In a busy emergency waiting area, the adult child of an alert older patient asks the PCT for test results, a coworker leaves a computer open with the census visible, and visitors can overhear the desk. The patient has not signed a release for family. Which HIPAA-compliant action should the PCT take to protect PHI?

Moving the conversation to a private area and explaining that a release is needed before sharing results protects confidentiality on two fronts: it reduces the chance that visitors overhear PHI in the busy waiting area, and it respects the alert adult patient’s autonomy and HIPAA authorization rules when no release is on file. Discussing results privately with the child now protects against being overheard but still discloses PHI before permission is established; minimum necessary does not excuse early disclosure. Explaining the need for a release while continuing the talk at the busy desk correctly addresses authorization but fails to provide reasonable safeguards, since visitors may overhear names, results, or context. Moving to a private area to explain the release while leaving the census open addresses the conversation’s location and authorization but leaves workstation security and incidental disclosure risks: an unattended screen with names and locations remains PHI accessible to passersby. Exam caveat: family status alone does not establish permission for an alert adult, and even general updates require an opportunity to object or explicit permission; check whether the stem states consent was given. Practical check: secure the open computer by locking or logging off, speak away from traffic, verify identity and permission with the patient privately, and document authorization before sharing results.