Information Privacy and Security

Releasing Patient Information

When a family member calls from out of town and wants information on a patient, how do we know when it’s okay to release the information?

Telephone communication about patient information is challenging since you cannot physically confirm the identity of the caller.  HIPAA frequently references “reasonable precautions” that need to be taken to safeguard the privacy of our patient’s information. Therefore, several “verification” steps might be available for you to use as “reasonable precautions.”  Please see the link below for suggested verification steps:

                                                Suggested Steps

Prior to treatment the patient could also complete the following authorization forms:

Unless there is an ongoing treatment relationship between the caller and the patient, always remember to follow the “minimum necessary rule” in releasing only the minimum amount of information necessary to satisfy the need. The minimum necessary rule does not apply for ongoing treatment needs.
Please call the Privacy Office at 936-3594 for additional information or email us at Privacy.Office@vanderbilt.edu.


This page was last updated December 6, 2011 and is maintained by