Protecting Patient Privacy Under HIPAA — Practice Checklist

Step-by-Step Procedure (6 steps)

1. 1.

   Access only the patient records necessary for your current task — HIPAA's minimum necessary standard applies even to coworkers' charts you're curious about.

2. 2.

   Verify a caller's identity before discussing any patient information over the phone, and confirm the caller actually has a legitimate right to that information (the patient themselves, or someone the patient has authorized).

3. 3.

   Never discuss patient information in public or semi-public areas (waiting rooms, elevators, hallways) where it could be overheard.

4. 4.

   Log out of or lock any workstation before stepping away, even briefly, so patient records aren't left visible to the next person who walks by.

5. 5.

   When faxing or emailing patient information, confirm the destination is correct and that the method itself meets your office's security requirements (encrypted email, confirmed fax number) before sending.

6. 6.

   If you witness or suspect a privacy breach (a misdirected fax, a conversation overheard, an unauthorized record access), report it through your office's procedure immediately rather than letting it go unaddressed.

Quality Checkpoints (4)

Confirm each of these before considering the task complete.

• Only the minimum necessary information is accessed or shared for the task at hand.

• Caller identity and authorization are verified before any patient information is shared by phone.

• Workstations are locked whenever unattended, even for a short absence.

• Suspected breaches are reported promptly, not handled informally or ignored.

Avoid These Mistakes

• ⚠

  Discussing a patient's visit with a coworker in the hallway or break room where other patients can overhear.

• ⚠

  Giving information to a caller claiming to be a family member without verifying the patient has actually authorized that disclosure.

• ⚠

  Leaving a workstation unlocked and a patient's chart open on screen while stepping away "just for a minute."

• ⚠

  Looking up a friend's, relative's, or coworker's chart out of curiosity when it has nothing to do with your job duties — this is a HIPAA violation regardless of intent.