HIPAA Facility Directory and Disclosures to Family (45 CFR 164.510)
Permitted disclosures for facility directories, disaster relief, and notification of family or friends involved in care, with individual opportunity to agree or object.
Primary source
45 CFR 164.510 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.510
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.510 permits two categories of disclosure that require the individual the opportunity to agree or object, rather than written authorization.
Facility directories (a)(1): a hospital may include the individual's name, location in the facility, general condition (in non-specific terms), and religious affiliation in a directory available to persons asking for the patient by name (and religious affiliation only to clergy). The individual must be informed and given the chance to restrict or prohibit inclusion.
Disclosures to family, friends, or others (b): the covered entity may disclose PHI directly relevant to the person's involvement in the individual's care or payment, or to notify family of location or condition. Best practice: ask the individual when present, infer permission from circumstances when not, and use professional judgment in emergencies.
The 164.510 pathways are why hospital phone operators can confirm a patient's room, and why a pharmacy can hand a filled prescription to a spouse without paperwork — but only when the policies and operational practices walk those decisions deliberately.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Notice of Privacy Practices (45 CFR 164.520)Covered entities must provide a Notice of Privacy Practices describing how PHI may be used and disclosed and the individual's rights, with specific delivery and posting requirements.
- RegulationHIPAA Personal Representatives (45 CFR 164.502(g))A covered entity must treat a personal representative — including parents of minors and court-appointed representatives — as the individual for purposes of the Privacy Rule, subject to defined exceptions.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
- GlossaryAmendment of PHIThe HIPAA right of an individual to request that a covered entity amend PHI in a designated record set.
- ComplianceAccounting of Disclosures (45 CFR § 164.528): Tracker + ProcedureA 2026 HIPAA Accounting of Disclosures procedure citing 45 CFR § 164.528 — the six-year lookback, what to log, exclusions, and a copy-ready tracker template.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.