What constitutes a HIPAA violation? An incidental disclosure? Sometimes complete privacy cannot reasonably be guaranteed in a pharmacy. It may not be a breach but an incidental disclosure if the pharmacy “applied reasonable safeguards and implemented the minimum necessary standard.”4
The University of Chicago describes reasonable safeguards as including:5
Avoiding conversations about one patient in front of other patients or visitors/families.
Lowering voices when discussing patient information in person and/or over the phone.
Avoiding conversations about patients in public places.
Two examples in the University
of Chicago Guidance5 instructive to pharmacists are:
. . . [Pharmacists and] health care professionals may discuss a patient’s condition over the
phone with the patient, a provider, or a family member, but should speak quietly.
A health care professional [pharmacists] may discuss test results with a patient or other provider in a joint treatment area, but should speak quietly
1. HIPAA Breach Notification Rule, 45 CFR §§ 164.400-414; see www.HHS.gov and http://www.hhs.gov/hipaa/for-professionals/breach-noti_ cation/index.html last accessed 10/28/2016.
2. http://www.hhs.gov/hipaa/forprofessionals/special-topics/mental-health/ accessed 10/28/2016
4. 45 CFR 164.502(a)(1)(iii)
5. University of Chicago, HIPAA Program Office, Guidance (Oct 2006), http://hipaa.bsd.uchicago.edu/incidental_disc.html accessed 12/5/2016.
These articles are not intended as legal advice and should not be used as such. When a legal question arises the pharmacist should consult with an attorney familiar with pharmacy law in his or her state. Ken Baker is a pharmacist and an attorney. He teaches ethics at Midwestern University, Glendale, Arizona, campus and risk management for the University of Florida. He consults in the areas of pharmacy error reduction, communication, and risk management. Mr. Baker consults with Pharmacists Mutual Insurance Company and is an attorney, of counsel, with the Arizona law firm of Renaud Cook Drury Mesaros, PA. Contact Ken Baker at [email protected].