Doctor-patient confidentiality and HIPAA are not the same thing. Confidentiality comes from professional ethics and state law, and the ethical duty applies to the clinician personally. HIPAA is a federal law that governs how covered practices and their vendors handle patient information. The two overlap, and when they give different answers, the strictest rule that applies wins.
A patient tells your front desk that releasing anything "violates doctor-patient confidentiality." An hour later, a staff member refuses to hand a husband his wife's visit summary, with the wife standing right there nodding, "because of HIPAA." Both invoked a real thing. Both pointed at the wrong rulebook.
Doctor-patient confidentiality and HIPAA are related, overlapping, and not the same. There are actually three layers of law and duty here, and knowing which one is in play decides real questions: who can sue, who enforces, and what your policies must say.
Doctor-Patient Confidentiality and HIPAA: The Three Layers
Layer 1: Professional Ethics
The oldest layer. Medical, dental, and mental health professions impose confidentiality duties on clinicians personally, through ethical codes and state licensing boards. This duty follows the clinician everywhere, applies regardless of how the practice bills, and is enforced by boards that can discipline a license. It predates HIPAA by centuries and survives it completely.
Layer 2: State Privilege and Privacy Law
"Doctor-patient privilege" is, strictly speaking, a rule of evidence: state law that lets a patient keep their medical information out of court testimony and discovery (the stage of a lawsuit where each side gathers evidence). The privilege belongs to the patient, not the doctor, and the patient can waive it, which happens routinely when someone puts their health at issue in a lawsuit. Alongside privilege, many states also have medical privacy statutes, and those are the laws that let a patient actually sue over a disclosure.
Layer 3: HIPAA
HIPAA is a federal law. It sets rules for how covered entities (the health plans, clearinghouses, and providers the law applies to) handle PHI (protected health information) day to day. The same rules reach business associates, the vendors that handle patient data for them. The rules say what may be used or shared, and how it must be kept secure. OCR (the HHS Office for Civil Rights) enforces HIPAA through complaints, investigations, and penalties.
Two boundaries surprise people. First, HIPAA binds organizations that meet the covered entity definition, not clinicians as humans in all contexts, and a cash-only practice that never bills electronically may fall outside it entirely, while layers one and two still apply in full. Second, there is no private right of action: a patient cannot sue you under HIPAA. They complain to OCR, and if they want damages, they sue under layer two.
Where the Layers Give Different Answers
Talking to family is the classic HIPAA myth. Nothing in HIPAA gags a provider from speaking with a spouse or family member: 45 CFR 164.510(b) permits sharing information directly relevant to a person's involvement in the patient's care when the patient does not object, and permits professional judgment when the patient is incapacitated. The staff member who stonewalled the nodding wife was not following HIPAA. She was following folklore about HIPAA.
Subpoenas run the other direction. HIPAA may permit a disclosure in litigation once its conditions are met, while state privilege law still blocks it, because privilege is the patient's to assert. Permitted under HIPAA never means required, and the full analysis is in the subpoena article.
Death changes nothing quickly. The ethical duty survives the patient, many state privileges survive too (check your state), and HIPAA protects a decedent's records for 50 years, covered in the deceased patients article.
Which One Controls?
For disclosure decisions, the practical rule is simple: the strictest applicable layer wins. HIPAA sets a federal floor and explicitly yields to more protective state law. So a practice's policies cannot be written from HIPAA alone; they have to absorb the state's stricter pieces, which is why generic national policy templates need state review before adoption. For enforcement, the layers run in parallel: one bad disclosure can simultaneously generate an OCR complaint, a state lawsuit, and a board complaint. Three rulebooks, three referees, one mistake.
The starting point for the federal layer is what HIPAA actually is, and the patient-facing view of these rights is in the patient rights guide.
FAQ
Can a patient sue a practice under HIPAA?
No. HIPAA has no private right of action. That means a patient cannot sue under HIPAA itself. Patients file complaints with OCR, which can investigate and penalize. Lawsuits for damages run under state privacy and negligence law instead.
Is talking to a patient's family a HIPAA violation?
Usually not. 45 CFR 164.510(b) permits sharing information directly relevant to a family member's involvement in care when the patient does not object, and permits professional judgment when the patient is incapacitated.
Does doctor-patient confidentiality survive the patient's death?
Yes, in all three layers. The ethical duty continues, state privilege rules often continue after death (check your state), and HIPAA protects the records for 50 years after death.
Which is stricter, HIPAA or state confidentiality law?
It varies by topic and state. HIPAA is a federal floor and defers to more protective state law, so for any given disclosure the strictest applicable rule controls.
Does HIPAA apply to a cash-only practice that never bills insurance?
Possibly not. HIPAA covers providers who send health information electronically as part of a standard transaction, such as an insurance claim. A practice outside that definition still owes full confidentiality duties under ethics rules and state law.
Practices do not need to become legal scholars. They need policies that satisfy all three layers at once, written once and trained annually. That is what One Guy Consulting's Full-Scope plan builds, with 1:1 implementation calls for the situations that do not fit the policy. Start with a free 30-minute intro call. No obligation, no pressure.
Sources
- 45 CFR 164.510 (uses and disclosures with opportunity to agree or object)
- 45 CFR 160.203 (preemption; more stringent state law)
- HHS: covered entities and business associates
Related Reading
Related reading: HIPAA vs FERPA: Who Covers the School Nurse and the Campus Clinic