9. May we release PHI to the Red Cross, without the patient's Authorization?
Yes. The Department of Health and Human Services created an exemption to the HIPAA regulations allowing
doctors, or their representative, to share information about a patient with the American Red Cross for the purposes of
providing emergency communications. This exemption is provided under 45 CFR 164.510(b)(1)(ii) and 45 CFR
164.510(b)(3). This information is also provided on the H&HS website at http://answers.hhs.gov.
The exemption reads as follows:
The HIPAA Privacy Rule permits a covered doctor or hospital to disclose protected health information to a person
or entity that will assist in notifying a patient's family member of the patient's location, general condition, or
death. See 45 CFR 164.510(b)(1)(ii). The patient's written authorization is not required to make disclosures to
notify, identify, or locate the patient's family members, his or her personal representatives, or other persons
responsible for the patient's care. Rather, where the patient is present, or is otherwise available prior to the
disclosure, and has capacity to make health care decisions, the covered entity may disclose protected health
information for notification purposes if the patient agrees or, when given the opportunity, does not object. The
covered entity may also make the disclosure if it can reasonably infer from the circumstances, based on
professional judgment that the patient does not object. See 45 CFR 164.510(b)(2).
Even when the patient is not present or it is impracticable because of emergency or incapacity to ask the patient
about notifying someone, a covered entity can still disclose a patient's location, general condition, or death for
notification purposes when, in exercising professional judgment, it determines that doing so would be in the best
interest of the patient. See 45 CFR 164.510(b)(3).
Under these circumstances, for example, a doctor may share information about a patient's condition with the
American Red Cross for the Red Cross to provide emergency communications services for members of the U.S.
military, such as notifying service members of family illness or death, including verifying such illnesses for
emergency leave requests.
Return to FAQ List