HIPAA's Privacy Rule explicitly protects any identifiable health information, "whether oral or recorded in any form or medium." Covered entities must have in place "appropriate administrative, technical and physical safeguards" to protect identifiable health information exchanged orally, just as with electronic- or paper-based data.

That said, DHHS has also been explicit in its recognition that oral exchanges must "occur freely and quickly in treatment settings" in order to go about the business of health care delivery. Appropriate protections in practice are to be subject to a test of reasonableness, which "will take into account all the circumstances, including the potential effects on patient care and the financial and administrative burden[s]."

HIPAA explicitly recognizes that incidental uses and disclosures occur as an inevitable byproduct of necessary communications. These "incidentals" do not constitute violations of HIPAA, provided reasonable steps have been taken to limit them.

Most institutions already have confidentiality policies in place, which include warnings about oral communications. Relatively simple steps, like speaking quietly when discussing a patient's condition in public areas, avoiding the use of names or other identifying information in conversations whenever possible, and providing "quiet areas" for protected information exchange, will probably meet the federal reasonableness test.

Note that there is no requirement to document uses or disclosures of information, including oral information, for routine treatment, payment or other health care operations functions. However, where a documentation requirement for a disclosure exists in the Privacy Rule, such as to a public health authority or a court, the Rule applies regardless of the form of the information exchange.

Note also that oral communications, like any other, are subject to the requirement that use and disclosure should be the minimum necessary given roles and responsibilities. (The minimum necessary standard does not apply to exchanges among providers for treatment purposes, whether oral or in any other form.)

There is no requirement that oral communications be taped or digitally recorded, nor must information recorded temporarily (such as notes for transcription) be retained. It is not considered part of the designated record set. However, if such information is retained and used to make subsequent health care decisions, it does become part of the record and is subject to HIPAA rules on access and disclosure.

The Privacy Rule allows the use of oral communications in lieu of written requests for a range of issues:

• resolving conflicts involving consents and authorizations;

• uses and disclosures requiring only an opportunity for the individual to agree or to object (such as listing in a facility directory);

• verifications from a person requesting protected health information when such documentation, statement, or representation is a condition of the disclosure;

• verifications of authority when a disclosure of protected health information is to a public official or a person acting on behalf of the public official, or of a request by a law enforcement official to temporarily suspend an individual's right to receive an accounting of disclosures.

Oral communications used as a substitute for paper or electronic exchange should be documented. HIPAA rules on records disposal and retention then apply.

See also:

• 45 CFR 160.103, 45 CFR 164.501

Last modified: 06-Apr-2005 [RC]