When family calls with concerns, listening is not sharing

A call with two different requests

Hypothetical clinic example: A woman calls and introduces herself as a patient's daughter. She says her father has stopped opening his exercise handout. Then she asks whether he attended his last appointment.

The staff member has not established a basis to share information with her. The caller knowing the clinic's name does not resolve that question.

There are now two tasks. One is receiving the daughter's concern. The other is deciding whether the clinic may answer her attendance question.

The staff member need not turn the first task into the second. They can explain the clinic's general process for submitting concerns without confirming treatment or discussing appointments. The concern can follow the clinic's review process. That does not make the daughter's interpretation a verified finding.

Start with the direction of the information

HIPAA defines disclosure as releasing information outside the entity holding it. Its definitions in 45 CFR 160.103 distinguish that from receiving information.

The rule separately permits a covered clinic to use information for its own treatment activities, subject to other applicable requirements. See 45 CFR 164.506(a) and (c)(1).

That is not a reciprocal right for the caller. The clinic still needs a permitted or required basis for disclosing protected information under 45 CFR 164.502(a).

Even a reply without a diagnosis can reveal patient information. The definition of identifiable health information includes information about providing care. Confirming an appointment or treatment relationship can therefore disclose more than the staff member intended.

Important distinction: No signed release is not the same as no permitted way to share information. 45 CFR 164.510 includes oral agreement and other specified circumstances. Its family-involvement provision limits sharing to information directly relevant to the person's involvement.

This guide assumes the clinic has not established an applicable basis to disclose information to this caller. It does not assume that family relationships create unrestricted access.

Offer a process, not a patient update

Here is suggested wording for your privacy lead to review:

"I can explain how our clinic receives concerns. I cannot confirm or discuss anyone's care in this conversation."

Then describe the process your clinic actually uses. Do not promise a callback, clinical action or review time that the clinic cannot deliver.

That wording is a HepBuddy suggestion, not government-approved language. Check the whole conversation, not only the script. Saying "I'll put this in his chart" can undo a careful opening by confirming a treatment relationship.

A caller may ask why you cannot answer. Avoid explaining a named patient's permission choices. Explaining the clinic's general privacy process is different from saying the patient refused to let you talk.

For the separate question of sharing during an agreed visit, see when a family member joins a PT appointment. If the patient has asked for updates to stop, use the stop-updates guide alongside your clinic's policy.

Hand off the concern without turning it into a finding

For an ordinary, nonurgent concern, we suggest this manual handoff record. Adapt it to your clinic's existing documentation and privacy policies. It is not a required form or a HepBuddy feature.

In the hypothetical example, record that the daughter reports the handout was not opened. Do not convert that into "patient did no exercises." The report describes what one person says they saw.

Keep the message within your clinic's approved communication and record processes. Do not create a separate private folder to avoid the normal rules.

If a concern may be urgent, use your existing clinical escalation process. This routine handoff is not an emergency protocol or a reason to wait until the next appointment.

Do not improvise a promise of secrecy

The caller may ask, "Can you keep this from them?"

Do not assume that a family message automatically stays outside the patient's access rights. HIPAA generally gives patients access to information about themselves in a designated record set, with exceptions. That includes medical records and certain records used to make decisions about individuals. See 45 CFR 164.501 and 45 CFR 164.524(a)(1).

There is a specific exception in section 164.524(a)(2)(v). Access may be denied when:

• The information came from someone other than a health care provider.
• It was obtained under a promise of confidentiality.
• The requested access would be reasonably likely to reveal the source.

Those conditions do not create a blanket guarantee that every family message will remain secret. Nor does the rule say every message must always be disclosed.

Ask your privacy lead before offering assurances. Decisions about withholding records also have separate requirements in section 164.524(d). This article does not provide a record-denial procedure.

Practice the distinction before a real call

Use the invented daughter-and-handout example in a staff discussion. Have one person offer the concern and ask for an appointment update.

Ask the listener to explain your actual intake process without confirming care. Then check whether the handoff preserves the source of the report and names the next responsible person.

Finally, add the request for secrecy. The useful finish is not a perfect script. It is staff recognizing which decision needs clinical review and which needs privacy review.

This is a federal HIPAA overview, not legal advice. More protective state privacy laws can still apply. It is not a complete policy for emergencies, minors, incapacity, personal representatives or specially protected records. Have your privacy lead and counsel review those situations.

For the separate job of agreeing on supportive roles, see family support without nagging. For a product overview, see HepBuddy.