Custodial Care Issues: The Geriatric Patient

Providers often feel unsure about what information they can disclose about their patients when the disclosure is related to that patient’s safety and wellbeing. This blog post, the first in a series addressing custodial care issues, offers guidance to practices on how to help their geriatric patients without violating their privacy.

The Case

Norman, a 78-year-old widower, visits his physician’s office twice per year so he can keep an eye on his blood pressure. Ordinarily, Norman is cheerful and well-groomed, but he has come in with unkempt hair and disheveled clothes. He has dark circles under his eyes, and he has lost a significant amount of weight since his last visit. His physician tried to broach the issue with Norman, but he made it clear that he was not interested in discussing his health. His physician has checked Norman’s file and seen that the only emergency contact listed is his recently deceased wife. Can the physician help Norman, and if so, how?

The Authority

HIPAA’s Privacy Rule vests covered entities with a certain degree of discretion when it comes to protecting the wellbeing of their patients. Under HIPAA, a provider may use or disclose protected health information (PHI) to identify or locate a family member or other person involved in the patient’s wellbeing. Once a patient representative is identified, the next step is to determine whether the provider is allowed to share PHI with them, and how much.

Determining whether and how much PHI a provider may disclose often depends on the circumstances of the patient. For example, if the patient is deceased, a covered entity may disclose PHI to the patient’s family member or friend so long as that disclosure does not conflict with any known preference of the patient. If the patient is present and has the mental capacity to make health decisions, HIPAA allows disclosure so long as the patient is given an opportunity to object and does not. As a third example, in cases of emergency where consent cannot be obtained, a provider may rely upon his or her professional judgment to determine whether disclosure is in the best interest of the patient. In all of the above scenarios, however, the patient’s consent or lack of an objection is a relevant consideration.

Significant to this case, however, there are certain uses and disclosures for which the patient’s authorization or opportunity to agree or object is not required. Specifically, a covered entity may use or disclose a patient’s PHI if two conditions are met. First, the provider must believe in good faith that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of the patient. Second, HIPAA requires the disclosure to be to a person who is reasonably able to prevent or lessen the threat.

The Result

In this case, Norman should most likely be treated as a present patient. His condition and appearance are concerning, but the provider has not observed any signs that would indicate that Norman lacks the capacity to make health care decisions. And although Norman appears to be doing worse than he was on his last visit, his condition does not yet rise to the level of an emergency that prevents consent from being obtained. To the contrary, Norman understands the questions being asked of him and has simply refused to allow the conversation to go any further.

Despite Norman’s obstinance, his physician may still be able to take further action to protect Norman’s health and wellbeing. While Norman’s rapid decline may not look like an emergency, his doctor may believe in good faith that it qualifies as a serious and imminent threat to his health. If so, and his care team is able to locate a nearby family member or friend who is able to get involved, the provider may disclose Norman’s PHI as may be relevant and necessary for Norman’s representative to get him help.

Tips on Dealing with Disclosure Rules

To help mitigate the risks stemming from custodial issues with geriatric patients, we recommend providers take the following steps:

• Ask patients to update their emergency contact information at least once per year
• Make sure emergency contact forms invite patients to list two or three people as emergency contacts to avoid situations where the only contact is unavailable
• Remind patients that they do not mean to pry and are only interested in their wellbeing

Disclaimer: This post is written in general terms and is not a substitute for legal advice or intended to create an attorney-client relationship.