Q: We are a doctor’s office in a small town. Recently, one of our patients threw away some papers containing PHI in a wastebasket in the waiting room. Another patient’s child later took them out of the wastebasket. The child’s parent brought the papers up to the desk and apologized. Is this a privacy breach? Are we responsible for the papers even though we turned them over to the patient?
Under what circumstances would it be appropriate for a patient who does not meet inpatient criteria to be registered as outpatient receiving observation services?
Q. Do laptops need to be encrypted if there is no PHI stored on them? Employees do use them to access PHI, but the PHI is stored remotely. We have a policy that states that employees are not allowed to save PHI to laptops.
