Hospitals and health systems are responsible for protecting the privacy and confidentiality of their patients and patient
information. The Health Insurance Portability and Accountability Act (HIPAA) mandates regulations that govern privacy standards for healthcare information.  HIPAA regulations specify the purposes for which information may and may not be released without authorization from the patient. This media guide is modeled after guidelines established by the American Hospital Association and endorsed by Utah Hospital Association. This document explains the guidelines Utah hospitals are required to follow when responding to media inquiries.

Under HIPAA guidelines, information about the condition and location of an inpatient, outpatient or emergency department patient may be released only if the inquiry specifically contains the patient’s name. No information may be released by the hospital if a request does not include a specific patient’s name. As long as the patient has not requested that information be withheld, hospitals will use the following terms to describe a patient’s condition*:

The death of a patient may be reported by the hospital, following notification of next of kin. Information about the cause of death must come from the patient’s physician, and its release must be approved by the decedent’s personal representative (next of kin or legal representative). Hospitals cannot share information with the media on the specifics about sudden, violent or accidental deaths, as well as deaths from natural causes, without the permission of the decedent’s personal representative.

*The term “stable” should not be used as a condition. Furthermore, this term should not be used in combination with other conditions

Under HIPAA guidelines, patients can choose to “opt out” of providing any information on their hospital stay. The patient has the option to expressly state that he or she does not want information released—including confirmation of his or her presence in the facility. If a patient is unable to state a preference about having information released, the patient will be considered to have “opted out.” In other words, no information about the patient, including confirmation of his or her presence in the facility, will be released unless the patient’s personal representative authorizes release of the patient’s one-word condition. Federal laws also prohibit hospitals from releasing any information regarding patients being treated for alcohol or substance abuse.

Matters of Public Record refer to situations that are reportable by law to public authorities, such as law enforcement agencies, the coroner or public health officers. While laws and/or regulations require healthcare facilities to report a variety of information to public authorities, HIPAA regulations prohibit the release of information in response to calls or other inquiries from the media without patient consent. Patients who are involved in matters of public record have the same privacy rights as all other patients. The mode of transportation by which a patient arrives at the hospital has no bearing on the information that the hospital can release about the patient. Only the one-word condition may be given.

The media should not attempt to contact patients directly. Instead, interview requests should be made through a public relations or other designated hospital representative. Consent by the patient is required to allow the release of additional information, interviews or the taking of photographs. If the patient is a minor, permission for any of these activities must be obtained from a parent or legal guardian. Hospitals may deny the media access to the patient if it is determined that the presence of photographers or reporters would interfere with patient care or aggravate the patient’s condition. Permission from patients or guardians through social media channels does not constitute permission to access patients who are in the care of medical facilities.