Top Tips for Engaging Patients' Families While Staying HIPAA Compliant

"I'm her husband. Can you just tell me how she's doing?"

Every front desk and care team has heard variations of that question. The caller sounds worried, and the answer seems harmless enough. But one careless reply can turn a kind gesture into a privacy violation.

Families play an important role in patient care. They drive patients to appointments, pick up prescriptions, and help manage treatment plans at home. Shutting them out can hurt the quality of care, while saying too much can put your practice at legal risk.

That's why so many providers hesitate when a relative asks for details. The Health Insurance Portability and Accountability Act (HIPAA) protects health information from people who aren't authorized to see it. Yet it also gives you room to involve the people your patients trust. The challenge is recognizing where that line sits.

Real situations rarely arrive with instructions. Think about a telemedicine visit where you and your patient are discussing a sensitive health concern. Halfway through, a relative walks into the room and joins the conversation. Do you continue the discussion, or pause?

Now consider a phone call from a patient's sister who wants to review her brother's history of substance use treatment. She explains that the family is worried and needs to know more. Do you release those records?

These situations happen every week in busy medical practices, and the right answer depends on a few clear rules that many teams have never been trained on.

Fortunately, HIPAA is far more flexible than most providers realize. Once you understand what it allows, you can support families confidently instead of relying on guesswork.

Below, we'll walk through common scenarios, what HIPAA says about each one, and the habits that keep your practice HIPAA compliant when you communicate with your patients' families.

The Patient Decides Who Hears Their Health Information

HIPAA's most important rule on family disclosure is simple. The decision belongs to the patient. Some patients want their spouse involved in every detail. Others prefer to keep even immediate relatives at a distance.

Under the HIPAA Privacy Rule, you may share health information with a spouse, family member, or friend the patient names as involved in their care. You can also share it if the patient agrees, or doesn't object when given the chance. In some cases, you can use professional judgment to infer that the patient is fine with it.

For example,

A patient who brings their daughter into the exam room likely expects her to hear the discussion.

What to Do When a Relative Joins a Telehealth Visit

Let's return to that telemedicine visit. When a relative enters, pause the conversation. Ask your patient, privately if you can, whether they want to keep going with the other person there.

If they say yes, you can continue, since their agreement is all HIPAA requires. If they hesitate or decline, offer to reschedule or politely ask the relative to step outside.

Why You Should Document the Agreement

HIPAA allows verbal permission to include a family member, so you don't need a signed authorization form. Still, it's smart to note the patient's agreement in their medical record after the visit.

A short note protects your team if questions come up later, and it tells the next provider who the patient trusts with their information.

What HIPAA Allows When a Patient Can't Speak for Themselves

Sometimes a patient can't give permission. They may be unconscious after an accident, sedated, or too ill to make decisions. In these cases, HIPAA lets you rely on your professional judgment.

You may share information with family members if you decide it's in the patient's best interest. Keep it limited to what relates to that person's role in the patient's care.

The Privacy Rule also lets you use judgment and common practice to allow a relative to act for the patient in everyday tasks,

Such as:

• Picking up filled prescriptions
• Collecting medical supplies
• Picking up X-rays or similar health records

Once the patient is able to decide again, ask them. Their wishes take over from that point on.

When a Patient Wants to Keep Family Out of the Loop

If an adult patient doesn't want a family member to know about their condition, you must respect that. It doesn't matter how close the relative is or how worried they seem. A clear "no" from the patient means no.

However, a few situations follow different rules, depending on the patient's age, condition, or type of record:

That last row answers the phone call from the worried sister. If she's asking about records from a substance use disorder program covered by Part 2, a verbal request isn't enough. In most cases, you'll need the patient's written consent before you share anything.

For patients who have passed away, share only what's relevant to the relative's role in care or payment. Unrelated medical history, such as an old health issue that has nothing to do with that role, should remain private.

How to Notify Family After an Emergency

Your patient is brought in after a car crash. Their family doesn't know yet. Can you call them?

Yes. HIPAA allows you to notify a family member, personal representative, or another person responsible for the patient's care. You can tell them about the patient's location, general condition, or death.

These steps help keep the call compliant:

1. Confirm who you're speaking with. HIPAA doesn't require proof of identity from family members, but you can set your own reasonable checks.
2. Check whether the patient can agree. If they're awake and able, ask them before you share.
3. Stick to the basics. Location, general condition, or death are fine for a notification call.
4. Share more only when it's relevant. Any further details should relate to the relative's role in care or payment.
5. Record what you shared. Note who you spoke with and what you told them.

The same rules apply no matter how you communicate. With the patient's permission, you can share information in person, over the phone, by text, or in writing.

Just keep it relevant. For example, don't bring up a past condition that has nothing to do with the patient's current care.

Quick Tip: Make "Ask, Limit, Document" Your Default

Here’s What We’ve Said So Far

Based on these discussions about engaging with patients’ families while remaining HIPAA compliant,

It is clear that the following conditions are crucial to your decisions about talking to family members:

• Gathering the patient’s permission or allowing them to agree or object to disclosing PHI to a family member
• Using professional judgment
• Following the minimum necessary rule provided by HIPAA
• Obtaining the patient’s written or verbal consent

Also, the HIPAA Privacy Rule does not require a healthcare provider to obtain a patient’s written consent when they agree to disclose PHI to a relative. However, you are free to get or document the patient’s agreement in writing, or you may note it in the patient’s medical record.

Suppose you have to disclose PHI to a family member via text message. In that case, the HIPAA Security Rule requires appropriate technical measures to ensure the confidentiality and security of electronic PHI (ePHI). To ensure that your practice complies with the standards of the Security Rule, you must use a HIPAA-compliant system to text a patient’s family member without having to worry about disclosing PHI.

Support Families Without Putting Patient Privacy at Risk

Families want to help, and your patients often want them involved, too. HIPAA doesn't stand in the way of that. It simply asks you to put the patient's wishes first.

Most situations come down to three questions. Did the patient agree, and if they can't, what's in their best interest? Is the information you're sharing directly related to this person's role in care? When your team can answer those questions quickly, family conversations stop feeling risky.

Clear policies make a real difference. Train your staff on the common scenarios in this guide, and give them a simple script for unexpected calls and visitors. Most importantly, make documentation a consistent habit rather than an afterthought.

The right communication tools matter, too. Families today expect quick updates, and many would rather receive a text than wait on hold for a phone call. Secure messaging lets you keep relatives informed without exposing ePHI on personal phones or unprotected apps. It also creates a clear record of every update you send.

Curogram gives your practice a HIPAA-compliant way to text patients and, with their permission, the family members involved in their care. Messages are secure, easy to send, and simple to track. Text messages have a 98% open rate, so important updates actually get read. Curogram can also reduce phone call volume by as much as 50%, which frees your front desk to focus on the patients in front of them.

The result is smoother communication for families and less stress for your staff. Patients get the support they need from the people they trust, and their private health information stays protected throughout the entire process.

Ready to make family communication easier and safer for everyone involved? See how Curogram's HIPAA-compliant texting works and discover how it can fit into your practice's daily workflow.

Frequently Asked Questions