HIPAA and Compliance
HIPAA governs how protected health information (PHI) moves through a medical office. Know the Privacy Rule (who may use or disclose PHI, and the minimum-necessary standard) and the Security Rule (administrative, physical, and technical safeguards for electronic PHI). The core permitted disclosures without patient authorization are treatment, payment, and health care operations (TPO). Other disclosures generally require a signed authorization that names the purpose, the recipient, an expiration date, and the patient's right to revoke.
Patients have specific rights: access to their records, request for amendment, an accounting of disclosures, a paper copy of the Notice of Privacy Practices, and a request for confidential communications. Know the breach notification rule: covered entities notify affected individuals without unreasonable delay and no later than 60 days after discovery; breaches affecting 500 or more individuals also require notice to HHS and, in many cases, the media.
Traps to watch: confusing the minimum-necessary rule with a ban on all sharing (it applies to non-treatment uses); assuming a family member can always receive information (only with authorization, or limited involvement the patient does not object to); thinking HIPAA prohibits leaving a voicemail (it does not, if the patient has agreed to that contact method).
Rule of thumb: if the request is not treatment, payment, or operations, and no law requires the disclosure, ask whether a valid written authorization exists. If not, do not release.
Worked example: a patient's adult sibling calls asking for lab results. Without authorization, the answer is no; the office may offer to contact the patient directly.