When can you disclose PHI?
When a health care provider covered by the Health Insurance Portability and Accountability Act (HIPAA) uses an interpreter to communicate with an individual, that individual’s authorization is not required for the disclosure of protected health information (PHI) to the interpreter, as long as certain conditions are met. That’s the short answer to a frequently asked question (FAQ) pertaining to the HIPAA privacy rule recently posted by the Department of Health and Human Services’ Office of Civil Rights (OCR).
New questions and answers are added regularly to the OCR privacy page at www.hhs.gov/ocr/hipaa/.
Covered entities may use and disclose PHI for treatment, payment, and health care operations without an individual’s authorization, according to the privacy rule. The health care provider might use interpreter services to communicate with patients who speak a language other than English or who are deaf or hard of hearing, and provision usually will be a health care operations function of the covered entity, as defined at 45 CFR 164.501.
The provider may use and disclose an individual’s PHI when using an interpreter without authorization in the following ways.
- When the interpreter is a member of the health care provider’s work force, as defined at 45 CFR 160.103.
- When the provider engages the services of a person who is not a work force member to perform interpreter services on its behalf, as a business associate, as defined at 45 CFR 160.103.
In addition, a covered health care provider may, without the individual’s authorization, use or disclose PHI to the patient’s family member, close friend, or any other person identified by the individual as his or her interpreter for a particular health care encounter. In those situations, that interpreter is not a business associate of the health care provider.
As with other disclosures to family members, friends, or other people identified by an individual as involved in his or her care, when the individual is present, the covered entity may obtain the individual’s agreement or reasonably infer, based on the exercise of professional judgment, that the individual does not object to the disclosure of PHI to the interpreter.
Using a telephone interpretation service
Similarly, if the provider encounters a patient who speaks a language for which the provider has no employee, volunteer member of the work force, or contractor who can interpret competently, but is able to identify a telephone interpreter service to communicate with the patient, the use of that service is acceptable — without a business associate agreement — if the provider reasonably concludes that the patient has chosen to be assisted by the interpreter.
Organizations that are subject to both HIPAA and Title VI must comply with the requirements of both laws, although not all HIPAA-covered entities are recipients of federal financial assistance and thus required to comply with Title VI, and not all recipients of federal financial assistance are also HIPAA-covered entities, subject to the privacy rule.
HIPAA-covered entities also may be required to comply with the Americans With Disabilities Act and/or Section 504 of the Rehabilitation Act of 1973, both of which have requirements for the provision of sign language and oral interpreters for people who are deaf or hard of hearing.
The use of communications assistants as part of a telecommunications relay service was the subject of a previous FAQ available at www.hhs.gov/ocr/hipaa.
When a health care provider covered by the Health Insurance Portability and Accountability Act (HIPAA) uses an interpreter to communicate with an individual, that individuals authorization is not required for the disclosure of protected health information to the interpreter, as long as certain conditions are met.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content