Protecting Patient Privacy Under HIPAA

Step-by-Step Procedure

1. 1

   Access only the patient records necessary for your current task — HIPAA's minimum necessary standard applies even to coworkers' charts you're curious about.

2. 2

   Verify a caller's identity before discussing any patient information over the phone, and confirm the caller actually has a legitimate right to that information (the patient themselves, or someone the patient has authorized).

3. 3

   Never discuss patient information in public or semi-public areas (waiting rooms, elevators, hallways) where it could be overheard.

4. 4

   Log out of or lock any workstation before stepping away, even briefly, so patient records aren't left visible to the next person who walks by.

5. 5

   When faxing or emailing patient information, confirm the destination is correct and that the method itself meets your office's security requirements (encrypted email, confirmed fax number) before sending.

6. 6

   If you witness or suspect a privacy breach (a misdirected fax, a conversation overheard, an unauthorized record access), report it through your office's procedure immediately rather than letting it go unaddressed.

Quality Checkpoints

• ✓

  Only the minimum necessary information is accessed or shared for the task at hand.

• ✓

  Caller identity and authorization are verified before any patient information is shared by phone.

• ✓

  Workstations are locked whenever unattended, even for a short absence.

• ✓

  Suspected breaches are reported promptly, not handled informally or ignored.

Common Mistakes

• ⚠

  Discussing a patient's visit with a coworker in the hallway or break room where other patients can overhear.

• ⚠

  Giving information to a caller claiming to be a family member without verifying the patient has actually authorized that disclosure.

• ⚠

  Leaving a workstation unlocked and a patient's chart open on screen while stepping away "just for a minute."

• ⚠

  Looking up a friend's, relative's, or coworker's chart out of curiosity when it has nothing to do with your job duties — this is a HIPAA violation regardless of intent.

On-the-Job Tips

• →

  When in doubt about whether you're authorized to share something with a specific person, don't guess — check the patient's authorization on file or ask the provider.

• →

  Treat "lock the screen" as part of the physical motion of standing up from a workstation, the same way you'd treat hand hygiene before leaving a room.

More on This Task