A man at the outpatient desk says he is the patient's spouse and asks for a copy of yesterday's myocardial perfusion report. The patient is still in the scan room, the file lists only the patient as authorized to receive results, and the department expects staff to help legitimate requesters begin the release process. Which HIPAA confidentiality step should the technologist take first?

Ask the patient for permission and document any disclosure before sharing the report. The file names only the patient as authorized to receive results, and being a spouse does not itself grant access. Your department can help the spouse begin the release process, but that does not replace obtaining the patient’s permission. Verifying the spouse’s identity and involvement in care reflects a real HIPAA pathway: relevant information may sometimes be shared with someone involved in care when the patient agrees or does not object. Here, however, the file limits authorization to the patient, so the spouse’s role alone is not enough. Helping submit a formal records request for review appropriately withholds the report pending review, but misses the first step available here: ask the patient for permission and help the spouse proceed with that permission. Asking the ordering provider to confirm the spouse may receive the report recognizes that a provider can coordinate communication, but provider confirmation alone does not establish the patient’s authorization to disclose this report to the spouse. Exam caveat: HIPAA allows several forms of patient agreement and does not universally require a signed authorization for every disclosure to a family member; follow applicable law and organizational policy. Practical check: before release, verify the patient’s permission, the intended recipient, the specific information authorized, and the required documentation.