A patient's daughter asks the team for his diagnosis and schedule; he is alert and waiting for today's fraction, yet no authorization form on file names her. Which privacy action should the therapist take first before speaking with her?

The patient is alert and present, so the therapist should first ask him whether he permits disclosure to his daughter; without that permission, the daughter’s request and relationship do not by themselves authorize sharing information. Permission can be limited to particular details, so the therapist should clarify what the patient agrees may be discussed before responding. Verifying identity and emergency-contact status is a prudent privacy check, but an emergency-contact listing establishes neither authority to receive information nor the patient’s consent to disclose today’s appointment time. Confirming that the daughter helps with his care recognizes a relevant circumstance, yet caregiver involvement alone does not establish permission when the patient can express his wishes. Applying the minimum-necessary principle and withholding the diagnosis appropriately limits the scope of disclosure, but it does not replace the prior permission required here; even a schedule detail is still information about the patient. A useful exam caveat is that privacy rules may permit limited disclosure to a person involved in care when the patient agrees, does not object, or circumstances support that judgment, but those conditions should not be presumed when an alert patient can be asked directly. In practice, ask the patient privately if appropriate, document the scope of his permission according to policy, and disclose only the information he approves.