An attorney seeks information about a patient undergoing rehabilitation after total knee surgery. The PT department should:

An attorney seeks information about a patient undergoing rehabilitation after total knee surgery. The PT department should:

• A. Refer the attorney to the patient's insurance carrier.
• B. Describe the patient's current status.
• C. Require written authorization from the patient to release information.
• D. Obtain verbal permission from the patient to release information.

Answer: (C)

Protecting patient confidentiality requires written authorization before sharing protected health information with outside parties such as an attorney. The HIPAA Privacy Rule allows disclosures to third parties only when the patient has provided explicit written consent that specifies what information can be shared, with whom, and for what purpose. Verbal permission isn’t reliable enough to document exactly what’s permitted, and describing current status or directing the attorney to the insurer would bypass the patient’s control over their own information. In the absence of a legal mandate like a subpoena, the appropriate step is to obtain a written authorization from the patient to release the information.

Protecting patient confidentiality requires written authorization before sharing protected health information with outside parties such as an attorney. The HIPAA Privacy Rule allows disclosures to third parties only when the patient has provided explicit written consent that specifies what information can be shared, with whom, and for what purpose. Verbal permission isn’t reliable enough to document exactly what’s permitted, and describing current status or directing the attorney to the insurer would bypass the patient’s control over their own information. In the absence of a legal mandate like a subpoena, the appropriate step is to obtain a written authorization from the patient to release the information.