Treatment of critical illness in the ICU poses complex challenges for patients, families, other loved ones, and the healthcare professionals providing care to patients. Because many ICU patients lack decision-making capacity, others must speak for them. Depending on the circumstances, these others may be persons designated in advance by the patient, court-appointed guardians, family members, or others close to the patient who know their preferences (1 , 2). We use the term “family members” to refer to family members and other loved ones following the relevant critical care literature (3 , 4) and the term “personal representative” (PR) to refer to the person who has legal authority to speak for the patient. Excellent communication in such circumstances is important to improve decision making, lessen psychologic distress among stakeholders, enhance the experience for patients and family members, and, perhaps, better enable family members to serve as informal caregivers (5–9). However, communication requires access to information. In fact, family members of ICU patients are interested in obtaining more information, including via electronic portals and other mechanisms (10). Lack of information may prevent meaningful engagement of patients themselves and their family members in care (3 , 11). Yet, apparent barriers to adequate communication remain, some of them being attributed to privacy regulations. In our judgment, such attributions are misleading.
In the United States, the Health Insurance Portability and Accessibility Act (HIPAA), extended by the Health Information Technology for Economic and Clinical Health Act, reflects a variety of concerns about privacy. HIPAA can involve civil and even criminal penalties for violations and may be viewed with concern by many clinicians (12). Beyond these federal regulations, state laws may further regulate patient privacy. We have elsewhere described the potential constraints of federal laws relating to digital health records on inpatient electronic portals (13). Here, we review the legal issues potentially relevant to communication in the ICU. When properly understood, both HIPAA and state laws are far more supportive of open communication than many ICU clinicians may realize. Our goal is to provide the clarity needed to improve the flow of information to ICU patients and their loved ones. Put most simply, the review below answers these questions: to “whom” can the practicing clinician tell “what” information under “which” conditions when the patient is unconscious or otherwise decisionally impaired?
Our review surveys applicable federal and state laws relevant to sharing information with patients’ families in the ICU. Our data sources are the U.S. Code, U.S. Code of Federal Regulations, and state codes, as identified and reviewed by the two attorney authors (L. F., M. V.) using the LEXIS and Westlaw databases. We describe a simple, practical approach to assist clinicians, administrators, and ICU management in facilitating robust communication with ICU patients, their decision makers, and their loved ones. The take-home point is that at a minimum, the patient’s PR and others directly involved in the patient’s care may receive access to health information from the current episode of care, unless the patient has previously refused (or if capable of deciding, currently refuses) such access.
THE HIPAA: BASIC CONCEPTS
HIPAA sets federal minimum standards for the protection of an individual’s health information; states may enact additional protections, and many do so. HIPAA takes precedence over state laws only where those laws are contrary to HIPAA and/or provide less stringent protections than HIPAA does, so a great deal of health privacy law is at the level of the individual states. HIPAA governs what it calls “protected health information” (PHI). PHI is individually identifiable information created or received by a healthcare provider relating to the person’s physical or mental health, treatment, or payment for treatment; HIPAA interprets what information is “related to” health very broadly, extending even to demographic information. HIPAA applies to what are called “covered entities” (CEs), which includes essentially every healthcare facility with an ICU in the United States (14 , 15). Under HIPAA, CEs may not use or disclose individually identifiable PHI, with several important exceptions relevant to ICU clinicians.
COMMUNICATING HEALTH INFORMATION UNDER HIPAA
HIPAA has three basic levels of protection for disclosures of PHI. Some disclosures require authorization by the patient or her PR. Some disclosures are permissible as long as the institution gives the patient the opportunity to object and she does not. Some disclosures permit full access without either authorization or the opportunity to object.
We depict the “what,” “to whom,” and “when” of HIPAA regulations in Table 1.
PRs are individuals with the legal authority to act for patients. They are identified as provided in state statutes. HIPAA defers to state laws about who is a PR and what the PR’s powers are (16). Clinicians may be familiar with different nomenclatures for PRs. Table 2 lists different types of PRs, how they are selected, and their typical authority. For a complete list of relevant state law provisions, see Appendix Table 2 (Supplemental Digital Content 1, http://links.lww.com/CCM/C283). The primary state law variation that clinicians are likely to encounter is that some states include persons who have exhibited “special care and concern” for the patient and are knowledgeable about the patient’s values among the list of surrogates, whereas other states do not.
Many patients do not have designated powers of attorney or court-appointed guardians. For these patients, the surrogate decision maker will be whoever is listed in the relevant state statute. Importantly, some ICU patients, even those who are decisionally compromised, may still have sufficient capacity to designate their power of attorney. The capacity required is understanding who they want to make their medical decisions and that they are giving the person this authority. Patients may have this capacity even if they are under legal guardianship.
In the absence of any limitations imposed by patients or state law (these are rare and most likely to involve special limitations on mental health information; for details, see Appendix Table 2, Supplemental Digital Content 1, http://links.lww.com/CCM/C283), HIPAA provides that PRs have the authority that patients would otherwise have with respect to disclosures of their PHI (17). There is an exception if, in reasonable medical judgment, access to PHI is likely to cause substantial harm to the patient or another (18). As mentioned above, patients may set limits on their PR’s ability to access information although very few do so. In the vast majority of cases, ICU clinicians may share information with the patient’s PR just as they would with the patient herself.
The PR is commonly only one of many individuals concerned about an ICU patient’s condition. As we described previously (13), these other individuals may also need and want information about how their loved one is doing. Although HIPAA does not specify this, many ICUs use the PR as the key informal “spokesperson,” providing more limited information to others. However, it is not necessary for the ICU to go through the PR in this way for individuals directly involved in the patient’s care. Under HIPAA, people directly involved in the patient’s care—family members, other relatives, close personal friends, or others designated by the patient—may have access to PHI relevant to that care (19). This access is subject to the patient’s being given the opportunity to object when they are able to do so. ICUs should develop policies to facilitate this access, including, if possible, methods for making relevant parts of the ICU record available to those involved in the patient’s care.
There may be cases in which the PR asks the healthcare team not to communicate with other family members. Legally, the PR speaks for the patient, and unless the PR’s authority has been limited by the patient or by state law, the PR’s request should be treated just as a request from the patient would be. When a patient request that information not be shared and clinicians believe this request is unwise, they should discuss it with the patient. Clinicians are advised to try to understand the patient’s reasoning and to discuss with the patient the pros and cons of limitations on information sharing. Clinicians should have similar conversations with PRs; PRs may have information that is not available to the healthcare team or concerns that need to be addressed. These conversations may be difficult, especially when they indicate underlying disagreements within the family but should be approached in the same way as other decisions about the patient’s care where there may be differences of opinion. Rarely, PRs may in fact not be performing their role appropriately, for example, through a conflict of interest. In such cases, regardless of questions about information sharing, clinicians should seek advice from their facility’s legal team and/or ethics consultation service.
Finally, callers identifying the patient by name may be given only general information about the patient’s location and status (e.g., “stable” or “critical”) that does not reveal PHI. We describe the constraints on these forms of access more fully below.
Under HIPAA, three levels of information are available: 1) access to PHI on the same terms as the patient, 2) access only to PHI specific to the current ICU admission, and 3) minimal information that can be released to interested callers.
HIPAA provides that, with limited exceptions, individuals have unfettered access to their own PHI. The exceptions are when in reasonable medical judgment, access would endanger the life or physical safety of the patient or others, when the information was obtained under a special promise of confidentiality and would reveal the identity of the source, or when access would jeopardize a research study and the participant has consented to this limit (20). Patient access also does not include separately maintained psychotherapy notes and materials collected in anticipation of criminal or civil court cases. PRs have the same rights as patients to access the medical record unless the patient or state law sets limits or in reasonable medical judgment the PR’s access would cause substantial harm to the patient or another.
As noted above, HIPAA also permits family or friends involved in the patient’s care to have access to some PHI. This access is restricted to PHI directly related to the current ICU admission. In general, records and information relating to outpatient visits and prior hospitalizations would not be made available, unless they were closely tied to the current hospitalization. The goal of this provision is to allow caregivers to have the information they need to help care for the patient. Healthcare professionals working in the ICU may also communicate PHI if needed to identify, locate, or inform family members, PRs, or others responsible for a patient’s care, about the patient’s location, general condition, or death (21). They may also communicate general information about the patient’s location and status that does not reveal PHI to callers who identify the patient by name. The conditions on such disclosures are discussed below.
Under Which Conditions
The patient has largely unconstrained access to PHI, as described above. The PR has the same access that the patient does, unless the patient or state laws set limits. For access to episode of care information for others involved in the patient’s care, the crucial HIPAA constraint is the “opportunity to object” (22). Patients must be given the opportunity to object to having information shared with persons involved in their care. They must also be given the opportunity to object to having general information about their condition being shared with others who ask about how they are doing.
The Department of Health and Human Services (the government body that enforces HIPAA) has issued guidance for facilities about what the opportunity to object means and what facilities must do to make sure patients have this opportunity (5). When the patient is present and able to communicate an objection, PHI may be disclosed if the patient agrees, could say no but does not, or if under the circumstances based on professional judgment it is reasonable to assume that she does not object (23). As an example, a clinician might simply ask a patient whether it is acceptable for a family member to stay in the room during an examination or a discussion. The clinician is not required to document the patient’s opportunity and lack of objection. If the patient is not present, lacks capacity, or if the situation is an emergency, ICU clinicians should use “their own professional judgment” to determine whether disclosures of PHI are in the best interest of the patient. A typical family meeting is an illustration (24). If someone other than a family member or friend seeks to be involved, the clinician should be reasonably sure that the patient would not object to the person’s involvement. Clinicians may get this information about the patient’s wishes in person or over the telephone. If the person states that she is a family member, friend, or involved in the patient’s care, proof of identity is not required although healthcare facilities are permitted to establish methods of verification.
Information about a patient’s location and general condition may be very important to people who want to know how the patient is doing, whether she is in the ICU, and whether she can be seen by visitors. HIPAA permits facilities to maintain this information in patient directories and to give out directory information to persons inquiring about the patient by name if the patient does not object (25). The information in a directory may include the individual’s name, location, condition described in general terms that does not communicate specific medical information, and religious affiliation. Only members of the clergy may be given the information about religious affiliation, however. Thus, if family or friends call a facility and ask for a patient by name, they may be told that the patient has been admitted and is in the ICU. They may be given general information such as that the patient is “stable” or “comfortable.” They may also be given information regarding general ICU policies.
In cases of incapacity or emergency circumstances, facilities may include and disclose directory information consistently with any prior expressed preferences and in the patient’s best interest as determined by the professional judgment of the clinician (26). If it becomes practicable at a later time, patients must be informed about directory information and be given the opportunity to object at that point (27). Hospitals should develop policies about directories and the disclosure of information in them.
As discussed above, HIPAA defers to state laws about the identification of PRs. ICUs should be familiar with their state’s provisions about the identification of PRs and any limits on their authority. Appendix Table 1 (Supplemental Digital Content 1, http://links.lww.com/CCM/C283) charts state PR laws.
As mentioned earlier, HIPAA also permits states to impose more stringent privacy protections as long as they do not conflict with HIPAA. Many states have statutes that impose stronger protections on specific types of health information. These statutes typically require explicit, real-time consent to any disclosure of the information. Examples include information related to reproduction (e.g., contraceptive use, abortion, and other reproductive history), sexually transmitted infections (including or in some cases specifically HIV/AIDS), genetic information, or mental health information. Many states also have provisions that track special federal protections for records of treatment in certain substance abuse or mental health treatment facilities. States may also have special provisions for access to information in records of adolescent patients. Appendix Table 2 (Supplemental Digital Content 1, http://links.lww.com/CCM/C283) charts some of the most common state protections for medical records and types of information they may contain.
Information in many protected categories may not be relevant to episodes of care in the ICU, so ICU clinicians will uncommonly have to confront them. However, some otherwise sensitive information may be relevant to the individual’s ICU admission, as, for example, after a suicide attempt or drug overdose. If the information is recorded as part of the patient’s ICU admission, it would be permissible to share it with those involved in the patient’s care as described above. With interoperable electronic health records (EHRs), it may be difficult in practice for ICU clinicians to use EHRs and related patient portals without efforts to segregate certain types of data from others. For example, information about a previous suicide attempt a year ago might or might not be relevant to the current episode of care. Facilities should be aware of and may need to develop methods for dealing with these issues. In developing these methods, facilities should consider any limits on the PR’s access to information, whether set by state law or by the patient. When sharing information with persons involved in the patient’s care, facilities should be cognizant that only information directly relevant to the current care episode may be shared. Facilities should also recognize that the patient may ultimately object to sharing the information and should use reasonable professional judgment in deciding whether sharing the information is relevant and in the patient’s best interest. We emphasize that “reasonable professional judgment” is the standard in making these difficult decisions.
HIPAA and related laws should not be viewed as barriers to sharing information with ICU patients and their family members. Rather, ICU clinicians should follow Department of Health and Human Services guidance to develop policies for responding to telephone inquiries. ICUs should develop methods for giving patients the opportunity to object to sharing information about their current treatment with individuals directly involved in their care. ICU clinicians should be aware of their state’s laws about the determination and authority of PRs and should know that under HIPAA, PRs have the same authority that patients would otherwise have. Finally, ICU clinicians should be aware of any special restrictions placed on medical information by the state in which they are located. Developing policies regarding these issues should help ICUs facilitate communication with patients and their family members.
1. Wendler D, Rid A. Systematic review: The effect on surrogates of making treatment decisions for others. Ann Intern Med. 2011;154:336–346.
2. Cassell EJ, Leon AC, Kaufman SG. Preliminary evidence of impaired thinking in sick patients. Ann Intern Med. 2001;134:1120–1123.
3. Brown SM, Rozenblum R, Aboumatar H, et al. Defining patient and family engagement in the intensive care unit. Am J Respir Crit Care Med. 2015;191:358–360.
4. Davidson JE, Powers K, Hedayat KM, et al. Clinical practice guidelines for support of the family in the patient-centered intensive care unit: American College of Critical Care Medicine Task Force 2004–2005. Crit Care Med. 2007;35:605–622.
5. Lautrette A, Darmon M, Megarbane B, et al. A communication
strategy and brochure for relatives of patients dying in the ICU. N Engl J Med. 2007;356:469–478.
6. Curtis JR, White DB. Practical guidance for evidence-based ICU family conferences. Chest. 2008;134:835–843.
7. White DB, Cua SM, Walk R, et al. Nurse-led intervention to improve surrogate decision making for patients with advanced critical illness. Am J Crit Care. 2012;21:396–409.
8. White DB, Malvar G, Karr J, et al. Expanding the paradigm of the physician’s role in surrogate decision-making: An empirically derived framework. Crit Care Med. 2010;38:743–750.
9. Scheunemann LP, Cunningham TV, Arnold RM, et al. How clinicians discuss critically ill patients’ preferences and values with surrogates: An empirical analysis. Crit Care Med. 2015;43:757–764.
10. Brown SM, Bell SK, Roche SD, et al. Preferences of current and potential patients and family members regarding implementation of electronic communication
portals in intensive care units. Ann Am Thorac Soc. 2016;13:391–400.
11. Carman KL, Dardess P, Maurer M, et al. Patient and family engagement: A framework for understanding the elements and developing interventions and policies. Health Aff (Millwood). 2013;32:223–231.
12. Shah F, Burack O, Boockvar KS. Perceived barriers to communication
between hospital and nursing home at time of patient transfer. J Am Med Dir Assoc. 2010;11:239–245.
13. Brown SM, Aboumatar HJ, Francis L, et al; Privacy
, Access, and Engagement Task Force of the Libretto Consortium of the Gordon and Betty Moore Foundation. Balancing digital information-sharing and patient privacy
when engaging families in the intensive care unit. J Am Med Inform Assoc. 2016;23:995–1000.
14. 45 C.F.R. § 164.104(2016)
15. 45 C.F.R. § 160.103(2016)
16. 45 C.F.R. § 164.502(g)(2016)
17. 45 C.F.R. § 164.502(g)(2016)
18. 45 C.F.R. § 624(a)(3)(iii)(2016)
19. 45 C.F.R. § 164.510(b)(1)(2016)
20. 45 C.F.R. § 164.524(2),(3)(2016)
21. 45 C.F.R. § 164.510(b)(2)(2016)
22. 45 C.F.R. § 164.510(b)(2016)
23. 45 C.F.R. § 164.510(b)(2)(2016)
24. 45 C.F.R. § 164.510(b)(3)(2016)
25. 45 C.F.R. § 164.510(a)(2016)
26. 45 C.F.R. § 164.510(a)(3)(i)(A),(B)(2016)
27. 45 C.F.R. § 164.510(a)(3)(ii)(2016)