Which of the following constitutes a HIPAA violation when communicating PHI?

• A. Authorized sharing with a patient's consent
• B. Encrypting PHI before transmission
• C. Accessing PHI with proper authorization
• D. Unauthorized sharing of a patient's PHI

Answer: (D)

Protecting patient information is about ensuring disclosures of PHI only happen with proper authorization or for allowed purposes, and always using the minimum necessary information. The best answer shows a scenario where PHI is shared without proper authorization or a valid exception. That unauthorized sharing directly violates HIPAA’s Privacy Rule, breaches confidentiality, and can lead to penalties.

Sharing PHI with a patient’s consent is permissible, and taking steps like encrypting PHI before transmission is a security safeguard that helps prevent breaches. Accessing PHI with proper authorization is also allowed as part of legitimate care and operations. So the only action that constitutes a HIPAA violation is sharing PHI without proper authorization.