Which of the following actions constitutes a breach of patient privacy under HIPAA?

• A. Discussing patient in a public elevator
• B. Sharing PHI with a coworker who is directly involved in the patient's care on a need-to-know basis
• C. Accessing own records
• D. Asking patient to sign forms

Answer: (A)

The focus here is safeguarding patient privacy by limiting disclosures of protected health information to those who need to know and by avoiding conversations in public spaces. Discussing a patient in a public elevator can be overheard by strangers, which risks exposing identifiable health information and violates HIPAA privacy protections. That kind of casual disclosure in a shared public area is the breach.

Sharing PHI with a coworker who is directly involved in the patient’s care on a need-to-know basis is permissible because it supports the patient’s treatment and uses the minimum necessary information. Accessing your own records is generally allowed under HIPAA, provided you follow organizational policies and safeguards. Asking a patient to sign forms is a routine part of consent and authorization processes and does not, by itself, disclose PHI.