The regulator was asked whether HIPAA requires private rooms and soundproof walls. It answered no.

The RealityThe room is not the violation. What gets said in it might be.

⚠️

The Problem

A privacy programme built around the building.

Money goes into partitions and curtains while the real exposure walks past every hour: a diagnosis said at normal volume to a patient six feet from another patient, for no clinical reason.

🔧

The Solution

Safeguard the content, not the square footage.

Decide which conversations move, which screens turn, and what the front-desk display may show — then write those down, because a safeguard that exists only as habit cannot be demonstrated.

✅

The Resolution

The practice can show what it decided and why.

Which is what the standard asks for. It requires appropriate safeguards evaluated for this environment, not the elimination of all risk.

Incidental disclosure rules: the provision that makes open bays lawful

The Privacy Rule’s list of permitted uses and disclosures includes one that is easy to miss: a use or disclosure made incident to a use or disclosure otherwise permitted or required by the rule. That permission is conditional — it applies provided the covered entity has complied with the minimum necessary standard, its implementation requirements, and the safeguards requirement.

That three-way conditional is the whole architecture of the argument, and it is worth stating precisely rather than paraphrasing. Incidental disclosure is permitted. It is permitted because three other things are being done. Remove those three and the permission goes with them.

The regulator’s guidance on the point is equally direct. The Privacy Rule does not require that all risk of incidental use or disclosure be eliminated, and it is not intended to impede customary and essential communications and practices. Covered entities are free to engage in communications as required for quick, effective, and high quality health care.

The phrase that settles it

In its list of practices the rule permits, the regulator writes that a health care professional may discuss lab test results with a patient or other provider in a joint treatment area. Joint treatment area is the regulator’s own term, in its own guidance, describing exactly the setting a physical therapy gym or an infusion suite creates.

The same list covers staff orally coordinating services at nursing stations, discussion of a patient’s condition in a semi-private room, and — the one every front desk asks about — the use of patient sign-in sheets and calling out patient names in waiting rooms.

There is a related answer worth knowing for practices running group sessions: disclosures of protected health information in a group therapy setting are treatment disclosures and may be made without an individual’s authorisation. Group classes and shared rehabilitation sessions sit on the same reasoning.

The minimum necessary exception for the clinical conversation

This surprises people and it changes how a policy should be written. The minimum necessary standard requires reasonable efforts to limit protected health information to the minimum needed for the purpose. But the rule then lists what it does not apply to, and the first item on that list is disclosures to or requests by a health care provider for treatment.

So a clinician-to-clinician treatment conversation on an open floor is categorically outside minimum necessary. Not a balancing test — an exception. What is still inside it is everything non-clinical: the front-desk exchange, the billing question, the scheduling call, the sign-in sheet.

That is a useful division for a practice writing policy, because it puts the constraint where the practice actually has discretion. Nobody wants to shorten a clinical handover for privacy reasons. Everybody can move a payment conversation off the treatment floor.

The non-monetary case examples are more instructive for an ordinary practice. One describes a staff member discussing HIV testing procedures with a patient in the waiting room, disclosing protected health information to several other individuals. Another describes a nurse and an orderly discussing a patient’s HIV status within earshot of other patients without making reasonable efforts to prevent the disclosure.

Read those together and the line is visible. It is not the shared space. It is a sensitive diagnosis, said at conversational volume, where saying it there was not necessary. The same two conversations in the same room about a shoulder impingement would not have produced a case.

The treatment area whiteboard, the patient sign-in sheet and the screen

The regulator names whiteboards explicitly. Among the practices it permits is the use of X-ray lightboards or in-patient logs, such as whiteboards, at a nursing station — paired with the safeguard that the whiteboard is not readily visible to the public, or any other safeguard which reasonably limits incidental disclosures to the general public.

Sign-in sheets are permitted with one specific limit: the sheet may not display medical information that is not necessary for the purpose of signing in, and the regulator gives the example of the medical problem the patient is there about. A sheet with a reason-for-visit column is the failure mode, and it is a form design problem rather than a training problem.

Screens belong in the same category. One published case required a practice to reposition its computer monitors to prevent patients from viewing information on the screens. On an open floor with wall-mounted workstations, screen angle is a safeguard decision that should be made once, deliberately, rather than inherited from wherever the mount happened to go. For chiropractic EHR and IT in particular, the adjusting floor and the workstation are usually the same room.

The reasonable safeguards standard, and how to demonstrate you met it

The safeguards standard requires appropriate administrative, technical and physical safeguards, and its implementation specifications require the entity to reasonably safeguard information to limit incidental uses or disclosures. The word reasonably appears twice. There is no zero-risk obligation anywhere in the operative text.

The printed regulation says the same thing in the same words. The Government Publishing Office’s annual edition of the rule opens the safeguards standard with the requirement that a covered entity have in place appropriate administrative, technical and physical safeguards to protect the privacy of protected health information. Appropriate, not exhaustive.

The regulator adds that reasonable safeguards will vary from covered entity to covered entity depending on factors such as size, and that each entity must evaluate what measures make sense in its environment and tailor its practices accordingly. That is a requirement to make a judgement, which means the judgement is the artefact.

So write it down. Which conversations move off the floor, what the front-desk display shows, where screens face, how the whiteboard is positioned and what may appear on it. A practice that has made those decisions and recorded them has something to show. A practice with the same habits and no document has to reconstruct its reasoning under pressure, and habits do not survive staff turnover. That record is what our HIPAA compliance work produces, alongside the cybersecurity compliance controls that cover the same screens.

Privacy in shared treatment areas: common questions