Safety in Oral Exchange of PHI

HIPAA Reminder – Privacy and Oral Communications

Oral communications at your practice are extremely important but are often overlooked and forgotten.  They can be a confusing issue but need serious attention.

The Privacy Rule applies to individually identifiable health information in all forms. Coverage of oral or spoken information ensures that information retains protections when discussed. If oral communications were not covered, any health information could be disclosed to any person, so long as the disclosure was spoken.

Providers and health plans understand the sensitivity of oral information. For example, many hospitals already have confidentiality policies and concrete procedures for addressing privacy, such as posting signs in elevators that remind employees to protect patient confidentiality.

Reasonable safeguards for orally exchanging PHI include:

• keeping a distance between the public and the people you’re speaking to
• stepping into a room with a door
• lowering your voice
• using the handset instead of the speakerphone

The Privacy Rule is not intended to prohibit providers from talking to each other and to their patients. It is understood that overheard communications are unavoidable. These are considered to be incidental disclosures.

For example, in a busy emergency room, it might be necessary for providers to speak loudly in order to ensure appropriate treatment. The Privacy Rule is not intended to prevent this appropriate behavior. The following practices are permissible, if reasonable precautions are taken to minimize the chance of inadvertent disclosures to others who might be nearby such as using lowered voices:

• healthcare staff may orally coordinate services at hospital nursing stations
• nurses and other healthcare professionals may discuss a patient’s condition over the phone with the patient or a provider
• staff may call outpatient’s names in waiting areas
• healthcare professionals may discuss a patient’s condition during training rounds in an academic or training institution

These are all considered to be incidental disclosures under HIPAA. HIPAA is not meant to impede the quality of our healthcare. Its intent is to improve our quality of care.

#HIPAA