Under HIPAA, which scenario is appropriate regarding disclosure of patient information?

• A. Sharing with a coworker not involved in the patient's care.
• B. Disclosing to family without patient consent in all cases.
• C. Sharing only for treatment, payment, and healthcare operations and with patient authorization.
• D. Posting patient data on social media for educational purposes.

Answer: (C)

HIPAA allows the use or disclosure of a patient’s protected health information without written authorization only for treatment, payment, and healthcare operations. In practice this means you can share PHI with people who are directly involved in the patient’s care or in activities that support those processes, and you should share the minimum amount of information necessary. The option that fits this rule is the one that states PHI should be shared only for treatment, payment, and healthcare operations and only with patient authorization if the disclosure falls outside those allowed purposes. Disclosing to a coworker not involved in care goes beyond the permitted scope, disclosing to family without consent isn’t universally allowed, and posting PHI on social media is a violation. If you need to use or share PHI for anything outside TPO, you must obtain patient authorization.