Which scenario demonstrates a breach of patient confidentiality?

Which scenario demonstrates a breach of patient confidentiality?

• A. Sharing results with a patient-authorized individual
• B. Disclosing a patient’s biopsy result to a coworker not involved in care without consent
• C. Sharing with the patient only
• D. De-identifying data for research

Answer: (B)

Protecting patient confidentiality means sharing health information only with people who need to know to provide care or who are authorized by the patient. Information can be shared with the patient themselves, with someone the patient explicitly designates, or within the care team if that coworker is directly involved in treatment. It can also be used in de-identified form for research, since removing identifying details reduces privacy risks. Disclosing a patient’s biopsy result to a coworker who is not involved in the patient's care and without the patient’s consent is a breach because that coworker has no legitimate need to know, and there is no authorization for that disclosure. This violates the duty to keep PHI confidential and the principle of only sharing the minimum necessary information. The other scenarios fit confidentiality rules: sharing with a patient-authorized person is allowed, sharing with the patient alone is the expected way to communicate results, and de-identifying data for research is appropriate privacy-protective practice.

Protecting patient confidentiality means sharing health information only with people who need to know to provide care or who are authorized by the patient. Information can be shared with the patient themselves, with someone the patient explicitly designates, or within the care team if that coworker is directly involved in treatment. It can also be used in de-identified form for research, since removing identifying details reduces privacy risks.

Disclosing a patient’s biopsy result to a coworker who is not involved in the patient's care and without the patient’s consent is a breach because that coworker has no legitimate need to know, and there is no authorization for that disclosure. This violates the duty to keep PHI confidential and the principle of only sharing the minimum necessary information.

The other scenarios fit confidentiality rules: sharing with a patient-authorized person is allowed, sharing with the patient alone is the expected way to communicate results, and de-identifying data for research is appropriate privacy-protective practice.