A medical assistant at a family practice receives a phone call from a community pharmacy requesting the dosing history of a patient's antihypertensive medication so the pharmacist can verify a refill. The caller identifies the pharmacy and the patient by name and date of birth, and the patient is an established patient of the practice. What is the BEST action under the HIPAA Privacy Rule?
- ARefuse to release any information because the patient has not signed a specific written authorisation for this disclosure to the pharmacy.
- BVerify the pharmacy's identity and the patient context, then share only the dosing information needed for the refill verification. Correct
- CFax the patient's full medication list and recent progress notes to the pharmacy so the pharmacist has complete clinical context for the refill.
- DTell the pharmacist to have the patient call the practice directly because clinical staff cannot release any medication information to a pharmacy by telephone.
Why A is wrong: Tempting because authorisation feels safest, but the Privacy Rule allows disclosure for treatment without a separate written authorisation. Refusing here delays legitimate patient care and misapplies the authorisation requirement, which is reserved for uses outside treatment, payment, or healthcare operations.
Why B is correct: Pharmacy refill verification is a treatment activity between healthcare providers, permitted under the Privacy Rule's treatment, payment, and healthcare operations provisions without separate authorisation, while the minimum-necessary standard still limits the disclosure to the dosing data the pharmacist actually needs.
Why C is wrong: Sending the full chart feels thorough and provider-friendly, but the Privacy Rule's minimum-necessary standard limits disclosures to the information reasonably needed for the purpose. Sharing progress notes and the entire medication list exceeds what refill verification requires.
Why D is wrong: Routing the patient back into the call seems privacy-protective, but the Privacy Rule does not bar telephone disclosures to another treating provider after reasonable identity verification. Refusing creates an unnecessary barrier to care and misreads the rule as more restrictive than it is.