Health Information Compliance Alert

Question: What is the difference between a wrongful and an incidental disclosure of protected health information? Also, do we have to report both types of violations when compiling an accounting of disclosures?


Minnesota Subscriber


Answer: An incidental disclosure is when PHI is shared inadvertently with unauthorized users during the performance of day-to-day operations in your medical office. For example, a patient in exam room A hears a doctor talking to another patient in exam room B. This is an incidental disclosure.

A wrongful disclosure is sharing PHI with unauthorized users outside of the office's day-to-day operations. Example: While at lunch outside the office, one staffer asks another, "Did you notice that Joe Stone's glaucoma is getting worse?" This is an example of wrongful disclosure of PHI: The staffer linked Joe Stone's name to his medical condition outside of the office.

Remember: Your office must note all of its wrongful disclosures, which are vital when compiling an accounting of disclosures for auditors. You are not required to list incidental disclosures of PHI.