Which action would violate HIPAA privacy protections?

Which action would violate HIPAA privacy protections?

• A. Selling PHI to a marketing firm without patient consent
• B. Providing PHI to the patient’s physician when needed for care
• C. Accessing PHI only as needed for patient care
• D. Storing PHI in a locked, password-protected system

Answer: (A)

PHI may be disclosed under HIPAA for treatment and to others involved in a patient’s care, and access to PHI should be limited to what is necessary to provide care. At the same time, disclosures for marketing or selling PHI require explicit patient authorization. Selling PHI to a marketing firm without patient consent amounts to a disclosure for marketing without authorization, which violates HIPAA privacy protections. The other scenarios fit HIPAA rules: sharing PHI with the patient’s physician for care is part of treatment; accessing PHI only as needed aligns with the minimum necessary standard; and storing PHI in a locked, password-protected system is a proper safeguarding measure to protect privacy.

PHI may be disclosed under HIPAA for treatment and to others involved in a patient’s care, and access to PHI should be limited to what is necessary to provide care. At the same time, disclosures for marketing or selling PHI require explicit patient authorization. Selling PHI to a marketing firm without patient consent amounts to a disclosure for marketing without authorization, which violates HIPAA privacy protections. The other scenarios fit HIPAA rules: sharing PHI with the patient’s physician for care is part of treatment; accessing PHI only as needed aligns with the minimum necessary standard; and storing PHI in a locked, password-protected system is a proper safeguarding measure to protect privacy.