A lead care coordinator wants to convene everyone on a care team, including healthcare providers and non-healthcare providers, to figure out how to find a client who has been missing and out of contact for several weeks. The client has missed several appointments to pick up important cardiac and seizure medications, but because the lead care coordinator did not get a release of information up front, they don’t know what to do next.

Can they bring the group together and share information about the person? If they don’t, the client might not get their medications and would likely end up in the hospital. If they do, they could possibly find the client and get them their medications.

But what do the rules say? 

Complex care relies on this type of collaboration across healthcare, behavioral health, and social service settings. Coordinating care often means sharing patient information, but navigating ethical responsibilities and complex privacy laws can feel challenging. Trainings on information sharing rarely reflect the realities of delivering complex care, instead opting to focus on HIPAA compliance and often – intended or not – scaring providers with threats of confidentiality breaches and fines.

This is why the Camden Coalition created a new course, Sharing information, written by people who understand the day-to-day of providing complex care. It’s not a formal HIPAA training or legal advice; instead, it’s a course written in plain language and meant to de-mystify what providers can and can’t do with patient information. It provides skills and practices necessary for complex care like getting a release of information (ROI), talking about consent, and comfortably sharing information for care coordination.

1. Share information for care coordination.

Best practice is to have a signed ROI before sharing information. When that’s not feasible or in emergency situations, the Health Insurance Portability and Accountability Act (HIPAA) recognizes the importance of coordination among providers and authorizes people to communicate for care coordination without explicit consent. For example, the lead care coordinator mentioned in the beginning who wants to pull together a team to talk about a client who hasn’t been seen for weeks can do so even though they don’t have a signed ROI.

2. Legal compliance is only a baseline; your information sharing practice should match the client’s interests and preferences.

A 2020 study found that most adults want their providers to exchange health information. Use legal requirements as the baseline and then consider and create practices focused on determining what your patient would want you to share. For example, if you don’t have a signed ROI but have heard from your patient in the past that they want you to coordinate with their other providers, you can share information with confidence – and get a signed ROI as soon as possible.

3. Getting a release of information is a powerful engagement tool, especially early in the relationship.

You can use the process of collecting a release of information to help you explain what complex care and care coordination are and learn about your client’s preferences and support network. Although a release of information is best practice, consent is a conversation that goes beyond just a signed piece of paper. Having the conversation early in the engagement means that when a crisis hits, or you can’t reach the person, you have what you need to coordinate their care in accordance with their wishes.

4. One release of information can cover multiple providers and organizations.

When possible and consistent with the patient’s preferences, instead of naming a specific person with whom information can be shared, name an organization or simply write “all my care providers” on a release of information. This allows you to continue coordinating care through staff turnovers and care changes.

5. Clients have likely signed other releases of information.

The patient doesn’t have to sign your release for you to share information. If they’ve signed another release that says that your type of organization (e.g., treating providers) can share information, you can do so.

Provider-approved training

For a full training on the goals and importance of sharing information, how to talk with individuals about sharing information and gaining consent, and when consent is not required to share information, check out the course, Sharing information.

Sharing information was originally developed as a standard training for the Vermont Agency of Human Services and their partners and has been taken over 150 people. Those who have taken the course say:

• I recommend this course for anyone who works in a field where sharing information with HIPAA is part and parcel of every day.

• I am less intimidated by all the rules around what and when info can be shared.

• I will be able to guide the people I supervise in the rules of properly sharing information.

For more information, visit the Camden Coalition Learning Center.