Under HIPAA, a patient's health information can only be shared with family members if the patient has given explicit permission. In cases where the patient is unable to give consent, healthcare providers may share relevant information with family members if it is in the best interest of the patient and aligns with HIPAA regulations.