HIPAA Disclosures to Family and Friends – Of Course I Want My Spouse to Know/Not Know!

02/25/2026
Live Webinar
37 day
14 hr
23 min
43 sec

This webinar explores how to handle disclosures to support systems in all forms, whether it be a spouse, other family member, a friend, or caregiver, and how to weigh a patient’s preferences with the need to effectively communicate status updates, decision making, and care instructions.

Under the HIPAA Privacy Rule, health care providers are permitted to share a patient’s protected health information (PHI) with family members, spouses, friends, or other persons involved in the individual’s care or payment responsibilities, but there are important conditions and safeguards that must be observed. First is the requirement of patient consent. Some patients would want their significant other to know, and others – absolutely not!

Fundamentally, the Privacy Rule seeks to respect and protect patient privacy while still recognizing that personal relationships and caregiving roles often require transparent communication about an individual’s health situation.

If a patient is present and capable of making their own health care decisions, a provider may disclose relevant health information to family members or friends only with the patient’s agreement or after offering the chance to object and the patient does not object. This means verbal consent can suffice in many routine situations, such as explaining mobility limitations to a friend who will be assisting the patient after discharge or discussing treatment with an adult child helping to manage care.

When the patient is not present, unavailable, or incapacitated, HIPAA still allows disclosures if, in the provider’s professional judgment, sharing the information is in the patient’s best interest. For example, during emergency care where the patient cannot communicate, a clinician might update a spouse about a heart attack and ongoing treatment decisions. Similarly, a physician may discuss details by phone with a family member if it will benefit the patient’s care.

Importantly, the Privacy Rule extends beyond legally recognized relatives. A covered entity may share PHI with any individual identified by the patient (including close friends, caregivers, partners, or others involved in care or payment of sad care) without having to verify their legal status. This flexibility ensures that support persons in all forms can be informed when appropriate.

Patients who want to make sure their providers communicate with specific people are encouraged to proactively discuss their preferences with their health care team. A formal advance directive or written authorization can further guide providers and ensure that the right people receive the right information when consent might otherwise be uncertain.

Ultimately, this area of HIPAA balances patient autonomy, privacy protections, and practical needs for communication and is central to understanding when and how PHI can be appropriately disclosed to spouses, family, and friends.

Focus as well on state licensure laws and how they can apply to this situation.

Areas Covered in the Session

  • Overview of HIPAA Privacy Rule permissions
  • Conditioners where a provider may disclose PHI with patient agreement or non-objection
  • Who can qualify as a recipient
  • Professional judgement and best interest standards
  • Practical steps patients can take
  • Examples of State Licensure Laws that Apply to the Health Care Professional

Who will Benefit?

Healthcare providers who have patients with support systems

Why should you Attend?

One should attend so that they are aware of patient preferences regarding communication and instances where information can be given when preferences are unable to be given or are unclear.

Date: 02/25/2026

Time: 12:00 pm - 1:00 pm (EST)

Reg. deadline: 02/24/2026

Venue: Live Webinar

Enrollment option

Speaker

Mark R. Brengelman
Mark holds Bachelor’s and Master’s degrees in Philosophy from Emory University and a Juris Doctorate from the University of Kentucky. Retiring as an Assistant Attorney General, he now represents: health care professionals; two government health care licensure boards; a government ethics commission, and; parents and kids in confidential child abuse and neglect cases, termination of…

Related Events

The Future of Telehealth
Compliance Webinars
Live Webinar

The Future of Telehealth

Telehealth completely changed in 2020 when the Public Health Emergency was put into effect. Now in 2025, many of those temporary changes are expiring and the telehealth business has exploded. These methods of communication between provider and patient are loved by many, and the convenience of telehealth in healthcare has become a common occurrence. This webinar will be reviewing the current parts of telehealth that are being considered permanent in the 2026 Physicians Fee Schedule Final Rule and the new evaluation and management services that are new codes for CPT in 2025 related to telehealth. We will find out what the do’s and don’ts of telehealth that are here to stay, as well as implementing these new codes and regulations into your practice. These new rules and codes are important to any one currently offering telehealth as well all who are considering it to add it to their practice in order to be compliant and maximize reimbursement for the services performed. Areas Covered in this Webinar The CMS Telehealth List and how to use it Medicare’s rules G codes for Medicare telehealth CPT addition of 17 codes to the E/M section for Telehealth Education for office staff Implementation on your software programs Who Will Benefit Physicians Advanced Nurses Physicians Assistant Billers Coders Compliance Managers Administrators Case Managers Claims Processors

HIPAA Breach Risk Assessment for Ransomware Attacks
Compliance Webinars
Live Webinar

HIPAA Breach Risk Assessment for Ransomware Attacks

HIPAA Breach Risk Assessments determine whether a Ransomware attack constitutes a HIPAA Breach that triggers Breach Notification Rule reports and notifications. A Ransomware attack is automatically presumed to be a HIPAA Breach unless you do a HIPAA Breach Risk Assessment that demonstrates the attack resulted in only a low probability of compromise to the affected protected health information (PHI). This webinar explains how to do a Ransomware HIPAA Breach Risk Assessment. The Problem Solved by this Webinar The HHS Office for Civil Rights (OCR) declared that a breach of unsecured PHI is presumed to have occurred when electronic protected health information (ePHI) is encrypted as the result of a ransomware attack on a HIPAA-regulated entity (health care provider, health plan, health care clearinghouse, or business associate). The entity must then comply with the applicable breach notification provisions, including notifying affected individuals without unreasonable delay, the Secretary of HHS, and the media (for breaches affecting over 500 individuals), in accordance with HIPAA breach notification requirements. However, it is not a breach if the ransomware-victimized entity can demonstrate that there is a low probability that the encrypted ePHI has been compromised. This webinar explains how to do that. Areas Covered in the Webinar A Breach Risk Assessment can determine whether a ransomware attack is a breach of unsecured ePHI, triggering embarrassing reports and notifications. Factors that can be applied in performing a Breach Risk Assessment. OCR’s guidance about specific factors that can demonstrate a low probability of compromise to ePHI encrypted by a ransomware attack. How to perform a Breach Risk Assessment step-by-step. How to document a Breach Risk Assessment and why you must document it. What to do if you cannot demonstrate a low probability of compromise to ePHI. Why You Should Attend This Webinar Attend this webinar to learn how to perform a Breach Risk Assessment with a special emphasis on ransomware attacks. Ransomware attacks may have only a low probability of compromising ePHI. A Breach Risk Assessment can determine whether a ransomware attack resulted only in a low probability of compromise to ePHI and provide Covered Entities and Business Associates with Documentation to overcome the presumption that the ransomware attack was a Breach.. Who Will Benefit Health Care Covered Entities HIPAA Compliance Officials – Privacy and Security Officers Chief Compliance Officer Practice Managers Health Information Technology Supervisors Risk Managers Group Health Plan Administrators Third Party Group Health Plan Administrators Covered Entity Senior Management and Owners Health Care Providers practicing as individuals or in small groups Attorneys for Covered Entities – In-house and Outside Counsel Business Associates HIPAA Compliance Officials – Privacy and Security Officers Chief Compliance Officer Business Associate Senior Management and Owners Risk Managers Attorneys for Business Associates – In-house and Outside Counsel

HIPAA in 2026: What Changed, What’s Coming, and What It Means for Your Organization
Compliance Webinars
Live Webinar

HIPAA in 2026: What Changed, What’s Coming, and What It Means for Your Organization

Over the last few years, the U.S. Department of Health and Human Services, Office for Civil Rights has made modifications to patient privacy requirements. The agency is on track for enhancing care coordination, empowering patients, and reducing administrative burden. In addition, on the Security Rule side, the agency released a proposed rule to overhaul significant requirements and make cybersecurity safeguards a priority. Knowing what an organization must do to meet these new regulatory requirements can be challenging. The webinar will address what has already changed in privacy, cover proposed Privacy Rule modifications, and cover the Security Rule overhaul proposals. Timeline and compliance implications will be covered. After completing this webinar, a Covered Entity or Business Associate will have a clear understanding of what has changed and what will change. Objectives Who Must Comply with HIPAA Requirements? What are the HIPAA Security and Privacy Rules? What Has Already Changed in Privacy? What are the Proposed Privacy Rule Modifications? What are the proposed Security Rule modifications? What is the Timeline & Compliance Implications? What recommendations should be followed now? Q&A Webinar Highlights Learn from an expert on the implementation of the HIPAA rules Understand what the HIPAA management process currently requires Learn how to implement these changes for your organization Who Should Attend Compliance Officer HIPAA Privacy Officer HIPAA Security Officer Medical/Dental Office Managers Practice Managers Information Systems Manager Chief Information Officer General Counsel/lawyer Practice Management Consultants Any Business Associates that access protected health information

Pros & Cons of Outsourcing Revenue Cycle Functions: What You Need to Consider
Compliance Webinars
Live Webinar

Pros & Cons of Outsourcing Revenue Cycle Functions: What You Need to Consider

Many providers have considered outsourcing functions in the revenue cycle. Like all businesses, some third-party companies do excellent work for providers, but there may be others that look for ways to take advantage of their provider. Outsourcing has its own pros & cons that must be carefully considered. We will review major common areas that providers must weigh strategically before making a decision whether to outsource and selecting the best partner for your needs. It is vital providers know exactly who is handling their claims and what they are doing with their information. Definitions of third-party vendors Legal responsibilities of the provider Common industry trends Important questions to ask vendors & contractors Who Will Benefit Physicians Practice managers Medical assistants Nurses Compliance staff Billers Coders Revenue Cycle Risk Management Mid level providers