Under HIPAA Privacy Rule, which statement about consent is true?

Under HIPAA Privacy Rule, which statement about consent is true?

• A. All conversations about patient care may be held in public areas.
• B. PHI can be disclosed to any third party without consent if the patient is informed.
• C. Language barriers prevent treatment from starting until formal consent is obtained.
• D. Written consent must be obtained before any personal health information is disclosed or used for other purposes (exceptions may be made in emergencies or if a delay will prevent timely care).

Answer: (D)

HIPAA requires that, for uses or disclosures of protected health information outside of what’s allowed without consent (such as treatment, payment, or health care operations), a patient’s written authorization is generally needed. Written consent or authorization is the standard way to share PHI for other purposes, with important exceptions: if an emergency arises or delaying care to obtain authorization would jeopardize the patient’s health, disclosures may proceed to the extent necessary to provide timely treatment. This aligns with the correct statement because it captures the need for written authorization for non-permitted disclosures and recognizes the emergency-related exception. The other options violate confidentiality or misstate how consent and disclosures work: public conversations can expose PHI; PHI can’t be disclosed to third parties without appropriate authorization or a valid exception; and treatment should not be blocked by language barriers—appropriate interpreters should be used and care can proceed with consent obtained as appropriate.

HIPAA requires that, for uses or disclosures of protected health information outside of what’s allowed without consent (such as treatment, payment, or health care operations), a patient’s written authorization is generally needed. Written consent or authorization is the standard way to share PHI for other purposes, with important exceptions: if an emergency arises or delaying care to obtain authorization would jeopardize the patient’s health, disclosures may proceed to the extent necessary to provide timely treatment.

This aligns with the correct statement because it captures the need for written authorization for non-permitted disclosures and recognizes the emergency-related exception. The other options violate confidentiality or misstate how consent and disclosures work: public conversations can expose PHI; PHI can’t be disclosed to third parties without appropriate authorization or a valid exception; and treatment should not be blocked by language barriers—appropriate interpreters should be used and care can proceed with consent obtained as appropriate.