How to Keep a Nursing Home Search Moving Without Sending Private Records Everywhere
A nursing-home search can quickly create a privacy problem: one hospital referral, three family emails, screenshots in a group text, and copies of the same medical records sent to facilities that may never review the case.
Families need enough information moving to get an admission decision. They do not need to scatter sensitive records across unverified inboxes.
The practical goal is to keep one current care summary, confirm each facility’s intake channel, and let the responsible health-care teams send the clinical detail that is actually needed.
Start with a non-record screening summary
Before sending a full chart, ask admissions what information it needs for an initial screen. A short factual summary can often establish whether the facility is worth pursuing.
Include only what is relevant to care fit, such as:
- current location and anticipated transition date;
- mobility and transfer assistance;
- cognition and supervision needs;
- major treatments or equipment;
- diet/swallowing needs;
- wound, dialysis, oxygen, or other significant services;
- therapy needs;
- payer being explored; and
- a contact person authorized to coordinate the search.
Avoid including Social Security numbers, financial account numbers, full insurance identifiers, or a lifetime medical history in an ordinary email just because a facility has not yet told you what it needs.
NHP’s one-page senior-care emergency binder guide can help families organize facts, but an organizational summary is not a substitute for formal clinical records.
Confirm the intake channel before sending records
Ask:
“What secure channel should the hospital or current provider use for your clinical review, and whose attention should the referral go to?”
Record the answer. The facility may use a referral portal, health-information exchange, secure fax, encrypted email, electronic health-record connection, or another approved process.
Do not assume the email address used for marketing, a website contact form, or a staff member’s personal email is appropriate for protected health information.
If a hospital or clinician is sending the referral, let that organization use its approved disclosure and transfer process. Do not copy records out of a secure clinical workflow merely so the family can forward them faster.
Understand what HIPAA does and does not require
HIPAA applies to covered entities and business associates—not automatically to every family member who possesses a copy of a record. HHS explains that covered health-care providers, health plans, and certain other entities must follow the HIPAA rules; a private individual generally is not transformed into a HIPAA-covered entity simply because they hold a relative’s records.
That does not make casual sharing a good idea. Families still have strong reasons to protect privacy, respect the person’s wishes, and use secure channels.
Also, be precise about the HIPAA “minimum necessary” rule. HHS states that disclosures for treatment purposes between health-care providers are explicitly exempt from the minimum-necessary requirement. Therefore, a family should not tell two providers that HIPAA forbids them from exchanging a full record when the treating providers determine it is needed for treatment.
A safer family rule is: do not personally distribute more information than the search requires, and let covered providers follow their own lawful treatment-disclosure procedures.
Get the resident’s wishes and authority clear
If the person can make their own decisions, involve them in where information is sent and who may receive updates.
HHS explains that covered providers may share information directly relevant to care or payment with family or others involved in the person’s care when the HIPAA conditions are met. A legally recognized personal representative may have broader access rights depending on applicable law.
Do not assume being an adult child automatically gives unrestricted authority to request or redistribute every record. When authority is unclear, ask the provider what documentation it requires and obtain legal advice for disputed situations.
Keep a referral-status log instead of another copy of the chart
Track the referral without storing detailed medical content in the log.
| Facility | Intake channel confirmed? | What was requested? | Sent by whom? | Date | Review status | Next action |
|---|---|---|---|---|---|---|
| Facility A | Yes — secure fax | Current clinical packet | Hospital | Oct. 15 | Nurse review pending | Call admissions tomorrow |
| Facility B | No | Initial summary only | Family | Oct. 15 | Awaiting intake instructions | Ask for secure channel |
| Facility C | Yes — portal | Therapy + medication update | Current provider | Oct. 15 | Declined | Record reason; close referral |
The log answers “where are we?” without duplicating the sensitive content itself.
Close the loop when a facility is no longer under consideration
When a community is no longer a candidate, mark the referral closed. If the family created an account or uploaded documents to a portal, ask the provider what retention, access, or account options apply; do not assume the family can require clinical records to be erased immediately.
For your own copies, avoid leaving documents in shared download folders, public cloud links, or family group chats. Use device and account protections appropriate to sensitive personal information.
Know when a full clinical record really may be necessary
A nursing facility must make a real clinical decision, and some cases require extensive information. Complex medications, recent hospitalization, wounds, dialysis, respiratory support, behavior changes, and other needs may require more than a one-page summary.
The point is not to withhold clinically important information. It is to route detailed records deliberately through confirmed channels instead of repeatedly forwarding them ad hoc.
Federal nursing-home transfer rules, for example, require appropriate information to be communicated to a receiving health-care institution or provider when a resident is transferred or discharged from a certified nursing facility. Safe transitions can require detailed information.
Use NHP’s admission documents checklist when a facility is moving from initial screening toward real admission.
A hypothetical example
A daughter contacts six nursing homes after her father is hospitalized. Instead of attaching his 70-page discharge record to six ordinary emails, she sends each admissions office a brief care summary and asks for its approved clinical-referral channel.
Two facilities say they cannot meet his dialysis transportation needs and never need the full chart. Three provide secure intake routes and the hospital sends the requested records. One does not respond and receives no sensitive packet.
The search moves forward with fewer copies of the record floating around and no loss of clinically necessary information.
A simple privacy-and-progress rule
For every new facility, answer four questions:
- Is this facility a serious candidate based on the basic care summary?
- What clinical information does it need next?
- What secure intake channel should the responsible provider use?
- Who will follow up on the admission decision, and when?
That keeps the referral process moving while reducing unnecessary family-side copying and forwarding.
Sources and scope
Sources checked October 15, 2026. This article is general privacy and care-navigation information, not legal advice. HIPAA applies differently depending on who is sending information, why it is being sent, and whether the sender is a covered entity or business associate. State privacy laws and provider policies may add requirements.
