FAQs: Facility directories

A facility directory is a record maintained by a healthcare facility to provide limited patient information to individuals who ask about them, like family, friends, or clergy. This directory typically includes a patient’s name, location within the facility, general condition (e.g., stable, critical), and religious affiliation (for clergy only).

Here are some FAQs related to facility directories:

What information can be included in a facility directory?

The HIPAA Privacy Rule allows the following information in a directory:

• Patient’s name
• Location in the facility
• General condition (e.g., stable, critical)
• Religious affiliation (shared with clergy only)

How are patients informed about facility directories and their rights?

Healthcare providers must notify patients about:

• The directory’s purpose
• The information included
• Their right to opt-out or restrict what information is shared

How does the HIPAA Privacy Rule handle directory disclosures during emergencies?

In emergencies or disaster situations, facilities can disclose directory information to help locate or identify patients, provided such disclosures align with HIPAA guidelines.

Read also: Understanding permissible disclosures in an emergency

Can a facility directory disclose PHI to the media?

No, facility directories cannot disclose information to the media unless the patient specifically authorizes the release of their information.

Who can access information from a facility directory?

• General inquiries: Friends, family members, or others who ask for the patient by name.
• Clergy: They may access the patient’s name, location, and religious affiliation unless the patient opts out.

What happens if a patient cannot communicate their preferences?

If the patient is incapacitated or unavailable to communicate their choices, healthcare providers can include the patient’s information in the directory based on professional judgment until the patient can make their preferences known.

Read also: Caring for incapacitated patients

What happens if a patient changes their mind about being included in the directory?

Patients can update their preferences at any time. Healthcare providers are required to honor the patient’s new instructions promptly and document the change.

Related: What to do when an individual revokes authorization

What safeguards must facilities implement to protect directory information?

Facilities must:

• Ensure that only authorized individuals can access the directory.
• Limit the type of information disclosed to what is permitted under HIPAA.
• Have policies to address patient privacy concerns and protect against unauthorized access.

Are outpatient facilities, like clinics, required to maintain a facility directory?

No, the requirement to maintain a facility directory primarily applies to inpatient settings, such as hospitals, where patients stay for longer periods. Outpatient facilities are not obligated to maintain directories under HIPAA.

See also: HIPAA Compliant Email: The Definitive Guide