Recently I cared for an 86-year-old woman admitted to my unit after a massive stroke. She was unresponsive and not expected to survive. That afternoon, her adult daughter, who lives in another state, called the nurses' station to ask about her mother's condition. The nurse who answered the phone refused to discuss it with her, explaining that when the patient can't give consent, nurses are prohibited from disclosing any information under the federal Health Insurance Portability and Accountability Act (HIPAA) privacy rule.

Not realizing how ill her mother was, the daughter delayed arranging her visit until the next day. When she arrived, her mother was dead.

This doesn't seem right to me. Does HIPAA really prohibit us from disclosing patient information to family members when the patient can't give consent?-L.Y., IOWA

No, but misunderstandings like this are common. Fearful of lawsuits or fines, many health care professionals apply the privacy rule inappropriately, withholding needed health care information from other caregivers, family members, and even patients themselves.

In fact, the HIPAA privacy rule gives health care professionals a great deal of latitude to exercise their professional judgment and common sense. On its Web site, the United States Department of Health and Human Services (HHS) addresses situations like the one you describe. When the patient is incapacitated and unable to give consent, a health care professional may share information about her care "when, in exercising professional judgment, [he] determines that doing so would be in the best interest of the patient."

Conversely, a health care professional may decline to share information in certain circumstances. For example, although parents are normally entitled to see medical records on their minor child, a health care professional may withhold that information if he "reasonably believes, in his or her professional judgment, that the child has been or may be subjected to domestic violence, abuse or neglect."

Because it's complex, HIPAA continues to confuse and frustrate health care professionals and patients alike. Consider asking your facility's risk manager to conduct a staff-development session to outline HIPAA do's and don'ts that affect your practice. She should also make sure facility policies and procedures are in line with HIPAA requirements.

For more information, including answers to frequently asked questions, visit the recently revamped HHS Web site at http://www.hhs.gov/ocr/hipaa.