Under the Privacy Rule, when a patient lacks capacity due to incapacity or emergency, the provider may disclose to family if...

• A. Disclosing is allowed anytime when the patient is not present.
• B. Disclosing to family should be avoided entirely.
• C. Disclosing is in the patient’s best interests.
• D. Disclosing requires the patient’s explicit consent.

Answer: (C)

When a patient cannot make decisions due to incapacity or an emergency, the Privacy Rule allows sharing PHI with family or others who are involved in the patient’s care if doing so is in the patient’s best interests to support treatment and safety. This isn’t a blanket permission to disclose anytime the patient isn’t present; it’s a careful balance that prioritizes helping care and protecting the patient, while limiting information to what’s necessary. Explicit consent isn’t feasible in these moments, but the disclosure should still respect the patient’s known preferences and aim to inform about care. If possible, once the patient regains capacity, inform them about what was shared.