Privacy, HIPAA & Prayer Ethics

Share the need without sharing the person’s identity. Use broad language, disclose only what prayer partners truly need to know, and leave out names, contact information, exact locations, workplaces, photographs, dates, and unusual details.

No. HIPAA applies to covered health plans, health care clearinghouses, certain health care providers, and their business associates. A ministry is not automatically a HIPAA-covered entity. Other privacy laws, contracts, professional duties, and ethical responsibilities may still apply.

For a HIPAA-covered entity or business associate, protected health information generally means individually identifiable health information held or transmitted in covered form. It may include diagnoses, treatment, payment information, medical record details, and identifiers connected to health information.

No. Information can be sensitive and harmful even when HIPAA does not govern it. FOFMI’s ethical standard is to protect dignity, confidentiality, safety, and trust regardless of whether a particular law applies.

No. A private disclosure to a minister does not automatically authorize posting it on a prayer wall, announcing it during worship, forwarding it to a group, or sharing it on social media.

Use clear, informed, preferably written permission that states what information may be shared, with whom, through which channel, for what purpose, and for how long. If the permission is unclear, do not identify the person.

Treat a person’s withdrawal seriously. Stop future sharing promptly, remove information where reasonably possible, and tell the privacy leader or administrator if the information has already spread beyond the original audience.

Yes, but keep it general and anonymous unless that adult has clearly authorized the identifying details. A caring intention does not replace the other person’s right to privacy.

Use extra caution. Do not post a child’s name, photograph, school, location, diagnosis, family conflict, or custody information. Obtain appropriate parent or legal-guardian permission and follow safeguarding policies and applicable law.

Avoid it unless the person has specifically authorized that public disclosure. Safer wording is “Please pray for healing, strength, wisdom for the care team, and peace for the family.”

Not always. A rare illness, exact age, employer, neighborhood, accident date, family role, or other distinctive facts can identify someone when combined. Remove or generalize those details too.

HIPAA uses a minimum-necessary standard in many covered situations. As an ethical practice, FOFMI applies the same wisdom: share only the least amount of information needed for meaningful prayer.

Describe the prayer goal: healing, comfort, provision, reconciliation, salvation, wisdom, protection, peace, or direction. Example: “Please pray for a family facing a serious medical decision this week.”

No. Never place contact information on the community prayer wall. Give contact information only through an approved private channel when it is necessary for an authorized minister to follow up.

Not on the prayer wall. These materials may reveal names, record numbers, faces, locations, medication details, or other identifiers. Use approved private procedures and proper permission if a leader genuinely needs a document.

No. Messages can be copied, forwarded, photographed, or viewed by unintended people. Share only what every participant is authorized and needs to receive.

Only with specific permission for that public and potentially permanent use. A person who agreed to a small prayer circle may not have agreed to a livestream, recording, broadcast, or social post.

HIPAA permits certain facility-directory disclosures to clergy when the patient has been informed and has not objected, subject to the rule’s conditions. Ministers should follow the hospital’s process and never assume access or permission.

Keep only what is necessary for responsible follow-up. Use access controls, avoid unnecessary medical detail, do not keep copies on shared devices, and follow an approved retention and deletion schedule.

Only authorized people with a legitimate ministry need. Curiosity, leadership title, friendship, or family connection is not enough.

Do not repeat or screenshot it. Notify the administrator promptly, remove or restrict the information where possible, document the response, and obtain qualified legal guidance if a reportable privacy or security incident may have occurred.

Privacy is important, but immediate safety comes first. Contact emergency services when danger is imminent and follow mandatory-reporting and safeguarding requirements. Do not promise absolute confidentiality.

No. Ministers may pray and encourage, but should not diagnose, prescribe, guarantee outcomes, or discourage appropriate professional care.

Ask permission, speak quietly, use general wording, verify recipients, avoid gossip, protect devices and records, correct mistakes quickly, and regularly train everyone who receives prayer requests.

No. It is general educational and ministry-ethics guidance. Laws vary by facts and location. FOFMI should obtain advice from qualified privacy counsel before handling regulated health information or adopting formal compliance policies.