally must report such information to protective services. Conditions that might seriously impair a person's ability to drive, such as dementia or recent seizures, must be reported to the Department of Motor Vehicles in some states.
Last full review/revision December 2012 by Charles Sabatino, JD