A deacon calls the hospital on a Tuesday afternoon to ask whether a church member has been admitted, and the nurse on the other end tells him she cannot even confirm that the person is a patient there. He hangs up frustrated and a little confused, because the family had told the pastor that morning that she was in the hospital and had asked the church to visit. That evening at the deacon board meeting, someone shrugs and says the magic four letters that end most church conversations about medical privacy: it must be HIPAA. And so the church quietly stops printing hospitalizations in the bulletin, stops naming diagnoses in the prayer chain, and in some cases stops tracking anything about member health at all, because no one on the board is sure where the line is.
Most small church care teams operate somewhere in this fog. Some overcorrect and treat every piece of health information like radioactive material, which slowly starves the care system of the very information it needs to function. Others undercorrect and read out full diagnoses from the pulpit every Sunday, which quietly teaches the congregation not to trust the pastor with anything private. Both patterns come from the same root problem, which is that almost no one at the church has ever read what HIPAA actually says or figured out whether it applies to a church visitation ministry at all. This piece walks through what the law actually covers, what it does not, what small church care teams should do differently in practice, and where realistic confidentiality lines belong on a care team that wants to be trusted.
The Short Answer: HIPAA Does Not Apply to Your Church
The Health Insurance Portability and Accountability Act was written in 1996 to regulate a specific set of organizations that the law calls covered entities. Covered entities are health plans, health care providers who transmit health information electronically, and health care clearinghouses. There is a fourth category called business associates, which covers vendors who handle protected health information on behalf of a covered entity. That is the entire universe of organizations HIPAA applies to. Churches are not on the list. Your visitation ministry, your care team, your deacon board, and your prayer chain are none of the four things HIPAA regulates. The law simply does not apply to you.
This matters because a lot of good instincts inside the church get shut down by a misunderstanding of the law. When someone says we cannot put that in the prayer chain because of HIPAA, they are almost always wrong on the law itself. HIPAA does not prevent a church from writing down that a member is in the hospital, does not prevent a deacon from sharing that a family has asked for prayer, and does not prevent a care coordinator from keeping a note about a diagnosis a member has openly shared. Whether the church should do any of those things is a real question, but it is a question about pastoral discretion and congregational trust, not about federal law.
Why Hospitals Behave Like HIPAA Does Apply, Even Though Not to You
The confusion usually comes from the hospital side of the conversation. Hospitals are covered entities. That means when a deacon calls a hospital and asks whether a church member is a patient, the hospital cannot answer that question without the patient's explicit permission. Under the HIPAA privacy rule, a patient can opt into what is called the facility directory, which lets the hospital share the patient's room number and general condition with people who ask for them by name. If the patient does not opt in, or has declined the directory, the hospital will not even confirm that the person is there. The rule about clergy is slightly different. If a patient has identified themselves as a member of a particular religious affiliation, the hospital may share that with clergy without needing the person's name to be asked for. But the patient still has to have opted in. If they have not, the hospital will refuse to answer even a chaplain.
This is why the pattern of calling the hospital to check on someone keeps failing. It is not that the church is doing anything wrong. It is that the hospital is legally required to keep quiet unless the patient has actively said otherwise, and most patients do not know that opting in is even a decision they can make at admission. The practical fix on the church side is simple. When a member or family tells the church about a hospitalization, the person taking the call should gently coach them to tell the hospital they would like to be listed in the directory and would like their pastor or a specific care contact to be able to visit. This one small habit prevents about ninety percent of the awkward hospital calls that get chalked up to HIPAA.
Prayer Chains, Bulletins, and the Consent Conversation Everyone Skips
Because HIPAA does not apply to the church, the question of what goes in the prayer chain or the bulletin is a matter of consent and trust, not law. That is actually a higher standard, not a lower one. A member who tells the pastor privately that they have been diagnosed with cancer has not thereby authorized the church to announce it from the front on Sunday. They have told one person, in one conversation, and any wider sharing needs their explicit permission. The best small church care teams have a simple habit around this. Whenever a family shares hard news, whoever received the information asks directly, would you like this shared with the elders only, with the whole care team, with the prayer chain, or from the pulpit, and writes the answer down.
Writing the answer down matters, because information decays into oversharing surprisingly quickly. A note that says the Johnsons are asking for prayer, elders only, means the news does not accidentally end up on the general prayer chain three months later when someone new joins the care team and asks who is on the list. The general rule is simple. Whatever the family said yes to is what the church shares, no less and no more, and any expansion of the circle requires going back to the family for permission. Churches that operate this way build the kind of trust that quietly makes people willing to share hard news at all, which is upstream of every other part of a working care system.
Care Notes Are Not Medical Records, But Treat Them Like They Matter
The other place HIPAA gets invoked in small churches is around care notes themselves. A care coordinator keeps a shared roster with notes like visited in hospital on 3/14, spoke with son about mother's dementia, family requesting help with meals through end of month, and someone on the team asks whether keeping notes like that is a HIPAA violation. It is not. Notes a church keeps about its own members, based on what those members and their families have shared with the church, are not protected health information in the legal sense. HIPAA does not touch them at all.
But that does not make care notes safe to treat carelessly. A shared roster is a working record of some of the most private moments in a family's life, and it will outlive the specific care event that created it. The right instinct is to write notes with a five year horizon in mind. Anything that would be uncomfortable to read aloud in front of the family or the whole care team in five years does not belong on the shared roster. Diagnoses and medication details rarely need to be there at all. What the team needs is enough context to actually care for the family, not a medical chart. The rhythm around who touches which family, and how often, is a much more useful thing to record than any specific health detail, and it fits naturally into the cadence covered in how often should deacons contact their assigned families.
What the Church Can Actually Ask For, and How to Ask Well
Because the church is not bound by HIPAA, the constraints on visitation come from the family, not the law. That means the best care teams get very good at asking well. Instead of calling the hospital cold, the care coordinator calls the family first and asks, would it be helpful for the pastor to visit today, and if so, would you like us to come to the hospital or wait until she is home. Instead of guessing at what a family needs after a diagnosis, the deacon asks, would it help most right now if we brought meals, if we sat quietly with you, if we prayed together, or if we simply stayed out of the way for a week. That kind of asking gives the family real control and prevents the well meaning but exhausting pattern of the church showing up in ways that do not actually help.
It also prevents a subtler failure. When the church does not ask well, care ends up flowing to the loudest situations rather than the ones that most need it. The family that would benefit most from a visit is often the family least likely to ask, and the family that gets three casseroles in one week is often the family least in need of them. A care coordinator who is consistently asking, tracking the answers, and matching real need to real capacity is the difference between a care team that feels caring to the congregation and one that mostly feels performative. That coordinator function is a big part of what a pastoral care system looks like in a small church, and it is far more important than any specific tool.
When to Bring a Lawyer Into a Care Team Meeting (Almost Never)
A common overcorrection in small churches is to imagine that any conversation touching on health information now requires a lawyer, a policy document, and a formal privacy notice. It does not. The vast majority of small church care work sits comfortably inside two ordinary standards, both of which the church already knows how to keep. The first is do not share what people have not authorized you to share. The second is do not write down what would embarrass them to see in five years. Those two standards, held consistently by a care chair who reviews the roster each month, will keep the church out of essentially every real trouble spot without needing to invoke federal law once.
There are a small handful of situations where the law actually does matter, and it is worth naming them so they do not get confused with HIPAA. Mandated reporting of suspected child abuse or neglect is one, and the requirements vary by state. Handling of confessions of past crimes is another, and clergy privilege is nuanced. Situations involving imminent harm to self or others are a third. Those are worth talking through with the pastor and, in a few states, with a lawyer, and they belong in a written care policy the elders have signed off on. None of them, though, are HIPAA questions. They are pastoral, legal, and ethical questions in their own categories, and treating them as HIPAA questions muddles all of them.
A Realistic Confidentiality Standard for a Small Care Team
Put together, a small church care team can hold a clean, defensible confidentiality standard with about five habits. First, treat every piece of information a member shares as belonging to them, and never widen the circle without asking. Second, coach families at the first call to opt into the hospital directory so the church can visit without hitting a legal wall. Third, keep the shared care roster oriented around rhythm and coverage rather than diagnoses, and write every note as if the family might read it. Fourth, name the two or three situations where the pastor should be looped in immediately regardless of the family's initial preference, and put those in a short written policy. Fifth, review the roster monthly for anything that has quietly aged into oversharing, and clean it up.
Those five habits will hold up under almost any real scrutiny, and they build the kind of quiet trust that makes members willing to share when things are hard. The care system a church needs is not a legalistic one. It is a trustworthy one, and trust comes from consistency across a lot of small moments rather than from any single policy document. A team that assigns families thoughtfully, using an approach like the one in how to assign families to deacons in a way that actually holds up, and then handles the resulting information with the same discretion a good friend would use, has done essentially everything HIPAA is designed to accomplish, and has done it without ever needing to be a covered entity.
Where OurChurchCare Fits
Software cannot make a care team trustworthy, but it can make trustworthy habits easier to hold. OurChurchCare was built for the small church pattern this piece describes. Care notes are structured so the team can record rhythm and coverage without needing a place to store diagnoses or clinical detail. Sharing controls make it straightforward to keep sensitive notes visible to the pastor or the elders only rather than the whole team, so a family's request for a narrower circle is easy to honor. And the coverage dashboard keeps the focus on who is being cared for and how consistently, rather than on the medical detail of what they are going through. That framing is very deliberate, and it exists because most of the confidentiality trouble in small church care comes from tools that quietly encourage the team to write down more than they should. If your care team is not sure where the line is, the fix probably starts with picking simpler habits and simpler tools, both of which are easier to hold to over years than any policy binder.
Related Reading
If this piece is useful, three others pair naturally with it. For the ongoing rhythm the confidentiality habits sit inside, see How Often Should Deacons Contact Their Assigned Families. For how the sharing controls above show up in software, see Pastoral Care Tracking Software: What Actually Tracks Well and What Doesn't. And for the broader shape a small church care system takes, see What a Pastoral Care System Looks Like in a Small Church.