A physician asks a medical assistant to call a patient's employer to confirm their employment status for disability paperwork. The patient has not signed a specific release of information for their employer. Which of the following is the most appropriate action for the medical assistant to take?
- ACall the employer and verify employment, as it's for disability purposes.
- BComplete the disability paperwork without employer verification.
- CInform the physician that a signed authorization is required before contacting the employer.
- DContact the patient to ask for verbal consent to call their employer.
Show answer & explanationAnswer & explanation
Correct answer: C. Inform the physician that a signed authorization is required before contacting the employer.
Under HIPAA, Protected Health Information (PHI) includes information that could be used to identify an individual, such as their employment status when tied to a medical condition for disability. A specific, signed authorization from the patient is required to disclose this information to a third party like an employer, even for disability purposes, unless it falls under a specific exception (which this scenario does not).
Why the other options are wrong
- A. Disclosing information without proper authorization is a HIPAA violation.
- B. Completing paperwork without required verification may lead to incomplete or inaccurate documentation, and still doesn't address the HIPAA issue.
- D. While verbal consent can sometimes be acceptable for certain disclosures, a written authorization is generally preferred and legally safer for sharing PHI with non-healthcare entities like employers.
HIPAA Authorization for External Disclosure
A patient's written permission, required by HIPAA, to allow a healthcare provider to use or disclose their Protected Health Information (PHI) to specified third parties for purposes other than treatment, payment, or healthcare operations.
- Must be specific, dated, and signed by the patient.
- Required for disclosures to employers, schools, and legal entities.
- Protects patient privacy and autonomy over their health data.
Memory trick: No signature, no share; patient's privacy, you must care.