When leaving a voicemail that includes clinical details, what is required to protect patient privacy?

When leaving a voicemail that includes clinical details, what is required to protect patient privacy?

• A. It is always allowed without consent
• B. You must have the patient's prior consent for unencrypted messages
• C. It must be encrypted by default but no consent required
• D. It is never allowed

Answer: (B)

Protecting patient privacy means carefully controlling how protected health information is disclosed in messages. Voicemail is not a guaranteed private channel, so you should not reveal clinical details unless the patient has given explicit permission to receive unencrypted messages that contain PHI. If the patient has provided prior consent for unencrypted voicemail, you may leave the necessary information but keep it concise and avoid unnecessary details. If there is no such consent, you should avoid placing PHI in the voicemail and instead use a secure method or have the patient return your call to discuss the details. Encryption helps reduce risk, but it does not remove the requirement for patient authorization to disclose PHI in an unencrypted voicemail.

Protecting patient privacy means carefully controlling how protected health information is disclosed in messages. Voicemail is not a guaranteed private channel, so you should not reveal clinical details unless the patient has given explicit permission to receive unencrypted messages that contain PHI. If the patient has provided prior consent for unencrypted voicemail, you may leave the necessary information but keep it concise and avoid unnecessary details. If there is no such consent, you should avoid placing PHI in the voicemail and instead use a secure method or have the patient return your call to discuss the details. Encryption helps reduce risk, but it does not remove the requirement for patient authorization to disclose PHI in an unencrypted voicemail.