Frequently Asked Questions About Family Medical History Information

HHS Logo

OCR Logo

THE HIPAA PRIVACY RULE

Frequently Asked Questions About

Family Medical History Information

U.S. Department of Health and Human Services • Office for Civil Rights

1. Does the HIPAA Privacy Rule limit an individual’s ability to gather and share family medical

history information?

No. The HIPAA Privacy Rule may limit how a covered entity (for example, a health plan or most health

care providers) uses or discloses individually identifiable health information, but does not prevent

individuals, themselves, from gathering medical information about their family members or from deciding

to share this information with family members or others, including their health care providers. Thus,

individuals are free to provide their doctors with a complete family medical history or communicate with

their doctors about conditions that run in the family.

2. Does the HIPAA Privacy Rule limit what a doctor can do with a family medical history?

Yes, if the doctor is a “covered entity” under the HIPAA Privacy Rule. A doctor, who conducts certain

financial and administrative transactions electronically, such as electronically billing Medicare or other

payers for health care services, is considered a covered health care provider. The HIPAA Privacy Rule

limits how a covered health care provider may use or disclose protected health information. The HIPAA

Privacy Rule allows a covered health care provider to use or disclose protected health information (other

than psychotherapy notes), including family history information, for treatment, payment, and health care

operation purposes without obtaining the individual’s written authorization or other agreement. The

HIPAA Privacy Rule also generally allows covered entities to disclose protected health information

without obtaining the individual’s written authorization or other agreement for certain purposes to benefit

the public, for example, circumstances that involve public health research or health oversight activities

es without obtaining the individual’s written authorization or other agreement. The

HIPAA Privacy Rule also generally allows covered entities to disclose protected health information

without obtaining the individual’s written authorization or other agreement for certain purposes to benefit

the public, for example, circumstances that involve public health research or health oversight activities.

When a covered health care provider, in the course of treating an individual, collects or otherwise obtains

an individual’s family medical history, this information becomes part of the individual’s medical record

and is treated as “protected health information” about the individual. Thus, the individual (and not the

family members included in the medical history) may exercise the rights under the HIPAA Privacy Rule

to this information in the same fashion as any other information in the medical record, including the right

of access, amendment, and the ability to authorize disclosure to others.

THE HIPAA PRIVACY RULE AND FAMILY MEDICAL HISTORY

3. Under the HIPAA Privacy Rule, may a health care provider disclose protected health information

about an individual to another provider, when such information is requested for the treatment of a

family member of the individual?

Yes. The HIPAA Privacy Rule permits a covered health care provider to use or disclose protected health

information for treatment purposes. While in most cases, the treatment will be provided to the individual,

the HIPAA Privacy Rule does allow the information to be used or disclosed for the treatment of others.

Thus, the Rule does permit a doctor to disclose protected health information about a patient to another

health care provider for the purpose of treating another patient (e.g., to assist the other health care provider

with treating a family member of the doctor’s patient)

ed to the individual,

the HIPAA Privacy Rule does allow the information to be used or disclosed for the treatment of others.

Thus, the Rule does permit a doctor to disclose protected health information about a patient to another

health care provider for the purpose of treating another patient (e.g., to assist the other health care provider

with treating a family member of the doctor’s patient). For example, an individual’s doctor can provide

information to the doctor of the individual’s family member about the individual’s adverse reactions to

anesthetics prior to the family member undergoing surgery. These uses and disclosures are permitted

without the individual’s written authorization or other agreement with the exception of disclosures of

psychotherapy notes, which requires the written authorization of the individual.

However, the HIPAA Privacy Rule permits but does not require a covered health care provider to disclose

the requested protected health information. Thus, the doctor with the protected health information may

decline to share the information even if the Rule would allow it. The HIPAA Privacy Rule may also

impose other limitations on these disclosures. Under 45 CFR § 164.522, individuals have the right to

request additional restrictions on the use or disclosure of protected health information for treatment,

payment, or health care operations purposes. If the health care provider has agreed to the requested

restriction, then the doctor is bound by that agreement and (except in emergency treatment situations)

would not be permitted to share the information. However, the health care provider maintaining the

records does not have to agree to the requested restriction. For example, an individual who has obtained a

genetic test may request that the health care provider not use or disclose the test results

iction, then the doctor is bound by that agreement and (except in emergency treatment situations)

would not be permitted to share the information. However, the health care provider maintaining the

records does not have to agree to the requested restriction. For example, an individual who has obtained a

genetic test may request that the health care provider not use or disclose the test results. If the health care

provider agrees to the restriction, the information could not be shared with providers treating other family

members who are seeking to identify their own genetic health risks.

Page 2 of 2

The HIPAA Privacy Rule and Family Medical History