HIPAA, Confidentiality, and Professional Communication in the Clinic

Why HIPAA Matters in the PT Clinic

As a PT aide you will hear, see, and handle sensitive information about patients every single day. A patient's diagnosis, treatment plan, insurance details, and even the fact that they are a patient at all — all of this is protected by federal law. The Health Insurance Portability and Accountability Act (HIPAA), passed by Congress in 1996, sets national standards for protecting that information. Violations can result in civil and criminal penalties for the clinic and can end a healthcare worker's career. More importantly, a violation can harm a real person by exposing their private health details without consent.

Protected Health Information (PHI)

Protected health information, or PHI, is any information that (1) relates to a person's past, present, or future physical or mental health condition, healthcare treatment, or payment for care, and (2) can be used to identify that person. PHI can be spoken, written on paper, or stored electronically (electronic PHI is called ePHI).

Examples of PHI include a patient's name paired with their diagnosis, their date of birth, medical record number, phone number, appointment dates, and billing information. Even a hallway conversation that reveals a patient's condition to someone who should not hear it is a PHI disclosure.

The HIPAA Privacy Rule and the Minimum Necessary Standard

The HIPAA Privacy Rule controls how covered entities — including PT clinics — use and share PHI. One of its core principles is the minimum necessary standard: you should access, use, or share only as much PHI as is needed to do your specific job task. As an aide, you do not need a patient's complete medical history to escort them to the treatment table. Do not look up records out of curiosity, and do not share more details than the task requires.

Permitted disclosures are situations where PHI may be shared without the patient's written authorization. The most common are: treatment (sharing information with other members of the care team), payment (billing the patient's insurance), and healthcare operations (running the clinic). Disclosures outside these categories generally require the patient to sign an authorization for release of records form.

The HIPAA Security Rule and Electronic PHI

The Security Rule applies specifically to ePHI — information stored or transmitted electronically, such as in the clinic's scheduling software or electronic health record (EHR). As an aide your Security Rule duties are straightforward but critical:

• Always log off a shared workstation when you step away, even briefly.
• Never share your login credentials with anyone.
• Do not access patient records on personal devices unless your employer has a specific, approved policy.
• Position screens so that passersby cannot read patient data.

These steps prevent unauthorized access and protect both patients and the clinic.

Your Scope as an Aide

Your scope of practice under HIPAA runs alongside your clinical scope. You carry out tasks the supervising PT or PTA assigns and communicate information only as directed. If a family member calls and asks about a patient's progress, you should not share clinical details. Politely take a message and let the supervising clinician decide what to communicate. This is not rude — it is both legally required and ethically correct.

Compliant Verbal Communication

In the clinic, keep voices low when discussing patient information. Do not use patient names or diagnoses in waiting areas or hallways where others can hear. If a patient asks you a clinical question you are not authorized to answer, say clearly: "That's a great question for your therapist — I'll let them know you'd like to speak with them." Never speculate about diagnoses or progress.

Compliant Written and Fax Communication

When faxing records, always use a cover sheet that includes a confidentiality notice and confirm you have the correct fax number before sending. Misdirected faxes are a common HIPAA breach. Paper records should be stored securely and shredded — not placed in regular trash — when disposal is needed.

Compliant Electronic Communication

Email and text messages that contain PHI must use encrypted or secure channels approved by the clinic. Do not text patient information from a personal phone. Voicemails are a common area of risk: when leaving an appointment reminder, include only the minimum information necessary — typically the patient's first name, the clinic name, the date and time, and a callback number. Do not state the diagnosis or nature of treatment.

Patient Rights Under HIPAA

Patients have the right to access their own records, request corrections, and ask for an accounting of who has seen their information. If a patient asks you about these rights, direct them to the front desk or the clinic's Privacy Officer. You are not responsible for processing these requests yourself, but you should know they exist.

Safety Note

A HIPAA breach is not only a legal and financial risk — it is a patient safety issue. Patients who fear their information will not be kept private may withhold important health details from their care team, leading to unsafe treatment decisions. Protecting confidentiality is part of protecting the patient.