16.4 HIPAA Confidentiality and Record Release
Key Takeaways
- 45 CFR § 164.524, cited on AMT CMLA-REF-2025-1, gives individuals a right to inspect and obtain a copy of PHI in a designated record set; the covered entity must act no later than 30 days after receipt, with one written extension of no more than 30 days.
- Minimum necessary (45 CFR § 164.502(b)) and need-to-know limit workforce snooping and extra disclosures; the standard does not apply to disclosures to a provider for treatment or to disclosures to the individual.
- Release to family, an employer, or police is not automatic because someone asked; follow SOP, a valid HIPAA authorization, personal-representative rules, or a lawful process such as a warrant, court order, or a listed Privacy Rule exception.
- Elevator and cafeteria talk, misdirected fax or email, and PHI left on printers are confidentiality failures even when a last name is omitted or the conversation is 'only among staff.'
- Do not invent current HIPAA civil-penalty dollar amounts as CMLA facts; contain the disclosure, notify the privacy officer, and follow facility incident procedure.
AMT IV.11.C is two duties: observe tenets of confidentiality and observe tenets of appropriate record release. The reference list on CMLA-REF-2025-1 cites 45 CFR § 164.524 (2025), Access of individuals to protected health information, retrieved December 18, 2025. That section is the patient's access right. The rest of the Privacy Rule tells you when everyone else may see the chart. CMLA will not ask you to litigate every exception. It will ask whether you gossip, whether you hand a spouse a printout, and whether you know the patient can request their own record.
Quick Answer: Speak about a patient only when the job requires it, and only as much as the job requires (minimum necessary / need-to-know). The patient may access PHI under § 164.524 (act within 30 days; one 30-day written extension). Family, employers, and police need authorization or a lawful process—not curiosity or a badge in the lobby. No elevator talk, no wrong-number fax, no results on the printer.
What counts as PHI and who is covered
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule protects protected health information (PHI): individually identifiable health information held or transmitted by a covered entity (health plans, most health-care providers who bill electronically, and health-care clearinghouses) or a business associate. Identifiers plus a clinical fact are enough: name, medical record number, full face photo, address, date of service, accession number, and a test result. A tube rack with readable labels is PHI. A whiteboard with last names and "HIV f/u" is PHI.
Confidentiality is the professional duty not to disclose that information except as authorized. HIPAA is the federal floor; state law and facility SOP may be stricter. AMT Standard 4 requires certificants to comply with privacy laws and safeguard confidences unless legally authorized or compelled to disclose.
Minimum necessary and need-to-know
45 CFR § 164.502(b) requires reasonable efforts to limit PHI uses, disclosures, and requests to the minimum necessary to accomplish the purpose. Facilities implement that with role-based access: accessioning sees orders, a reference-lab courier sees a packing list, billing sees codes, and a collector sees the requisition for the patient in front of them. Need-to-know is the workplace translation: you open the record because you are collecting, processing, or reporting that patient, not because a neighbor is on the schedule.
Minimum necessary does not apply to disclosures to or requests by a health-care provider for treatment, uses or disclosures to the individual, or uses or disclosures under a valid authorization (§ 164.508), among other listed exceptions. That is why a covering physician can receive what is needed to treat, and why you do not withhold a patient's own results from a proper access request by citing minimum necessary. It is also why curiosity clicks in the electronic health record remain a firing and reporting event: treatment of your assigned work is not a license to read every celebrity on the census.
45 CFR § 164.524 — patient access to PHI
Section 164.524 is the named CMLA-REF cite. Except for limited exclusions (notably psychotherapy notes and information compiled for a legal proceeding), an individual has a right to inspect and obtain a copy of PHI about that individual in a designated record set (medical and billing records the covered entity uses to make decisions). Laboratories typically hold reportable results and accession records in that set.
Timelines (do not invent others): the covered entity must act on the request no later than 30 days after receipt—either provide access or issue a written denial. If it cannot meet that, it may take one extension of no more than 30 days, and only if it gives the individual a written statement of the delay reason and the completion date within the original 30 days (§ 164.524(b)(2)). HHS guidance treats these as calendar days and calls 30 days an outer limit, not a goal. Provide the form and format requested if readily producible, including electronic copies of electronic records. Reasonable cost-based fees may cover copying labor, supplies, postage, and agreed summaries—not a punitive chart-retrieval penalty you invent.
A CMLA does not freelance denials. Access requests go to the medical records / health information office or privacy official named in policy. If you are handed a patient request at the window, you route it; you do not refuse because "labs are only for the doctor." Limited unreviewable and reviewable denial grounds exist (endangerment determinations by a licensed professional, certain inmate copies, research suspensions with prior agreement). Those are not collector discretion.
Appropriate record release: patient, family, employer, police
Release is a process, not a favor.
| Requestor | Default CMLA action | What makes release appropriate |
|---|---|---|
| The patient (or personal representative) | Route to the access SOP; do not hide results | § 164.524 access; identity verification; facility forms |
| Family / friend | Do not hand over a printout because they drove the patient | Valid authorization; personal representative paperwork; or limited involvement-in-care disclosures the patient has not objected to, per SOP (§ 164.510) |
| Employer | Do not fax a pre-employment or workers' compensation result from the clinical chart on a supervisor's say-so | Written authorization or a specific occupational/legal pathway in SOP; workplace drug screens follow the program's custody forms (Chapter 8.3), not hallway requests |
| Police / law enforcement | Do not open the LIS because a uniform is at the desk | Warrant, court order, grand-jury subpoena, or a listed § 164.512(f) law-enforcement provision; facility legal/privacy review. Some states add stricter lab-result rules |
| Another treating provider | Use the treatment pathway / LIS routing | Treatment exception; still verify identity of the requestor per SOP |
| Insurer / payer | Billing office process | Payment operations; minimum necessary for that purpose |
A spouse is not automatically a personal representative. A parent of an adult patient is not automatically authorized. A badge is not a HIPAA key. If the situation is a true emergency disclosure, that is a privacy-officer / clinical-leadership call under the applicable exception—not a collector improvising a stack of reports. Follow SOP and legal process is the exam-safe close.
Authorizations (§ 164.508) are specific: who may disclose, to whom, what information, for what purpose, expiration, signature. A sticky note that says "OK to tell my husband" is not a substitute unless policy treats a documented informal permission for a limited involvement-in-care discussion. Results by telephone follow identity-verification SOP (Chapter 17), not a callback to an unverified number on a requisition.
Everyday breaches CMLA actually sees
Elevator, cafeteria, and hallway talk. "The diabetic in bay 2 with the huge viral load" is a disclosure to everyone within earshot, including visitors. Staff-only does not mean public-space-only. Close the door. Use accession numbers on the bench, not shouted names plus tests.
Misdirected fax or email. Wrong cover sheet, wrong stored number, open cc: line, or a result attached to the wrong patient email is a release. Stop, notify the privacy officer, attempt to retrieve or request destruction, and document. Do not ignore it because "they probably deleted it."
PHI on printers, copiers, and screens. Result printers in a hallway, labels facing a waiting room, a signed-on LIS terminal, and a courier manifest left on a counter are access for whoever walks by. Pull printouts immediately, use cover sheets, lock screens, and face labels down in public.
Other classics: taking work home on an unencrypted USB drive, photographing a funny result, discussing a neighbor's pregnancy test with a coworker who is not in the testing chain, and releasing a verbal result to a caller you did not authenticate.
Civil money penalties exist for HIPAA violations, and HHS Office for Civil Rights publishes enforcement figures that change. Do not invent dollar amounts as current official CMLA facts. The exam-useful response is: report, contain, document, cooperate with the privacy officer. Do not hide a mis-fax to avoid trouble.
In practice
A patient's adult child asks for yesterday's metabolic panel "because Mom wants me to keep track." You do not pull the report. You explain that records go through the release-of-information process and offer the access form. A police officer asks whether a named person was in the lab this morning. You do not confirm from memory at the window; you route the officer to the administrator and privacy process. You shred a misprinted label, lock your screen when you walk away, and save the result discussion for a closed work area.
Exam traps
- Minimum necessary is not a reason to deny a patient their own § 164.524 access.
- Family, employers, and police are different requestors with different rules; none is "always yes."
- Thirty days is the access action deadline in the regulation, with one documented 30-day extension—not 90 business days.
- Elevator talk with no last name can still be PHI.
- Penalty dollar figures you memorized from a blog are not CMLA content.
A patient submits a written request for copies of their laboratory results. What does 45 CFR § 164.524 require of the covered entity?
Which record-release decision matches HIPAA and laboratory SOP teaching?
Which situation is a confidentiality failure under HIPAA minimum-necessary and need-to-know rules?