A technician is charting at a busy nurses station when a visitor asks for details about a roommate’s test results, while a phone speaker broadcasts updates and papers with identifiers face up. The census screen is visible to hallway traffic. Which response best follows HIPAA and protects protected health information?

The response that declines to share the roommate’s results, lowers voices and screens, and secures visible papers and devices is best because HIPAA requires avoiding unauthorized disclosure and taking reasonable safeguards against incidental exposure. It addresses verbal, visual, and electronic risks at the busy nurses station. Declining the request while turning papers face down and angling screens, but continuing charting without lowering voices or stopping the speakerphone broadcast, leaves updates audible to visitors. Declining the request and muting the speakerphone and angling screens, while charting quietly, still leaves papers with identifiers exposed; audio and screen safeguards do not secure paper PHI. Muting the speakerphone and securing papers and screens before verifying the visitor’s identity and sharing results fails because identity verification alone does not authorize disclosure of another adult’s test results. HIPAA requires prior authorization or a proper personal-representative determination for that disclosure. An exam caveat: a visitor’s identity or relationship does not by itself permit access to results. A practical check at the station is to confirm that voices are lowered, the speakerphone is not broadcasting updates, screens are shielded, and papers and devices are secured before responding to a visitor.