Which of the following statements best reflects HIPAA privacy rules as they apply to case management communications?

• A. Protect PHI and apply minimum necessary standard
• B. Share PHI with anyone who asks
• C. Ignore consent requirements
• D. Use unencrypted email for all communications

Answer: (C)

The key idea is safeguarding PHI and sharing only what’s necessary to coordinate care. HIPAA’s privacy rules require that protected health information be protected and that disclosures be limited to the minimum amount needed for the intended purpose. In case management, this means you share PHI only with people who need it to help manage the patient’s care, and you use secure, appropriate channels to transmit that information.

Disclosures should not be open to anyone who asks, and you shouldn’t rely on consent in a way that ignores the safeguarding principle—authorization or allowed-permitted disclosures under HIPAA govern when and how PHI can be shared. Also, PHI should not be sent through unencrypted channels like unencrypted email, since that can expose sensitive information during transit.

So the statement that best reflects HIPAA privacy in case management is the one that emphasizes protecting PHI and adhering to the minimum necessary standard in all communications.