In an elevator, a coder tells a coworker details about a celebrity patient's diagnosis and upcoming procedure. What HIPAA judgment applies?
Select an answer to reveal the explanation.
Short Explanation
Fame doesn't punch a hole in HIPAA. If someone doesn't need that patient's info to do their job, keep it zipped—even in the elevator where ears are everywhere.
Full Explanation
The HIPAA Privacy Rule requires that PHI be used or disclosed only for permitted purposes and limited to the minimum necessary for the workforce member’s role. Casual conversation about a patient’s identity and clinical details in public or semi-public spaces without a treatment, payment, or operations need is an impermissible disclosure. When a coder tells a coworker in an elevator details about a celebrity patient’s diagnosis and upcoming procedure, PHI is disclosed without need-to-know; hallway or elevator gossip is a privacy violation. Celebrity status does not remove privacy protections. Claiming celebrity patients are unprotected if fame is public knowledge fails—clinical details remain PHI. Claiming elevator discussions are always permitted among any clinic employees regardless of role fails minimum-necessary and need-to-know limits. Claiming only electronic PHI disclosures can violate HIPAA fails because oral disclosures are covered. Exam caveat: incidental disclosures have narrow allowances; deliberate gossip with identifiable clinical detail is not an incidental disclosure safe harbor. Operational check: stop the conversation, report per the county clinic’s privacy incident process, retrain workforce on elevator/hallway rules, and document sanctions/education as required by the privacy program.