A patient tells your front desk that releasing anything "violates doctor-patient confidentiality." An hour later, a staff member refuses to hand a husband his wife's visit summary, with the wife standing right there nodding, "because of HIPAA." Both invoked a real thing. Both pointed at the wrong rulebook.
Doctor-patient confidentiality and HIPAA are related, overlapping, and not the same. There are actually three layers of law and duty here, and knowing which one is in play decides real questions: who can sue, who enforces, and what your policies must say.
Doctor-Patient Confidentiality and HIPAA: The Three Layers
Layer 1: Professional Ethics
The oldest layer. Medical, dental, and mental health professions impose confidentiality duties on clinicians personally, through ethical codes and state licensing boards. This duty follows the clinician everywhere, applies regardless of how the practice bills, and is enforced by boards that can discipline a license. It predates HIPAA by centuries and survives it completely.
Layer 2: State Privilege and Privacy Law
"Doctor-patient privilege" is, strictly speaking, a rule of evidence: state law that lets a patient keep their medical information out of court testimony and discovery. The privilege belongs to the patient, not the doctor, and the patient can waive it, which happens routinely when someone puts their health at issue in a lawsuit. Alongside privilege, most states also have medical privacy statutes, and those are the laws that let a patient actually sue over a disclosure.
Layer 3: HIPAA
HIPAA is a federal regulation governing how covered entities and business associates handle P.H.I. (Protected Health Information) day to day: what may be used, disclosed, and how it must be secured. It is enforced by OCR through complaints, investigations, and penalties. Two boundaries surprise people. First, HIPAA binds organizations that meet the covered entity definition, not clinicians as humans in all contexts, and a cash-only practice that never bills electronically may fall outside it entirely, while layers one and two still apply in full. Second, there is no private right of action: a patient cannot sue you under HIPAA. They complain to OCR, and if they want damages, they sue under layer two.
Where the Layers Give Different Answers
Talking to family is the classic HIPAA myth. Nothing in HIPAA gags a provider from speaking with a spouse or family member: 45 CFR 164.510(b) permits sharing information relevant to a person's involvement in the patient's care when the patient does not object, and permits professional judgment when the patient is incapacitated. The staff member who stonewalled the nodding wife was not following HIPAA. She was following folklore about HIPAA.
Subpoenas run the other direction. HIPAA may permit a disclosure in litigation once its conditions are met, while state privilege law still blocks it, because privilege is the patient's to assert. Permitted under HIPAA never means required, and the full analysis is in the subpoena article.
Death changes nothing quickly. The ethical duty survives the patient, most state privileges survive too, and HIPAA protects a decedent's records for 50 years, covered in the deceased patients article.
Which One Controls?
For disclosure decisions, the practical rule is simple: the strictest applicable layer wins. HIPAA sets a federal floor and explicitly yields to more protective state law. So a practice's policies cannot be written from HIPAA alone; they have to absorb the state's stricter pieces, which is why generic national policy templates need state review before adoption. For enforcement, the layers run in parallel: one bad disclosure can simultaneously generate an OCR complaint, a state lawsuit, and a board complaint. Three rulebooks, three referees, one mistake.
The starting point for the federal layer is what HIPAA actually is, and the patient-facing view of these rights is in the patient rights guide.
---
FAQ
Can a patient sue a practice under HIPAA?
No. HIPAA has no private right of action. Patients file complaints with OCR, which can investigate and penalize. Lawsuits for damages run under state privacy and negligence law instead.
Is talking to a patient's family a HIPAA violation?
Usually not. 45 CFR 164.510(b) permits sharing information relevant to a family member's involvement in care when the patient does not object, and permits professional judgment when the patient is incapacitated.
Does doctor-patient confidentiality survive the patient's death?
Yes, in all three layers. The ethical duty continues, state privilege rules often continue after death (check your state), and HIPAA protects the records for 50 years after death.
Which is stricter, HIPAA or state confidentiality law?
It varies by topic and state. HIPAA is a federal floor and defers to more protective state law, so for any given disclosure the strictest applicable rule controls.
Does HIPAA apply to a cash-only practice that never bills insurance?
Possibly not. HIPAA covers providers who transmit standard electronic transactions, typically billing. A practice outside that definition still owes full confidentiality duties under ethics rules and state law.
Conclusion
Practices do not need to become legal scholars. They need policies that satisfy all three layers at once, written once and trained annually. That is what One Guy Consulting's Full-Scope plan builds, with consulting hours for the situations that do not fit the policy. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.510 (uses and disclosures with opportunity to agree or object)
- 45 CFR 160.203 (preemption; more stringent state law)
- HHS: covered entities and business associates
Related Reading