How to Navigate HIPAA Compliance When Preserving Hospice Patient Stories

The HIPAA Question Every Life Story Program Must Answer

When a hospice team captures a patient's life story, they are handling information about a patient. Some of that information may qualify as protected health information (PHI) under HIPAA. The question every program must answer clearly is: Where does clinical care end and personal storytelling begin — and how do we manage the boundary?

The good news is that HIPAA does not prohibit life story work. It requires that patient information is handled with appropriate authorization, safeguards, and documentation. A well-structured life story program can be fully HIPAA-compliant without compromising the richness of the stories captured.

Understanding What Is and Is Not PHI

Not everything a patient shares during a life story session is PHI. HIPAA protects health information — data that relates to a patient's health condition, treatment, or payment for healthcare services, combined with identifying information.

Not PHI (and not subject to HIPAA):

• The patient's childhood stories
• Their career history
• Their family relationships
• Their hobbies and interests
• Their personality traits and habits
• Their wisdom, advice, and life lessons
• Photos of the patient from their personal life

Potentially PHI (subject to HIPAA):

• The patient's diagnosis or medical condition
• Their treatment details
• Their hospice admission status
• Clinical observations by the care team
• Information shared in the context of clinical care

The distinction matters because life story content is overwhelmingly non-PHI. A patient telling their wedding story, describing their favorite vacation, or recording a message for their grandchild is sharing personal information, not health information.

Authorization: The Foundation of Compliance

Regardless of PHI considerations, best practice requires explicit patient or family authorization before capturing and sharing any content:

Create a life story authorization form. This is separate from the general consent for treatment. It should cover:

1. What is being captured: Stories, photos, audio recordings, video recordings
2. Who will access the content: Family members, memorial contributors, and potentially the public (if the memorial is not password-protected)
3. How the content will be used: Preservation in a digital memorial for the family
4. The patient's rights: The right to withdraw authorization, the right to review content before sharing, the right to exclude specific stories
5. Data storage and security: Where the content is stored and how it is protected

Keep the form simple and in plain language. A two-page legal document will discourage participation. A one-page form with clear checkboxes facilitates it.

For patients who cannot sign: Obtain authorization from the healthcare proxy, legal guardian, or designated decision-maker. Document verbal assent from the patient if they can communicate agreement non-verbally (nodding, squeezing a hand).

Separating Clinical Documentation from Memorial Content

The most important structural decision is keeping clinical documentation and life story content in completely separate systems.

Clinical chart: Contains assessments, care plans, progress notes, medication records, and all PHI. Stored in the electronic health record (EHR). Subject to HIPAA protections, access controls, and retention requirements.

Memorial platform: Contains stories, photos, audio recordings, and contributed memories. Stored on the memorial platform. Subject to the life story authorization and the platform's privacy policies. Not part of the medical record.

The firewall rules:

• Staff should never copy clinical observations directly into the memorial platform
• Clinical information (diagnosis, medications, symptoms) should not appear in the memorial
• If a patient mentions their diagnosis during a life story session ("I've been fighting cancer for three years"), the clinical detail can be included only if the patient authorizes it specifically
• Staff notes about patient responses ("She smiled when she heard the song") are observational and personal, not clinical — these belong in the memorial, not the chart

Staff Training on Privacy Boundaries

Train all life story team members on:

What to capture: The patient's personal stories, memories, personality, voice, and messages. The human being, not the medical case.

What not to capture: Clinical details, treatment discussions, medication names, staff clinical opinions, or any content that the patient has not specifically authorized.

What to do with ambiguous content: When in doubt, ask the patient or family: "You mentioned your surgery — would you like that to be part of the memorial, or would you prefer to keep it private?" Let the patient define the boundary.

How to handle inadvertent PHI capture: If a voice memo or note includes clinical information that was not authorized, edit it before uploading to the memorial platform. Remove the clinical detail and preserve the personal content.

Platform Security Requirements

The digital memorial platform must meet basic security standards:

• Encryption in transit and at rest — All data should be encrypted during upload and during storage
• Access controls — Only authorized family members should be able to view or contribute to a memorial
• Data backup — Content should be backed up to prevent loss
• Privacy settings — Families should be able to choose whether the memorial is public, password-protected, or accessible only by invited contributors
• Data deletion capability — If a family requests that a memorial be removed, the platform must be able to delete all associated data

Note: The memorial platform is not required to be HIPAA-compliant as a business associate if it does not store PHI. By keeping clinical information out of the memorial platform, you avoid triggering business associate agreement requirements — simplifying compliance significantly.

Consent for Photos and Recordings

Special considerations apply to multimedia content:

Photos of the patient: Authorization should explicitly cover photographic content. Some patients are comfortable with stories but not photos — respect this boundary.

Audio recordings: Ensure the patient knows they are being recorded and has authorized it. In some states, recording consent requires specific verbal acknowledgment on the recording itself.

Video recordings: Same consent requirements as audio, with added consideration for the patient's physical appearance during illness. Some patients are comfortable being recorded early in their stay but not later when their appearance has changed.

Photos and recordings of staff: If hospice staff appear in photos or recordings with the patient, ensure staff consent as well.

Creating a Compliance Checklist

Provide your life story team with a simple checklist:

• Life story authorization form signed by patient or authorized representative
• Patient has been told what will be captured and how it will be used
• No clinical information is included in memorial content (unless specifically authorized)
• Memorial content is stored in the memorial platform, not in the clinical chart
• Multimedia recordings include consent acknowledgment
• Family has been informed about privacy settings and their options
• Content has been reviewed for inadvertent PHI before publishing

When a Patient Dies

After the patient's death, HIPAA protections continue for 50 years. However, the life story content — already separated from clinical information — is not affected because it was captured under a separate authorization and does not contain PHI.

The family now controls the memorial. They can:

• Add new content
• Invite additional contributors
• Change privacy settings
• Request deletion

Your hospice's role transitions from content creator to content steward — maintaining the platform and supporting the family's ongoing use during the bereavement period.

Ready to launch a HIPAA-compliant life story program with confidence? Join the LifeTapestry waitlist and get a platform built with privacy-by-design architecture that keeps patient stories and clinical data cleanly separated.