Patient Confidentiality and HIPAA Flashcards

A patient's adult child calls the pharmacy asking if their mother's blood pressure medication has been refilled, explaining they are on their way to pick it up. Which of the following is the most appropriate response to comply with HIPAA?

Answer: "Due to privacy laws, I can only provide information to the patient unless she has given us specific permission. Are you listed as an authorized person on her account?"

HIPAA's Privacy Rule prevents the disclosure of Protected Health Information (PHI) to unauthorized individuals. Confirming the status of a specific medication for an identified patient is a disclosure of PHI. The correct procedure is to first verify if the person making the request has been given prior authorization by the patient to receive such information before sharing any details.

Which of the following is the best way to dispose of paper documents containing Protected Health Information (PHI), such as old prescription labels or patient profiles?

Answer: Placing them in a designated, secure shred bin for confidential destruction.

HIPAA requires that PHI be disposed of in a manner that renders it unreadable, indecipherable, and unable to be reconstructed. Placing documents in a secure shred bin is the standard and most effective method used in pharmacies to ensure compliance and protect patient privacy. Other methods like tearing or blacking out names do not sufficiently guarantee that the information cannot be pieced back together.

The HIPAA "Minimum Necessary" standard is a key principle of patient privacy. Which of the following scenarios best demonstrates the correct application of this standard?

Answer: When an insurance company calls to verify a patient's date of birth for a claim, the pharmacy technician provides only the date of birth.

The Minimum Necessary standard requires that employees only access, use, or disclose the minimum amount of PHI needed to accomplish a specific task. In this case, the insurance company only needs the date of birth, so providing only that specific piece of information correctly applies the standard. The other options involve accessing or sharing more information than is required for the immediate task.

A person comes to the pharmacy counter and sees a prescription bag for their neighbor, Jane Doe, on the will-call shelf. They ask you, "Oh, is that for Jane? I can just take that to her." How should you respond?

Answer: "For her privacy and safety, I cannot confirm who that prescription belongs to or release it without verifying pickup authorization and patient identifiers, like her date of birth."

Even if the prescription is visible, confirming it belongs to Jane Doe and releasing it to an unverified third party is a HIPAA violation. The correct action is to protect the patient's privacy by not acknowledging the PHI and stating the policy for authorized pickup, which requires verification of the person's authority and the patient's identity.

While counseling a patient at the counter, a pharmacist speaks loudly, and another customer waiting several feet away overhears the patient's name and the medication being discussed. Under HIPAA, what is this situation most likely considered?

Answer: An incidental disclosure, which is permissible if reasonable safeguards were in place.

An incidental disclosure is a secondary disclosure of PHI that cannot be reasonably prevented and occurs as a by-product of a permitted use or disclosure (like patient counseling). As long as the pharmacy has taken reasonable safeguards, such as asking waiting customers to stand back or speaking in a lowered voice, this is not considered a violation. It is an expected part of pharmacy operations.

A law enforcement officer presents their badge and asks for a patient's address and medication history, stating it is for an official investigation. According to HIPAA and standard pharmacy procedure, what is the correct action?

Answer: Ask the officer to wait and immediately refer them to the Pharmacist-in-Charge, as a warrant, subpoena, or other legal order is typically required.

Disclosures of PHI to law enforcement are permitted under HIPAA but only under specific legal circumstances, such as with a court order, warrant, or subpoena. A simple request is not sufficient. The proper procedure is to escalate the request to the pharmacist, who is trained to verify the legal authority of the request before releasing any information.