In the aftermath of the nightclub massacre in Orlando, Mayor Buddy Dyer announced that he had requested and received a waiver of medical privacy laws from the White House. Major media outlets immediately began reporting that the waiver was essential for updating families about their loved ones and for treating same-sex partners with dignity.

There was only one problem with this narrative—no waiver was issued, nor was one needed. Sadly, the episode is indicative of larger misconceptions about patient confidentiality that have confused the health care community and even spawned flawed legislation to dilute the privacy rights of the mentally ill.

{mosads}While the government can waive certain hospital requirements in an emergency, doing so requires multiple federal declarations and is both time- and geography-limited. After Hurricane Katrina, for example, the Bush administration waived provisions of the federal privacy regulations in hard-hit states for 72 hours, the maximum period allowable by law. Its impact was limited at best.

Thankfully, such anemic privacy waivers are unnecessary for hospitals to notify or exchange relevant information with patients’ loved ones. In most cases, the Health Insurance Portability and Accountability Act Privacy Rule, or HIPAA, already allows doctors to communicate with a patient’s family, friends, or caretakers.

When patients are present and lucid, HIPAA provides three avenues to discuss their care with family and friends: doctors can ask patients’ permission, rely on their acquiescence, or otherwise use professional judgment to infer they don’t object. A prime example of the latter is when a companion follows the patient into the treatment room.

When patients are absent or incapacitated, doctors can use professional judgment to decide whether talking to a relative or friend is in their best interest. This covers mundane situations, as when patients send their spouse to pick up a prescription, as well as more dramatic events, as when families receive updates while the patient remains unconscious after emergency surgery.

For disaster relief purposes, HIPAA also permits hospitals to share information with organizations like the Red Cross to coordinate notification efforts. The bottom-line is that federal law already anticipates the need for doctors to communicate with patients’ family or friends, whether to ensure that an adult daughter is aware of her elderly father’s mobility limitations, or to notify victims’ loved ones after a tragedy.

This was true before same-sex marriage became the law of the land. HIPAA focuses solely on who is responsible for the patient’s medical affairs, whether it be a friend, relative, or hired health aide. Simply put, the patient’s sexual preference is, and always has been, immaterial.

There is, however, one clear instance where sensitive information cannot be divulged—when the patient is present, has the capacity to make medical decisions, and has specifically asked the doctor not to do so. This is as it should be. Sometimes the last person patients want to tell about their condition is a relative or friend, to prevent either heartache or embarrassment. When clear-headed patients express this wish, doctors must respect it except in rare cases to avert serious and imminent danger.

Indeed, respecting patients’ preferences is integral to the practice of medicine. If not assured of basic confidentiality, people may be dissuaded from seeking care altogether.

Yet myths about HIPAA abound, prompting calls to roll back privacy protections for especially vulnerable patients. Based on the misimpression that the law prohibits information-sharing between doctors and families, some proponents of mental health reform have advocated creating a HIPAA exception for patients diagnosed with “serious mental illness.”

These efforts are well-intentioned but misguided. When patients lack decision-making capacity due to temporary psychosis, doctors can already use professional judgment to act in their best interest. And when patients have made a credible threat or pose a high suicide risk, state laws and professional ethics already impose a “duty to warn.”

Further stigmatizing psychiatric treatment by making HIPAA less protective of mentally ill patients is both counterproductive and unwarranted. In any event, more stringent state laws would trump a weakened HIPAA standard. Thankfully, the House Energy and Commerce Committee recognized this flaw and amended its mental health reform bill accordingly before unanimously passing it earlier this month.

To be sure, HIPAA rumors themselves pose an obstacle by forcing hospitals into a protective crouch. Legal uncertainty fosters a presumption of reticence—a problem exacerbated by errant claims that HIPAA must be overhauled to achieve “compassionate communication.” The privacy rules are lengthy and doctors are busy. That is why the answer lies in commonsense guidance, not waivers or more legislation.

Maj. Charles G. Kels is senior attorney at the American Medical Association and a judge advocate in the Air Force Reserve. Opinions expressed in this article are those of the author alone and do not necessarily reflect those of the Air Force, Department of Defense, or AMA.