tphillips78
HIPAA does not require the total absence of information available to friends, family, or the media. Hospitals are allowed to have patient directories available to the public. For instance, one can call hospital X and ask if Friend Citizen is in that hospital and what is the status of Friend Citizen. Unless the patient has 'opted out' of being included in the patient registry, the hospital can provide the caller with Friend Citizen's room number and a status report such as stable, guarded, poor, etc. Of course, hospitals may opt out of providing a registry; but, if the hospital has a registry, the information I listed is available to the family, friends, and the press.
The unscrupulous person in the OP's description is the attorney who held himself out to be in need of contacting the patient. In the strictest application of HIPAA, it is possible that the OP's name should not have been released as the name of the patient would not be provided to a person who is not involved in any aspect of providing or securing initial or continuing healthcare. However, if the hospital worker who released the OP's name did so while believing the attorney was directly related to continuing healthcare needs of the patient, then the hospital worker did not violate HIPAA in releasing the OP's name. Releasing a cell phone number was the right choice as opposed to releasing the OP's home telephone number, or work telephone number, or street/mailing address. A cell phone number maintains the person's privacy. In these ways, the hospital worker complied with HIPAA--releasing only 'need to know' information and releasing the absolute minimal information.
The information released would not allow anyone to identify the OP from any number of persons with the same name. Absolutely no information about medical history or treatment was provided.
The OP received a HIPAA notice at the hospital and had the opportunity to state that he wanted absolutely no information about him released to anyone for any reason. He did not state such.
EC