Office for Civil Rights

HIPAA Privacy Rule: Disclosures for Emergency Preparedness - A Decision Tool

Who is the source of the information to be disclosed?

YES, the source of the information is the individual.

The individual may disclose the information. The Privacy Rule applies only to covered entities and not individuals!

The Privacy Rule does not apply to individual consumers. Individuals may disclose information to any person without regard to the Privacy Rule.
For example, a consumer may provide information directly to anyone without an authorization.

The Privacy Rule limitations on disclosure of PHI apply to persons who are workforce members of a covered entity, such as employees, volunteers, board members and contractors. So while individual consumers or patients may share information about themselves, nurses or other hospital or medical staff are bound by the privacy protections of the Privacy Rule and may only disclose the information as the Privacy Rule permits.

Last revised: June 27, 2006

The White House | USA.gov | Helping America's Youth