Health Information Compliance Alert

Question: We frequently get calls from patients wanting their medical information over the telephone. What is the best way to authenticate that these callers are who they say they are?

Answer: "It's almost impossible to verify the identity of someone on the other end of the telephone," cautions Kelly Pickens, an attorney with the Health Law Center in Greenville, SC.It's okay to give out PHI over the phone if you've "initiated contact with a patient and obtained their permission," but you're opening yourself up to a potential HIPAA violation, Pickens warns. The caller could be "an ex-spouse or someone in a custody dispute trying to obtain confidential information," she explains. In those cases a caller might know the patient's Social Security number or other identifying info.

The Bottom Line: Give health information over the phone only as a last resort, Pickens advises. If you're worried about authenticating callers, you could assign patients a password or some other information that proves that they really are who they claim to be, she suggests.