Professional Ethics and Communication
Confidentiality and authorized disclosure
HIPAA permits disclosure for treatment, payment, and health care operations, but the minimum necessary standard applies, and the caller’s identity and authority must be verified. HIV, substance use, and genetic information may have stricter state or federal protections. Research use requires IRB approval and informed consent. Mandatory reporting of communicable diseases and suspected abuse follows public health law.
Professional communication
Use two patient identifiers before releasing results. For critical values, use a read-back: state the patient, test, result, units, and time, and have the recipient repeat it. Offer interpreter services and plain-language explanations; do not use family members as interpreters for sensitive information. Disclose errors through the laboratory’s chain of command and quality system rather than informally.
Worked example
A caller says, “I’m the patient’s employer; just tell me whether the drug screen was positive.” Do not confirm or deny. Verify the caller, explain that workplace drug-test results require the patient’s specific written authorization and a designated medical review officer process, and refer the request to the privacy officer. The reasoning: HIPAA’s minimum necessary rule and substance-testing confidentiality outweigh the employer’s curiosity, and a verbal yes would itself be a disclosure.
Traps
HIPAA does not prohibit all sharing; treatment disclosures are allowed when properly verified. Leaving results on voicemail, discussing cases in an elevator, or posting a notable case on social media can be breaches. Curbside results to an unauthorized provider and disclosure to a spouse without authorization are common ethics failures.