HIPAA, Privacy Laws, and Prayer Lists

	Prayer Lists - How to Protect Privacy
	Prayer Requests Policies and Procedures
	Prayer Requests Privacy Issues
	Privacy Rules and Churches
	Sample Prayer Request Form for Privacy Considerations

Non-legal observations (see "Disclaimer"):

In general the following points apply to churches, privacy laws, and prayer lists:

1. HIPAA Privacy Rules do not generally apply to a church's disclosure of health related information on prayer lists.
2. Generally, churches were not violating privacy laws / HIPAA before these laws were enacted.
3. The traditional ways churches have handled prayer lists usually do not violate privacy laws / HIPAA
4. With regard to church procedures for handling prayer requests and publishing prayer lists, the general principles below could apply:
   1. Although consent is not legally required in most circumstances, if it is easily obtainable, then obtain it.
      1. The church secretary of staff member would respond when given a prayer request, "Would you mind if we shared this information with the congregation?", or, "Would you like us to add you to our prayer list?"
      2. As a routine practice, oral consent should be sufficient, unless the church is disclosing particularly sensitive information
   2. Less is best - publish only general and not specific information on prayer lists
   3. DO NOT publish detailed, health related prayer concerns about church employees, including pastors as separate rules apply to employers releasing information about employees.
   4. Most of the time the following rule will apply when weighing how much information to publish on a prayer list:  If I am in the hospital, how much detail do I want released about my condition?
5. Place any online prayer lists behind a login on the church website for members only.