Rule explicitly protects any identifiable
health information, "whether oral or recorded in
any form or medium." Covered
entities must have in place "appropriate administrative,
technical and physical safeguards" to protect identifiable
health information exchanged orally, just as with electronic-
or paper-based data.
That said, DHHS
has also been explicit in its recognition that oral exchanges
must "occur freely and quickly in treatment settings"
in order to go about the business of health care delivery.
Appropriate protections in practice are to be subject to a
test of reasonableness, which "will take into account
all the circumstances, including the potential effects on
patient care and the financial and administrative burden[s]."
recognizes that incidental
uses and disclosures occur as an inevitable byproduct
of necessary communications. These "incidentals"
do not constitute violations of HIPAA, provided reasonable
steps have been taken to limit them.
already have confidentiality policies in place, which include
warnings about oral communications. Relatively simple steps,
like speaking quietly when discussing a patient's condition
in public areas, avoiding the use of names or other identifying
information in conversations whenever possible, and providing
"quiet areas" for protected information exchange,
will probably meet the federal reasonableness test.
Note that there
is no requirement to document uses or disclosures of information,
including oral information, for routine treatment,
payment or other health
care operations functions. However, where a documentation
requirement for a disclosure exists in the Privacy Rule, such
as to a public health authority
or a court, the Rule applies regardless of the form of the
Note also that
oral communications, like any other, are subject to the requirement
that use and disclosure should be the minimum
necessary given roles and responsibilities. (The minimum
necessary standard does not apply to exchanges among
providers for treatment purposes, whether oral or in any other
There is no requirement
that oral communications be taped or digitally recorded, nor
must information recorded temporarily (such as notes for transcription)
be retained. It is not considered part of the designated
record set. However, if such information is retained and
used to make subsequent health care decisions, it does become
part of the record and is subject to HIPAA rules on access
The Privacy Rule
allows the use of oral communications in lieu of written requests
for a range of issues:
- uses and disclosures
requiring only an opportunity for the individual to agree
or to object (such as listing in a facility
from a person requesting protected health information when
such documentation, statement, or representation is a condition
of the disclosure;
of authority when a disclosure of protected health information
is to a public official or a person acting on behalf of
the public official, or of a request by a law
enforcement official to temporarily suspend an individual's
right to receive an accounting
used as a substitute for paper or electronic exchange should
be documented. HIPAA rules on records
disposal and retention then apply.