Q&A: Posting thank you notes from patients

Q: I work in the maternity department of a hospital, and sometimes we get thank-you notes. It a HIPAA violation to post those notes in an employee-only area? They often include patient names and other personal information.

A: Posting these notes in a staff-only area is acceptable, since the note writer intended for the information to be shared with the staff who provided care. They should not be posted in a public area.

Editor’s note: Question answered by Mary Brandt, MBA, RHIA, CHE, CHPS. Brandt is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Heidi Samuelson at hsamuelson@hcpro.com.