3. A clinic customarily places patient charts in the plastic box outside an exam room. It does not want the chart left unattended with the patient, and physicians want the record close by for fast review right before they walk into the exam room.

Does HIPAA allow the clinic to continue this practice?

Yes, the HIPAA Privacy Rule permits this practice as long as the clinic takes reasonable and appropriate measures to protect the patient's privacy. The physician or other health care professionals use the patient charts for treatment purposes. Incidental disclosures to others that might occur as a result of the charts being left in the box are permitted, if the minimum necessary and reasonable safeguards requirements are met.

Examples of measures that could be reasonable and appropriate to safeguard the patient chart in such a situation would be limiting patient access to certain areas, ensuring that the area is supervised, escorting non-employees in the area, and placing the patient chart in the box with the front cover facing the wall.

Each Health Care Component must evaluate what measures are reasonable and appropriate in its environment and tailor measures to their particular circumstances.

Return to FAQ List