Which of the following actions would be the HIPAA violation?

• A. You logging out after access
• B. You printing a patient summary for personal use
• C. You reading an open patient record
• D. You discussing patient data with colleagues

Answer: (C)

The main idea being tested here is that access to protected health information must be limited to people with a legitimate, job-related need to know. HIPAA requires the minimum necessary standard and strong safeguards to protect PHI.

Reading a patient record that is open but not needed for your work is a direct breach of that principle. Even though the record is accessible, you must still have a legitimate purpose to view it. If you read it without a justified business need, you’re accessing PHI without authorization or purpose, which is a HIPAA violation.

The other actions don’t illustrate the same clear violation. Logging out after access is a good security practice that helps prevent unauthorized use. Printing a patient summary for personal use is misuse of PHI and would violate privacy rules. Discussing patient data with colleagues can be appropriate when it’s for treatment, payment, or operations and you’re sharing only with those who need to know, within the proper safeguards.