Can you provide an example of unintentional PHI disclosure?

Editorial team Published on

An unintentional Protected Health Information (PHI) disclosure happens when a worker accidentally shares private patient data without any bad intent, such as sending an email with medical details to the wrong recipient.

Common Example

A clinic nurse types an incorrect email address and sends a message containing a patient's name, diagnosis, and upcoming appointment time to an external person instead of the intended doctor.

Other Typical Examples

  • Misdirected faxes: Sending a medical record to a wrong fax number where an unauthorized person can view it.
  • Improper disposal: Throwing paper charts or notes containing patient names into a regular trash or recycling bin instead of a secure shredding bin.
  • Social media mistakes: Posting a staff photo online that accidentally captures a computer screen in the background displaying readable patient names.
  • Unencrypted device loss: Misplacing a personal smartphone or laptop used for work that lacks data encryption.

What is an example of accidental disclosure of PHI?

An example of an accidental disclosure of Protected Health Information (PHI) is sending an email containing patient medical details or names to the wrong recipient due to an autofill error in the address bar.

Common Examples of Accidental PHI Disclosures

  • Misdirected Faxes or Mail: Entering an incorrect fax number and transmitting a patient's lab results or diagnosis to an unrelated office or a personal machine.
  • Improper Disposal: Throwing paper intake forms or printed schedules containing identifiable patient names directly into a regular office trash or recycling bin instead of a secure shredding bin.
  • Unattended Screens: Leaving an electronic health record (EHR) terminal unlocked and visible on a computer screen in a busy hallway or reception area where visitors can see patient data.
  • Oversharing on Social Media: Posting a seemingly innocent photo from a clinic workspace that accidentally captures a whiteboard or computer monitor in the background displaying patient names.

What is an example of PHI disclosure?

An example of a PHI (Protected Health Information) disclosure is a clinic sending a patient's name, date of birth, and diagnosis codes to an insurance company to process a medical bill.

Types of PHI Disclosures

Disclosures of protected health information fall into two main categories under HIPAA rules:

  • Permitted Disclosures: Sharing information for allowed purposes like treatment (sending records to a specialist), payment (billing an insurer), or healthcare operations (quality reviews).
  • Unauthorized Disclosures: Sharing patient data without consent or a legal exemption, such as a hospital employee looking up a celebrity's chart or selling patient lists to a third party.

Can PHI be disclosed without permission?

Protected health information (PHI) can be disclosed without patient permission under specific exceptions defined by the HIPAA Privacy Rule.

Treatment, Payment, and Operations (TPO)

  • Treatment: Sharing information between healthcare providers for your care, coordination, or referrals.
  • Payment: Disclosing data to obtain reimbursement or process insurance claims.
  • Operations: Internal administrative and quality assessment activities of the healthcare entity.

Public Interest and Safety Exceptions

  • Public Health: Reporting disease outbreaks, tracking statistics, or sending immunization records to schools.
  • Abuse and Neglect: Reporting suspected child abuse, domestic violence, or elder neglect to authorities.
  • Imminent Threat: Disclosing information to prevent a serious and imminent threat to health or safety.
  • Oversight: Audits, inspections, and licensing actions by health oversight agencies.

Legal and Judicial Proceedings

  • Required by Law: Disclosures mandated by federal, state, or local statutes.
  • Court Orders: Responding to valid court orders, subpoenas, or warrants.
  • Law Enforcement: Assisting police in locating suspects, fugitives, or missing persons under strict limits.

What is an example of an incidental HIPAA disclosure?

An example of an incidental HIPAA disclosure is a receptionist calling out a patient's first name in a waiting room, and another patient nearby hearing it.

An incidental disclosure is a secondary, unintentional exposure of protected health information (PHI) that occurs as an unavoidable by-product of a permitted healthcare activity. Under the Department of Health and Human Services (HHS) Privacy Rule, these are not considered violations as long as the organization uses reasonable safeguards.

Common Permissible Examples

  • Waiting Room Announcements: A staff member calls a patient by name to come back for an appointment.
  • Overheard Conversations: Two nurses talk in hushed tones at a nursing station about a patient's care, and a passing visitor catches a brief word.
  • Sign-In Sheets: A front desk uses a basic sign-in sheet that only asks for a name and appointment time, which other patients might see.
  • Bedside Discussions: A doctor talks quietly with a patient in a semi-private room separated by a curtain, and the neighboring patient hears part of it.

Rules for Compliance

  • Reasonable Safeguards: Staff must try to protect privacy, such as lowering their voices or using privacy screens.
  • Minimum Necessary Standard: Staff should share only the bare minimum information needed for the task.

Three Exceptions to Unintentional HIPAA Violations

9 related questions found

What is an accidental disclosure?

An accidental disclosure is an unintended exposure of private, sensitive, or confidential information caused by human error or oversight rather than malicious intent.

Common Examples

  • Sending an email, text message, or physical document containing private data to the wrong recipient.
  • Printing confidential records on a shared or publicly accessible printer.
  • Leaving unencrypted devices or files containing personal information where unauthorized people can view them.
  • Verbally sharing sensitive facts with the wrong person due to a misidentification.

Accidental vs. Incidental Disclosure

  • Accidental Disclosure: An outright mistake or process failure (such as misdirecting an email) that is not permitted by privacy rules and may constitute a compliance violation or reportable data breach.
  • Incidental Disclosure: A minor, secondary exposure that happens as an unavoidable side effect of an otherwise permitted activity (such as a visitor briefly overhearing a nurse call out a patient's name in a waiting room), which is generally allowed if reasonable safeguards are used.

What should you do if you unintentionally disclose protected health information?

If you share protected health information (PHI) by mistake, you must report the incident to your organization's Privacy Officer immediately.

Immediate Actions

  • Report internally: Notify your supervisor or Privacy Officer right away so they can assess the risk.
  • Stop the spread: Try to retrieve the file, recall the email, or secure the lost device if possible.
  • Document details: Write down what data was shared, who received it, and when the mistake happened.

Organizational Assessment

  • Risk review: The Privacy Officer decides if the mistake breaks HIPAA rules and counts as a data breach.
  • Mitigation: Your workplace might ask the receiver to delete or destroy the data in writing.
  • Notifications: If a true breach occurs, the organization must notify the affected individuals and the government.

What is considered a PHI disclosure?

A Protected Health Information (PHI) disclosure under HIPAA Privacy Rule is the release, transfer, provision of access to, or divulging of a patient's identifiable health data outside the entity holding the information.

What Counts as a Disclosure

  • Sharing with third parties: Sending patient medical records or billing details to an outside vendor, separate specialist, or unauthorized family member without consent.
  • Improper internal or external exposure: Leaving physical charts where unauthorized staff or visitors can view them, or sending unencrypted emails containing PHI identifiers over public networks.
  • Data leaks or breaches: Unauthorized hacking, theft, or accidental publishing of records that link an individual's identity to their past, present, or future medical care or payment data.

Permitted vs. Impermissible Disclosures

  • Permitted: Sharing data for direct treatment, payment, or health care operations, or mandated public health reporting, without explicit patient authorization.
  • Impermissible: Sharing information for marketing, research without proper waiver/authorization, or giving access to anyone outside the defined care team without a signed patient consent form.

What are 5 examples of PHI?

Protected Health Information (PHI) is any data about health status, care provision, or payment that links to a specific individual under HIPAA guidelines.

5 Common Examples of PHI

  • Names: A patient's full first or last name combined with any health or medical data.
  • Dates: Any date directly connected to an individual, such as a date of birth, hospital admission, discharge, or death (excluding standalone years).
  • Contact Information: Telephone numbers, fax numbers, or email addresses linked to health records or appointment reminders.
  • Identification Numbers: Social Security numbers, medical record numbers (MRNs), health plan beneficiary numbers, or account numbers.
  • Images and Biometrics: Full-face photographs, fingerprints, or voice prints tied to a patient file.

What is considered an unauthorized disclosure of PHI?

An unauthorized disclosure of Protected Health Information (PHI) is any sharing, sending, or leaking of patient health data to someone who does not have the legal right or a valid job need to see it, violating the HIPAA Privacy Rule.

Common Examples

  • Misdirected communication: Sending patient medical records, lab results, or billing statements to the wrong email address, fax number, or postal recipient.
  • Employee snooping: Healthcare staff looking up medical files of family members, coworkers, or celebrities out of personal curiosity rather than medical necessity.
  • Improper disposal: Throwing away paper charts, sticky notes, or un-shredded documents containing names and diagnoses into regular trash bins.
  • Lost or stolen devices: Misplacing unencrypted laptops, smartphones, or USB drives that store patient files.
  • Casual conversation: Discussing identifiable patient details in public areas like elevators, cafeterias, or on social media.

Violations vs. Breaches

  • Violation: Any impermissible use or disclosure of PHI. If a risk assessment shows a low probability that the data was actually compromised (such as a misdirected fax sent to a trusted partner who immediately destroys it), it may remain an internal violation rather than a full breach.
  • Breach: An unauthorized disclosure of unsecured PHI that compromises the security or privacy of the data. Breaches require formal notification to the affected patients, the U.S. Department of Health and Human Services (HHS), and sometimes the media.