Which action is NOT compliant with HIPAA?

• A. Cropping all patient identifiers from images used for teaching purposes.
• B. Refraining from disclosing patient health information without proper authorization.
• C. Reviewing your neighbors medical studies on your hospital PACS system so you can give her your opinion of her condition.
• D. Covering your daily requisition list so that the names are not visible to patients and visitors.

Answer: (C)

The main idea here is protecting patient privacy by limiting access to health information to appropriate, authorized purposes. Accessing a neighbor’s medical studies on the hospital’s imaging system to give a personal opinion about her condition is a violation of HIPAA. PHI should only be accessed if you have a legitimate role-based need related to care, billing, or operations, and with proper authorization. Browsing someone else’s confidential information for personal reasons bypasses the minimum necessary standard and constitutes unauthorized access and disclosure, which is not allowed.

The other actions align with privacy practices. Removing all patient identifiers from images before using them for teaching is a standard de-identification step that reduces the risk of linking data to a patient. Not disclosing PHI without proper authorization is precisely what HIPAA encourages. Covering a daily requisition list so names aren’t visible to patients and visitors helps prevent unintended exposure of identities in public areas.