“Just call my name, and I’ll be there,” sang the Jackson 5 in 1989. In the waiting room, this is usually the case: the office staff walks out into a full waiting room and calls out a patient’s first and last name. But now, everyone in the room has heard that patient’s name. Is the staff member’s use of the patient’s full name considered a HIPAA violation? The short answer is “probably not”.
The HIPAA Privacy Rule does not prohibit a Covered Entity (most healthcare facilities) from using a patient’s name in the waiting room. The Rule explicitly permits the incidental disclosure of names that may result from the routine use of a patient’s name when other patients are in a waiting room and can hear and identify the person whose name is called. These incidental disclosures are permitted when the Covered Entity has implemented reasonable safeguards and the minimum necessary standard.
However, HIPAA does impose reasonable, common sense limitations:
- Consider whether the patient’s full name is really needed. In many cases, only a first or last name is necessary. Of course, no matter what form of the name is used, it is a good practice to confirm that the right patient responded after leaving the waiting room. Commonly, many practices confirm a birthdate before leaving the patient in the exam room.
- It is likely not appropriate to include the medical reason for the visit when calling the patient. For example, announcing “Ms. Smith, who is here for a gastroscopy” does not follow the requirement that the disclosure be appropriately limited to the minimum necessary.
- Develop a policy about how a patient in the waiting area should be called. Train the office staff, and keep records of the training. Re-train office staff periodically.
For more information, please contact the LAMMICO Risk Management and Patient Safety Department at 504.841.5211.