Under HIPAA, when may a health care provider warn family or others about a serious and imminent threat?

• A. Only with patient consent regardless of threat
• B. When there is a serious and imminent threat to health or safety, consistent with professional ethics and state law
• C. Never; HIPAA forbids such disclosure
• D. Only if the patient waives rights in writing

Answer: (B)

The key idea is that HIPAA allows a provider to disclose patient information without consent when there’s a serious and imminent threat to health or safety, and the disclosure is made in a way that’s consistent with professional ethics and applicable state law. In such urgent situations, sharing with the person or parties at risk (or appropriate authorities) is permitted to prevent harm, and disclosure should be limited to the minimum necessary information. This aligns with the ethical duty to protect others from imminent danger and with state laws that govern how and to whom such warnings may be given.

This explains why the option requiring consent in all cases isn’t correct and why a blanket prohibition isn’t correct either. It also clarifies that a patient’s rights aren’t restricted by a must-have written waiver in these acute scenarios; consent is not always required when there’s an imminent threat.