HIPAA Today

Dealing with friends and relatives

By Walter L. Fitzgerald Jr., R.Ph., J.D.

Can spouses pick up prescriptions, or printouts of prescriptions dispensed, for each other? Can a neighbor or someone else pick up a patient's prescription? What do you do if someone calls or comes to the pharmacy and requests protected health information (PHI) on a patient? Answers to these often-asked questions are provided in the HIPAA privacy standards at 45 CFR 164.510.

As a reminder, a pharmacy may use or disclose PHI, without patient authorization, if a patient is (1) informed in advance of the use or disclosure and (2) allowed the opportunity to agree to, prohibit, or restrict it. Of course, if the patient prohibits or restricts the disclosure, you could not disclose the PHI. Informing in advance may be achieved through the Notice of Privacy Practices (NOPP). In addition, paragraph (b) of section 164.510 allows the pharmacy to orally inform a patient of, and obtain a patient's oral agreement or objection to, a permitted use or disclosure.

As to the questions above, paragraph (b) permits a pharmacy to disclose to a patient's family member, other relative, close personal friend, or other person identified by a patient PHI directly relevant to such person's involvement in a patient's care or payment for care. This assumes that the pharmacy gave the patient an NOPP describing uses or disclosures in relation to a family member, other relative, close personal friend, or other person identified by the patient, and the patient did not place a prohibition or restriction on the use or disclosure. If the NOPP does not describe such use or disclosure, the pharmacy may orally inform a patient of the use or disclosure and then obtain a patient's oral agreement or objection. Thus it is realized that an NOPP should contain a description of uses or disclosures of PHI made to a family member, other relative, close personal friend, or other person identified by a patient.

The requirements stated in paragraph (b) must also be satisfied. First, the use or disclosure may be made only to a family member, other relative, close personal friend, or other person identified by a patient. Second, even if the person is one of these four, use or disclosure may occur only if the person is involved in a patient's care or payment for care. Third, only that PHI directly relevant to the person's involvement in care or payment may be used or disclosed. Thus it is understood that in some situations the pharmacy may need to confirm the relationship of a person to a patient, and, further, that a person is involved in a patient's care or payment.

To demonstrate: At 10 am, Dr. Smith calls in a prescription for a topical antiviral for Becky Jones, who is single, 23 years of age, and a regular patient who previously received an NOPP. The NOPP given to Becky describes uses or disclosures to a family member, other relative, close personal friend, or other person identified by a patient. In reviewing Becky's patient profile, you do not find a medical condition for which the topical antiviral is indicated. At 12:40 pm, Becky arrives at the pharmacy drive-through window. You go to the window to ask her questions, including the medical condition for the prescription, and see three other people in the car. You do not know their relationship to Becky, and, further, whether they are involved in her care or payment for care. Applying paragraph (b), you should inform Becky that you have questions and need to counsel her about the medication, and arrange to talk with her privately.

Contrast this with Becky driving up to the window with her elderly mother to pick up her mom's prescription, and her mother having previously been given an NOPP describing uses or disclosures to a family member, other relative, close personal friend, or other person identified by a patient. You recognize both, are aware of their relationship, and know that Becky is involved in caring for her mother.

Another example is a community pharmacy with a private, in-pharmacy charge account system. At month's end, a statement is mailed to a family member, other relative, close personal friend, or other person identified by the patient, for payment. The statement contains the patient name, prescription number, dispensing date, and medication name. Such disclosure of PHI is permissible if the pharmacy either (1) informed the patient in advance of such a disclosure through the NOPP or (2) orally notified the patient of such disclosure. And with either method, the patient did not prohibit or restrict such use or disclosure.

But what do you do if the patient has not been given an NOPP and is not present? Paragraph (b) provides that if the patient has not been informed, either by the NOPP or orally, and an opportunity to agree or object to the use or disclosure cannot practicably be provided because of the patient's incapacity or an emergency circumstance, the pharmacy may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the patient. If it is, the pharmacy may disclose only the PHI directly relevant to the person's involvement with the patient's health care. The pharmacy may use professional judgment and its experience with common practice to make reasonable inferences of the patient's best interest in allowing a person to act on behalf of the individual to pick up filled prescriptions or other similar forms of PHI.

Section 164.510 also addresses other uses or disclosures of PHI, including for disaster relief purposes and to notify or assist in notifying a family member, personal representative, or other person responsible for a patient's care of the patient's location, general condition, or death. Because of the frequency of persons other than the actual patient requesting prescriptions and other forms of PHI from a pharmacy, reviewing all of section 164.510 is encouraged.

The author, a pharmacist-attorney, is a professor of pharmacy at the University of Tennessee College of Pharmacy and author of the NCPA HIPAA Compliance Handbook for Independent Pharmacy. To access the NCPA Web site, go to: www.ncpanet.org .

Walter Fitzgerald. HIPAA Today: Dealing with friends and relatives.

Drug Topics

May 19, 2003;147:46.