In a crowded emergency waiting area, a visitor asks a PCT for test results of an adult being evaluated for chest pain, while the PCT's workstation computer still shows that patient's chart and other people are within hearing distance. The patient has not signed a release for this visitor. Which HIPAA safeguard should the PCT apply to protect PHI in this situation?

The correct safeguard is required because three HIPAA risks occur at once: PHI visible on an unattended workstation, a crowded area where conversations can be overheard, and a request for adult test results without a signed release, so the PCT must secure the electronic display, remove the conversation from public hearing, and limit any sharing to what the patient has authorized. The identity-verification and private-discussion approach fails on workstation security because proper verification and location still leave electronic PHI exposed to others in the waiting area when the screen remains unlocked. The lock-and-whisper-at-the-desk approach fails on physical safeguards because speaking quietly at a public desk does not prevent incidental disclosure when other people remain within hearing distance. The lock-and-relocate-to-review-results approach fails on authorization and minimum necessary because securing the computer and using a private room do not replace the need for patient permission, and family relationship alone does not authorize disclosure of an adult's results. Exam caveat: combined-vulnerability questions often include choices that correct two problems while leaving one unaddressed, so select the response that resolves computer security, location privacy, and authorization together. Practical check: lock or log off before leaving the workstation, confirm private setting and documented authorization before discussing results, and involve the nurse or provider when visitor authority is unclear.