Advanced Search

Health Information Compliance Alert

HIPAA Quiz:

Permitted Disclosure Or Privacy Violation -- What's The Difference?

Published on Sat Mar 10, 2007

HIPAA Quiz: Permitted Disclosure Or Privacy Violation -- What's The Difference?

5 scenarios help you decide.

Can you distinguish a permitted incidental disclosure from a potential HIPAA privacy violation? Or better yet, can you and your staff hear the difference?

Most incidental uses and disclosures involving paper or electronic forms of protected health information can be sufficiently minimized by moving medical charts or computer screens out of ready view, asserts consultant Gwen Hughes with Chicago-based Care Communications. But more often than not, incidental PHI disclosures are likely to result from overheard conversations within your facility, she reports.

Cat's out of the bag: "It's easier to overhear and harder to fix those overhearing problems than it is to move a physical piece of equipment or documentation," Hughes explains.


Consider These 5 Incidents

Have a look at these five conversations described by Hughes and determine whether each is a permitted incidental disclosure under HIPAA or an impending privacy violation:

1. A patient waiting in an examination room overhears a nurse relaying another patient's test results to a physician--in the next room.

2. A patient in a semiprivate hospital room overhears multiple conversations between his roommate and the physicians and nurses caring for his roommate.

3. A patient overhears the receptionist and medical assistant making unkind comments about the waist measurement of a patient who's expecting triplets.

4. A patient overhears a conversation between a staff member and an insurance company in which the staff member is attempting to secure preauthorization for another patient's surgery.

5. A bartender overhears one nurse telling another about the sponge bath she gave a famous actor who is presently a patient on her unit.

 

HIPAA Quiz Answers

1. This example constitutes an incidental disclosure because it's simply a by-product of a use or disclosure that's otherwise permitted under the privacy rule, states Hughes. "Physicians and nurses having conversations in normal tones of voice are permissible because the rule doesn't expect us to remodel and put soundproofing in every wall or every door," she explains.

2. Again, this instance would be a permitted incidental disclosure, Hughes reports, because "the authors of the rule did not expect us to remodel and make every room a private room." Therefore, it's reasonable that physicians can have bedside conversations with their own patients, she contends.

3. This example is not an incidental disclosure, states Hughes. "I can see this happening as you're waiting in a doctor's office. You're bored, the magazines are eight months old, and you can't help but listen to the receptionist having a private conversation," quips Hughes. But the fact is that neither the nurse nor the medical assistant should have been engaged in this disclosure of PHI, she states.

Because their conversation wasn't related to treatment, payment or health care operations, "it wasn't a normally permitted disclosure and there was no reason for them to be discussing it," insists Hughes.

And even if the individuals were making kind or flattering comments about the patient's waistline, it would still be an inappropriate disclosure since there was no reason to disclose the patient's PHI at all, she stresses.

4. This is an incidental disclosure under the privacy rule, remarks Hughes, since seeking pre-approval from an insurance company is a standard and appropriate procedure relating to medical billing. "It goes back to the fact that big huge capital expenditures are not expected" to construct private, soundproof rooms for permitted conversations, she states.

"And as long as people aren't yelling it" and "they're having those conversations where they make sense for them to be," then any overheard PHI would simply be an incidental disclosure.

5. This is most definitely not an incidental disclosure, insists Hughes, because it has nothing to do with treatment, payment or health care operations. "It was totally inappropriate to be discussing that at all, much less outside of the workplace," she charges. "It's simply not acceptable."

Other Articles in this issue of

Health Information Compliance Alert

View All