If a patient’s family member, friend, or other person involved in the patient’s care or payment for care calls a health care provider to ask about the patient’s condition, does HIPAA require the health care provider to obtain proof of who the person is before speaking with them ?
HIPAA does not require the provider to establish proof of identity if speaking to a friend or family member over the phone if the person "is involved in the patient’s care or payment for care."
Under HIPAA a health care provider can share information regarding the patient's condition with a friend, family member, or other individual in certain circumstances. First, a provider may discuss a patient's treatment or condition in the presence of another person if the patient does not disagrees or consents to them being present. For example, if a patient's friend accompanies her on a prenatal visit, then the obstetrician may discuss the patient's progress in front of her friend.
Second, a provider may discuss a patient's condition with a friend or family member if the patient is incapacitated. The provider may only speak about the current medical condition, however. Providers are not required to provide documentation that a patient allowed a friend or family member to be present or that information was shared with a friend or family member in an emergent situation.
Finally, a friend or family member may pick up prescriptions, x-rays or test results on behalf of the patient.