Patient Privacy Communication: Key Terms & Interactive Checklist

Patient privacy communication requires more than lowering your voice or avoiding names in public. Every phone call, portal message, fax, voicemail, records request, and family inquiry creates a decision about identity, authority, purpose, and information scope. Staff who understand patient confidentiality, HIPAA privacy terminology, effective patient communication, and medical records management can communicate efficiently without exposing protected information, obstructing patient rights, or creating preventable complaints.

1. Why Patient Privacy Communication Fails Under Pressure

Privacy failures frequently occur when employees know the general rule but cannot apply it quickly. A caller sounds convincing, a spouse knows the patient’s date of birth, a physician demands an immediate fax, or a frustrated patient refuses standard verification. Staff working through front-desk operations, patient intake procedures, appointment scheduling, and healthcare portal workflows must make defensible decisions while maintaining speed, courtesy, and access.

The HIPAA Privacy Rule establishes national standards for protecting individually identifiable health information held by covered healthcare providers, health plans, and healthcare clearinghouses. It permits many communications needed for treatment, payment, and healthcare operations while requiring appropriate limits and safeguards. Privacy-conscious communication therefore depends on understanding why information is being used or disclosed, who is receiving it, and what conditions apply to that specific exchange.

Identity answers “Who is this person?” Authority answers “What are they legally or operationally allowed to receive?” These checks serve different purposes. A caller may correctly identify themselves as the patient’s employer, neighbor, former spouse, or insurance representative while having no authority to receive the requested information. A reliable process connects active listening techniques, difficult-patient conversations, de-escalation techniques, and legal responsibilities for CMAAs so that staff can pause a disclosure without sounding evasive or accusatory.

HIPAA requires reasonable verification of the identity and authority of a person requesting PHI when that person is unknown to the covered entity. Verification can often occur orally or in writing, although certain disclosures require specified documentation. The organization should establish verification methods appropriate to the communication channel, information sensitivity, and requester category instead of improvising a different test during every call.

Purpose and scope control prevent over-disclosure. A person may have a valid reason to receive some information without being entitled to the entire chart. An authorization specialist may need an order and supporting clinical note; a family caregiver may need medication instructions; a transportation service may need pickup information. Staff should connect the minimum-necessary principle, insurance verification process, prior authorization workflow, and claims-processing controls to the exact purpose of the communication.

The minimum-necessary standard requires reasonable efforts to limit many PHI uses, disclosures, and requests to the information needed for the intended purpose. Exceptions apply, including certain treatment disclosures, disclosures to the individual, and disclosures made under a valid authorization. Staff should therefore learn the standard’s scope rather than treating “minimum necessary” as an absolute rule covering every exchange.

Communication preferences must become usable controls. Recording “call mobile” provides limited protection when the record does not state whether detailed voicemail is acceptable, whether text reminders are approved, which portal account belongs to the patient, or whether mail sent to the home could expose sensitive care. Preference capture should be integrated with patient portal management, secure scheduling tools, patient communication applications, and virtual patient management.

HIPAA permits providers to communicate with patients through mail, telephone, voicemail, and other reasonable methods. Appointment reminders are considered part of treatment and can be made without a separate authorization. Providers should still use reasonable safeguards, honor applicable confidential-communication requests, and limit voicemail content according to circumstances and organizational policy.

The checklist below converts these principles into observable actions across registration, scheduling, records release, billing, telehealth, and clinical support. It can be used during onboarding, team huddles, workflow audits, or remediation after a privacy near miss.

30-Point Patient Privacy Communication Checklist

Check each control your office consistently performs. Unchecked items reveal communication gaps that can cause unauthorized disclosures, delayed access, patient complaints, or inconsistent staff decisions.

0 of 30 controls confirmed

Check	Communication Point	Control to Confirm	High-Risk Failure	Compliant Staff Action
	Incoming patient call	Verify identity before discussing PHI	Accepting caller ID or voice recognition as sufficient verification	Apply the approved identifiers before opening or discussing the record.
	Outgoing patient call	Confirm the person who answered	Beginning with the patient’s diagnosis, test, or procedure	Identify the organization minimally and confirm the recipient first.
	Voicemail	Use the approved message level	Leaving detailed clinical or billing information on a shared phone	Use limited callback language unless documented preferences permit more detail.
	Family inquiry	Confirm involvement and information relevance	Disclosing the entire treatment plan because the caller is a spouse	Share only information directly relevant to permitted care or payment involvement.
	Personal representative	Verify authority and its scope	Assuming every power-of-attorney document covers healthcare decisions	Review applicable documentation and state-law requirements before disclosure.
	Minor patient	Check parental-access and minor-consent rules	Automatically giving every parent access to every category of information	Apply HIPAA, state law, consent circumstances, and organizational policy.
	Patient companion in room	Give the patient an opportunity to agree or object	Discussing sensitive information merely because the companion entered with the patient	Confirm the patient is comfortable before continuing the discussion.
	Incapacitated patient	Route disclosure through professional judgment	Giving unrestricted information to the first person claiming to be family	Share relevant information only when the authorized professional determines it serves the patient’s interests.
	Waiting room	Limit publicly spoken information	Announcing diagnosis, procedure type, or account problem	Use the patient’s name only as needed and move substantive discussions to a private area.
	Sign-in sheet	Restrict displayed fields	Showing appointment reasons, phone numbers, or clinical details	Collect only the limited information required for arrival processing.
	Front-desk conversation	Control voice level and screen visibility	Discussing balances or treatment where other patients can hear	Use discreet language, reposition the conversation, and protect the monitor.
	Email to patient	Verify the address and apply safeguards	Relying on autocomplete without reviewing the recipient	Confirm the address, attachment, subject line, and approved transmission method.
	Email to provider	Confirm treatment purpose and recipient	Sending a full record when one report is sufficient	Use an approved channel and include information appropriate to the purpose.
	Text message	Use an approved platform and permitted content	Sending clinical details through a personal messaging account	Follow documented patient preferences and organizational technology rules.
	Patient portal	Confirm correct chart and proxy access	Posting one patient’s attachment to another patient’s account	Use a final patient-and-document verification step before release.
	Portal proxy	Review proxy authority and expiration	Leaving caregiver access active after authority changes	Define scope, review dates, and revocation procedures.
	Fax transmission	Verify number, recipient, and page count	Using an outdated number stored in a personal contact list	Use an approved directory, cover sheet, confirmation process, and disclosure limit.
	Mailing records	Confirm address and envelope contents	Placing one patient’s documents in another patient’s envelope	Separate preparation and final verification responsibilities where practical.
	Records request	Identify access request versus authorization	Using the wrong form, fee rule, or response pathway	Classify the request before processing scope, format, recipient, and timing.
	Authorization form	Validate required elements and expiration	Accepting an unsigned, expired, altered, or vague authorization	Confirm information, sender, recipient, purpose, expiration, signature, and revocation language.
	Law-enforcement request	Route through the designated review process	Treating a badge, verbal demand, or ordinary subpoena as automatic authority	Preserve the request and obtain authorized privacy or legal review.
	Employer inquiry	Separate employment needs from treatment information	Confirming diagnosis, attendance, or work restrictions without authority	Release only properly authorized or otherwise permitted information.
	Insurance inquiry	Confirm payment purpose and request scope	Sending unrelated clinical history with claim support	Provide the information appropriate to the permitted payment activity.
	Interpreter involvement	Use the approved interpreter pathway	Depending on an unverified companion for sensitive interpretation	Confirm the interpreter’s role, privacy expectations, and patient preference.
	Telehealth visit	Confirm patient identity, location, and privacy conditions	Starting sensitive discussion while unidentified people are present	Establish who is participating and address privacy limitations before care begins.
	Shared workstation	Use unique credentials and screen locking	Leaving messages or charts visible after stepping away	Lock the screen and prevent another employee from acting under the same account.
	Printed material	Control collection, storage, and disposal	Leaving schedules, labels, or reports on printers and counters	Retrieve documents promptly and use approved confidential disposal.
	Misdirected communication	Report immediately through the privacy-incident process	Deleting the email and assuming the problem is resolved	Preserve facts, report promptly, and follow authorized mitigation instructions.
	Substance-use-disorder record	Check whether 42 CFR Part 2 applies	Processing specially protected records through an ordinary release workflow	Route the request through the organization’s Part 2 procedure.
	Staff uncertainty	Pause, protect, document, and escalate	Guessing to avoid making the patient wait	Use the designated privacy contact before releasing information.

Review Readiness Reset Checklist

2. Key Patient Privacy Communication Terms Staff Must Apply Correctly

Protected health information, or PHI, is individually identifiable health information protected under HIPAA when maintained or transmitted by a regulated entity. PHI can be spoken, printed, handwritten, photographed, faxed, or stored electronically. A patient’s name linked to an appointment, outstanding balance, prescription, provider, insurance issue, or test can reveal healthcare information. Staff studying HIPAA terms for medical scribes, EMR and charting terminology, medical compliance terms, and patient confidentiality controls should therefore avoid equating privacy solely with full clinical records.

Use and disclosure describe two different movements of information. A use generally happens within the regulated entity, while a disclosure sends or makes information available outside it. Opening a chart for an assigned task is a use; faxing a report to another organization is a disclosure. Staff managing medical administrative workflows, EMR record updates, medical records releases, and healthcare CRM data should document which category applies before selecting the governing procedure.

Consent and authorization should never be used interchangeably in operational instructions. Under HIPAA, a covered entity may choose to obtain consent for treatment, payment, and healthcare-operations uses and disclosures, although HIPAA generally does not require that consent. A HIPAA authorization is a more specific document used for certain purposes and must contain prescribed elements, including a meaningful description of the information and an expiration date or event.

Authorization review belongs inside patient intake procedures, patient portal management, medical claims workflows, and medical records management. Staff should confirm the information covered, who may disclose it, who may receive it, the purpose, expiration, signature, and any required statements. An authorization that appears broad, altered, expired, incomplete, or inconsistent with the request should be escalated before disclosure.

Treatment, payment, and healthcare operations, often abbreviated as TPO, are major categories under which covered entities can use or disclose PHI without obtaining a separate HIPAA authorization, subject to applicable conditions. Treatment includes coordination and consultation; payment includes activities needed to obtain or provide reimbursement; operations include specified administrative, quality, training, and business functions. Staff should connect TPO analysis with insurance verification, revenue cycle management, clinical documentation improvement, and medical chart audits.

Personal representative means a person who has authority under applicable law to act for the individual concerning healthcare decisions. Within that authority, the representative generally stands in the patient’s place for relevant HIPAA rights. The scope of a power of attorney, guardianship, executor role, or parental authority must be reviewed rather than assumed. Staff working with patient complaints, legal CMAA responsibilities, risk-management strategies, and privacy communication procedures need a defined document-review route.

Family member or caregiver involvement follows a different analysis. When a patient is present and capable, a provider may discuss information directly relevant to the involvement of a family member, friend, or other person when the patient agrees, does not object, or reasonably indicates acceptance. When the patient is unavailable or incapacitated, a provider may use professional judgment to share relevant information when doing so serves the patient’s interests.

This distinction is critical during emergency appointment management, medical-office triage, telehealth administration, and effective patient communication. Being related to a patient does not automatically grant unrestricted access. Staff should identify what involvement exists and disclose only information connected to that involvement.

Incidental disclosure refers to limited information exposure that occurs as a by-product of an otherwise permitted use or disclosure despite reasonable safeguards. Hearing a patient’s name called in a waiting room may qualify; announcing the patient’s diagnosis does not become acceptable merely because the waiting room is busy. HIPAA permits certain incidental disclosures when the underlying activity is allowed and reasonable safeguards are in place.

Confidential communication request concerns a patient’s request to receive communications through an alternative method or location. Practical examples include using a mobile number instead of a home number, mailing information to another address, or avoiding detailed voicemail. These preferences should flow through appointment scheduling tools, patient communication apps, healthcare portal systems, and medical-office policies so one department does not unintentionally override another department’s privacy control.

Right of access gives individuals a right to inspect or obtain copies of PHI in a designated record set, subject to limited exceptions. Under the HIPAA standard, covered entities generally must act on an access request within 30 calendar days and may use one additional extension of up to 30 days when the required written explanation is provided within the initial period. State law or another applicable requirement may establish a faster timeline.

42 CFR Part 2 protects certain substance-use-disorder patient records maintained in connection with federally assisted Part 2 programs. The 2024 Part 2 Final Rule became effective in April 2024, and compliance with its applicable requirements was required by February 16, 2026. HHS also updated notice requirements so affected HIPAA covered entities and Part 2 programs communicate the relevant privacy rights and obligations appropriately.

Part 2 screening should be built into patient record release tools, medical records management, patient portal administration, and medical compliance procedures. Staff should avoid assuming that every behavioral-health record is governed by Part 2 or that every Part 2 record can be processed through an ordinary HIPAA workflow.

3. How to Communicate Safely Across Phone, Email, Portal, Fax, and In Person

Telephone communication should begin with controlled disclosure. An outgoing caller should avoid announcing sensitive details before confirming who answered. An incoming caller should complete the organization’s verification process before receiving account, appointment, billing, or clinical information. Staff managing front-desk calls, appointment conflicts, insurance questions, and difficult conversations need scripts that separate courtesy from disclosure.

A strong script explains the action without revealing information: “For your privacy, I need to verify two details before accessing the account.” When a caller refuses, staff should offer an approved alternative such as portal communication, a callback through a validated number, in-person verification, or escalation. An angry tone, detailed personal knowledge, urgent deadline, or claim of prior permission should never replace the required workflow.

Voicemail content should follow recorded preferences and contextual risk. A neutral message can provide the organization name, callback number, staff name, and limited reason for contact. Detailed results, procedure names, balances, medication names, or specialty references may expose information to household members, employers, or anyone with access to the device. Staff should align voicemail practice with patient scheduling terminology, privacy communication essentials, active-listening techniques, and daily office checklists.

Email is permitted when reasonable safeguards are applied. Useful controls include validating the address, limiting subject-line content, reviewing attachments, disabling unsafe autocomplete practices, using approved encryption or secure delivery systems, and documenting patient requests involving less secure methods. HHS specifically identifies address accuracy checks as an example of a reasonable safeguard for email communication.

Email controls should be integrated with secure patient scheduling tools, healthcare collaboration platforms, EMR integration tools, and healthcare CRM systems. A technically secure message can still become an unauthorized disclosure when the employee selects the wrong patient, attaches the wrong file, or sends more information than the recipient requires.

When an individual requests a copy of their information through unencrypted email, HIPAA’s right-of-access guidance permits that method after the organization advises the individual of the security risk and the individual accepts it. The organization must still apply reasonable safeguards, including accurately entering the address and fulfilling the request as directed.

Patient portals reduce some channel risks while creating identity and routing risks. Staff may send an accurate document to the wrong chart, grant proxy access too broadly, overlook expired caregiver authority, or assume portal authentication resolves every disclosure question. Portal procedures should connect patient portal terminology, portal management controls, EMR troubleshooting, and patient record-update training.

A final portal-release check should compare the patient, document, date, provider, recipient account, and intended purpose. Sensitive attachments should never be selected by filename alone. Proxy accounts need defined scope, activation criteria, review points, and revocation procedures. When a patient reports compromised access, staff should secure the account, preserve relevant facts, and follow the organization’s privacy and security incident process.

Fax workflows need current recipient validation. A successful transmission report proves that a machine received the pages; it does not prove that the number belonged to the intended recipient or that the correct pages were sent. Staff using medical records release systems, insurance claims workflows, prior authorization procedures, and medical credentialing processes should verify the destination through an approved source and reconcile the page count.

Face-to-face communication requires privacy engineering. Staff should use neutral language at reception, shield screens, avoid leaving printed labels exposed, move financial or clinical conversations away from waiting areas, and identify everyone participating in a telehealth or in-room discussion. HIPAA allows limited practices such as calling patient names or using appropriately restricted sign-in sheets, provided reasonable safeguards are applied and the exposed information is limited.

These protections should support medical-office ergonomics, office organization, telehealth platform use, and infection-control workflows. Privacy controls should fit the physical workflow so employees do not have to choose between patient flow and confidentiality during every busy period.

Which communication pressure causes the most patient privacy near misses in your office?

Callers becoming impatient when staff ask identity and authority questions Deciding what can be shared with spouses, parents, caregivers, and other relatives Avoiding wrong-recipient errors across email, portal messages, text, mail, and fax Protecting conversations and screens while the front desk and waiting room are crowded Processing urgent record requests without confusing access rights, authorizations, and special protections Submit Vote

4. Patient Privacy Communication Examples and Correct Staff Responses

Scenario 1: A patient’s spouse requests laboratory results. The spouse knows the patient’s address, date of birth, physician, and recent appointment date. Those facts may help establish identity while leaving authority unresolved. Staff should determine whether the spouse is a personal representative, whether the patient has permitted relevant involvement, whether the patient is present and can agree or object, and what information is connected to that involvement.

The correct response may involve asking the patient directly, checking documented communication preferences, sending the patient a portal message, or routing the matter to the treating team. Staff should use family communication guidance, active-listening skills, privacy terminology, and patient complaint procedures. A spouse’s familiarity with the patient should never become a substitute for the applicable disclosure pathway.

Scenario 2: A patient refuses telephone verification and says the clinic is withholding their own information. Staff should explain that verification protects the patient’s information and offer approved alternatives rather than arguing about HIPAA. The patient might verify through the portal, return a call through a trusted number, present identification in person, or use another documented method. The encounter should be handled through de-escalation techniques, difficult-conversation guidance, front-desk procedures, and risk-management controls.

A useful explanation is: “I understand that these questions are inconvenient. We use the same verification process before discussing any patient’s information. I can offer another approved way to complete the request.” This language acknowledges frustration, explains the control, applies it consistently, and moves toward a solution.

Scenario 3: An employee emails the correct report to the wrong patient. The employee should report the incident immediately, preserve the message details, avoid contacting the unintended recipient outside the approved response process, and follow authorized mitigation instructions. Deleting the sent message from the employee’s mailbox does not recall the recipient’s copy or complete the organization’s assessment.

The response should connect medical compliance procedures, patient confidentiality rules, EMR compliance training, and medical-office risk management. Authorized personnel must determine what information was involved, who received it, whether it was accessed, what mitigation occurred, and whether further action is required.

Scenario 4: A parent asks for an adolescent patient’s complete record. Parents generally act as personal representatives for minor children, although exceptions can arise under HIPAA, state law, court arrangements, and circumstances in which the minor lawfully controls consent for particular care. Staff should never resolve these questions solely through the patient’s age or the parent’s insistence.

The request should be routed through a workflow connecting patient intake documentation, medical records release tools, patient portal proxy access, and legal CMAA responsibilities. The reviewer should determine the parent’s authority, the scope of the request, whether any record segment requires separate treatment, and which state-specific rules apply.

Scenario 5: Police arrive and demand a patient’s address and treatment information. Staff should remain respectful, preserve any document presented, and contact the organization’s designated privacy or legal reviewer. Law-enforcement disclosures are permitted under HIPAA in specified circumstances and subject to conditions; a badge or urgent verbal demand does not eliminate the need to identify the applicable authority and requested information.

The response should align legal responsibilities, medical-office policies, patient confidentiality, and risk-management procedures. Front-desk employees should avoid interpreting subpoenas, warrants, court orders, administrative requests, or statutory exceptions independently.

Scenario 6: A patient requests that records be emailed to a personal account. Staff should classify the request correctly, verify identity, confirm the email address, explain relevant transmission risks when required, record the patient’s choice, and apply reasonable safeguards. The request should not be rejected merely because the patient chose a method the organization considers less secure when HIPAA’s right-of-access conditions permit that choice.

Processing should connect healthcare portal terminology, records-release tools, medical records management, and patient communication applications. Staff should distinguish a patient’s access request from an authorization-based disclosure to a third party because form, fee, and operational requirements may differ.

5. How to Build a Privacy-Safe Patient Communication System

Begin with a communication decision pathway that asks five questions in order: Who is requesting information? What authority or permitted relationship applies? Why is the information needed? What is the appropriate scope? Which approved channel should be used? This sequence should appear in medical-office policies, daily procedure checklists, medical administrative workflows, and front-desk training.

Each requester category needs a defined route. Patients, personal representatives, family members involved in care, other providers, health plans, employers, attorneys, courts, law enforcement, schools, researchers, public-health authorities, and vendors present different questions. A single “release form required” rule can obstruct permitted treatment communication, mishandle patient access, or overlook specialized legal conditions.

Create channel-specific safeguards instead of relying on a generic instruction to “protect privacy.” Telephone policy should cover verification, callbacks, voicemail, language assistance, and failed verification. Email policy should address address confirmation, encryption, attachments, subject lines, and patient-directed unsecure transmission. Fax policy should cover approved directories, cover sheets, page reconciliation, and misdirected fax response. Portal policy should define proxy access, release checks, account compromise, and attachment validation.

These safeguards should coordinate secure scheduling tools, EMR integration platforms, patient communication apps, and medical-office collaboration tools. Technology should reinforce the privacy decision rather than allowing employees to send information before confirming recipient, scope, and authority.

Build a single source of truth for communication preferences and authority records. The system should distinguish a preferred phone number from permission to leave detailed voicemail; a caregiver contact from a personal representative; an emergency contact from a person involved in care; and portal proxy access from unrestricted authority. Employees working through patient intake, appointment scheduling, virtual patient management, and patient portal administration should see consistent, current instructions.

Train staff through decision scenarios rather than definition recall. Employees should practice responding to a spouse seeking results, a parent requesting an adolescent’s record, a police officer presenting paperwork, a patient requesting unencrypted email, a caregiver seeking medication instructions, and a recipient reporting a misdirected fax. Training can use medical terminology mastery, CMAA exam preparation, medical scribe HIPAA guidance, and realistic medical scribe questions.

Measure operational privacy performance through more than annual completion certificates. Review wrong-recipient incidents, incomplete authorizations, failed identity checks, unlogged proxy changes, record-request aging, repeat fax errors, unresolved communication preferences, abandoned portal accounts, complaint themes, and delays caused by unclear policy. Pair these findings with medical chart audits, clinical documentation improvement, risk-management strategies, and medical office organization.

Finally, create an immediate escalation culture. Employees should know whom to contact, which details to preserve, what actions to avoid, and how quickly to report a concern. The safest response to uncertainty is to pause the disclosure, protect the information, document objective facts, and obtain authorized guidance. Supervisors should never reward employees for bypassing verification, improvising releases, or concealing communication mistakes to protect productivity metrics.

6. Frequently Asked Questions About Patient Privacy Communication

• Q1. Can a medical office leave an appointment reminder on voicemail?

  HIPAA permits healthcare providers to communicate with patients about their care, including appointment reminders and voicemail messages. The office should apply reasonable safeguards and consider the patient’s documented communication preferences. A limited message containing the practice name, callback number, and neutral request to return the call often reduces exposure. Detailed procedure names, diagnoses, medications, or balances should follow organizational policy and the patient’s preferences. Staff should connect scheduling best practices, privacy communication guidance, front-desk procedures, and patient communication tools.

• Q2. Can staff discuss a patient’s condition with a spouse or family member?

  A provider may share information directly relevant to a family member’s or caregiver’s involvement when the patient agrees, does not object, or reasonably indicates acceptance. When the patient is unavailable or incapacitated, relevant information may be shared based on professional judgment and the patient’s interests. Family status alone does not create unrestricted access. Staff should apply active-listening techniques, effective patient communication, patient confidentiality rules, and legal responsibility guidance.

• Q3. Is calling a patient’s name in the waiting room a HIPAA violation?

  Calling a patient’s name or using a limited sign-in sheet can be permitted when the office limits the information and applies reasonable safeguards. Staff should avoid announcing diagnoses, procedure types, balances, test results, or reasons for the visit. Waiting-room privacy should connect medical-office ergonomics, office organization, front-desk operations, and patient intake procedures.

• Q4. Does a patient’s emergency contact automatically have permission to receive medical information?

  An emergency contact designation identifies someone to contact in certain circumstances. It does not automatically make that person a personal representative or grant unlimited access to PHI. The office must determine whether another permitted basis supports the communication, such as the patient’s agreement, the person’s involvement in care, professional judgment during incapacity, or legally established representative authority. Staff should use patient intake controls, emergency appointment procedures, privacy terminology, and risk-management guidance.

• Q5. Can patient information be sent through ordinary email?

  HIPAA permits providers to communicate with patients through email when reasonable safeguards are used. Controls can include verifying the address, checking attachments, limiting unnecessary details, and using approved systems. A patient requesting records through unencrypted email under the right of access may choose that method after being informed of the relevant risk. Staff should coordinate patient portal management, secure communication applications, EMR integrations, and records-release tools.

• Q6. What should staff do after sending information to the wrong recipient?

  Staff should report the event immediately through the approved privacy-incident process, preserve the message and transmission facts, and follow authorized mitigation instructions. They should avoid deleting evidence, independently promising the recipient that no further action will occur, or deciding that the information was insignificant. The organization must assess the information involved, recipient, access, mitigation, and applicable breach requirements. This response should connect medical compliance procedures, patient confidentiality, risk management, and medical-office policies.