What constitutes a violation of HIPAA regulations?

• A. Accessing PHI with proper authorization
• B. Unauthorized sharing of a patient's PHI
• C. Discussing PHI in a private office
• D. Documenting PHI with care

Answer: (B)

PHI must be accessed and disclosed only to people who have a legitimate need to know and only in ways the law allows. A violation happens when PHI is shared without proper authorization or a permitted reason. Accessing PHI with proper authorization is permitted, so it isn’t a violation. Discussing PHI in a private office is typically allowed as long as those present are authorized to know and confidentiality is maintained. Documenting PHI with care is standard and appropriate practice when done securely. The action that violates HIPAA is unauthorized sharing of a patient’s PHI to someone who isn’t authorized to know it.