What constitutes patient confidentiality and what federal law governs PHI protection in the United States?

• A. The obligation to protect a patient’s private health information; governed by HIPAA.
• B. The obligation to share a patient’s private health information with family upon request.
• C. The obligation to protect a patient’s private health information; governed by FERPA.
• D. There is no confidentiality obligation in health care.

Answer: (A)

Protecting a patient’s private health information from unauthorized disclosure is patient confidentiality. In the United States, this protection is governed by HIPAA, which establishes how PHI can be used and shared and gives patients rights over their information. HIPAA’s Privacy Rule and Security Rule apply to covered entities and business associates, define what counts as PHI, and set when disclosures are allowed—such as for treatment, payment, health care operations, or with patient authorization or as required by law. The minimum necessary standard requires sharing only the amount of PHI needed. Sharing with family on request isn’t automatic; it generally requires the patient’s consent or another permitted exception. FERPA, which protects educational records, is not the federal law that governs PHI in health care. There is a confidentiality obligation in health care, and HIPAA is the federal framework that governs PHI protection.