Optometry Coding & Billing Alert

Published on Thu Mar 10, 2005 PDF

Question: We sometimes get calls from patients wanting their medical information over the telephone. Is this a HIPAA violation? What is the best way to authenticate that these callers are who they say they are?


Mississippi Subscriber

Answer: It's almost impossible to verify the identity of someone on the other end of the telephone. It's OK to give out PHI over the phone if you've initiated contact with a patient and obtained his permission, but you're opening yourself up to a potential HIPAA violation.

The caller could be an ex-spouse or someone in a custody dispute trying to obtain confidential information. In those cases, a caller might know the patient's Social Security number or other identifying info.

Bottom line: Give health information over the phone only as a last resort. If you're worried about authenticating callers, you could assign patients a password or some other information that proves that they really are who they claim to be.

Advice for Reader Questions and You Be the Expert contributed by David Gibson, OD, FAAO, practicing optometrist in Lubbock, Texas; and Charles Wimbish, OD, president of Wimbish Consulting Group in Martinsville, Va.