Yes. The HIPAA Privacy Rule permits a covered doctor or hospital to disclose protected health information to a person or entity that will assist in notifying a patient’s family member of the patient’s location, general condition, or death. See 45 CFR 164.510(b)(1)(ii). The patient’s written authorization is not required to make disclosures to notify, identify, or locate the patient’s family members, his or her personal representatives, or other persons responsible for the patient’s care. Rather, where the patient is present, or is otherwise available prior to the disclosure, and has capacity to make health care decisions, the covered entity may disclose protected health information for notification purposes if the patient agrees or, when given the opportunity, does not object. The covered entity may also make the disclosure if it can reasonably infer from the circumstances, based on professional judgment, that the patient does not object. See 45 CFR 164.510(b)(2).
Even when the patient is not present or it is impracticable because of emergency or incapacity to ask the patient about notifying someone, a covered entity can still disclose a patient’s location, general condition, or death for notification purposes when, in exercising professional judgment, it determines that doing so would be in the best interest of the patient. See 45 CFR 164.510(b)(3).
Under these circumstances, for example:
A doctor may share information about a patient’s condition with the American Red Cross for the Red Cross to provide emergency communications services for members of the U.S. military, such as notifying service members of family illness or death, including verifying such illnesses for emergency leave requests.
A hospital may ask police to help locate and communicate with the family of an individual killed or injured in an accident.
A hospital may contact a patient’s employer for information to assist in locating the patient’s spouse so that he/she may be notified about the hospitalization of the patient.