September 8, 2026
This story is fictional. If it sounds like your hospital, that’s between you and your privacy officer.
The call came at 2:40 in the morning. I remember because I had just sat down for the first time since eleven.
“I’m looking for my husband. Raymond Dell. The ambulance brought him from the house. Is he there?”
I have worked nights on this unit for nineteen years, and I know that voice. Everyone with a family member in the hospital at 2:40 sounds the same, and so does everyone pretending to be one. “Ma’am, I can’t confirm or deny whether any patient is here.”
“I followed the ambulance. I’m in your parking garage. Level three.”
“Then you’ll want to come to the front desk during visiting hours with identification.” Visiting hours start at eight.
She called back four more times. I logged each call, because if something comes up later you want a record. Around four the unit clerk asked whether we should mention the calls to bed 14, and I told her, clearly, that we do not discuss phone calls with patients without a reason, and I didn’t have one.
Bed 14 was a pleasant man, a retired machinist who had come in with chest pain that turned out to be his gallbladder. He was alert and oriented times four. He asked twice before midnight whether his wife had come, and once more around three, and I told him what I tell everyone, which is that we would let him know.
At 8:05 she came up with her driver’s license and a thermos, and he cried, which surprised the day nurse more than it surprised me. People get emotional after a night in the hospital.
The complaint letter came three weeks later. It went to patient experience, then to my manager, who read it aloud to me in her office. The phrase “hid my husband from me” appears twice. I keep a copy in my locker. In this job nobody ever thanks you for privacy, and I have never once been sorry for being careful.
Before you read on: Did HIPAA require what the nurse did? What could he have told the caller, and on what basis?
HIPAA does not require it, and information blocking might actually prohibit his conduct. Disclosures to family under 45 C.F.R. § 164.510 are permitted, not required, which may account for the nurse’s confusion. The rule allowed nearly everything Mrs. Dell wanted. Medical professionals can often cite “HIPAA” when what they really mean is “my hyper fixation on professional secrecy”.
A hospital may confirm a patient’s presence, location and general condition to anyone who asks for the patient by name, unless the patient took the offered the chance to opt out of the facility directory (§ 164.510(a)). Mr. Dell did not opt out and circumstances suggest he wanted to hear from his wife. “Can’t confirm or deny” is the right answer for a patient who opted out, but on this unit it had inappropriately become the answer for everyone.
A provider may also share with a spouse the information relevant to her involvement in the patient’s care (§ 164.510(b)). When the patient is present and has capacity, the provider can disclose if he agrees, if he has a chance to object and doesn’t, or if the circumstances show he wouldn’t object (§ 164.510(b)(2)). Mr. Dell asked for his wife three times, which is more than enough for the rule, which allows the provider to even just infer from circumstances (e.g., family in the patient’s room when he walks in).
Suspecting an impostor in this situation is unreasonable without evidence, and the nurse could have settled all of this by walking twenty feet to bed 14 and asking, “Your wife is on the phone. May I tell her you’re here and discuss your status?” Train staff that when a family member calls, the next step is to ask the patient, and that the default answer to a patient who wants his wife told is yes.
Takeaway: When in doubt, ask the patient. HIPAA never stops you from asking; this power trip could have been avoided.