Need to Know

Need to know means that only the individuals that have a need to know individually identifiable health information have access to that information.

Physical and administrative restrictions based on an individual's need to know

Safeguards should be in place to prevent the unauthorized disclosure of patient health information to individuals/employees that do not have a business need to know. While it is important for individuals/employees with a business reason to gain timely access to the information they need to do their job, it is equally important that we balance the scale by inquiring and establishing the reason for the individual's/employee's presence in areas where patient health information may be seen or overheard. For example, if an individual/employee accesses a nurse' station or patient care area, ask the individual/employee the nature of their visit. If there is no business need to be in the nurse' station or patient care area, direct the individual/employee to a more public area. Note: Waiting for another individual/employee for break/lunch or visiting with employees is not a valid reason for accessing a patient care unit in which they otherwise would not have a need to access.

Oral communications

Need to know also applies to oral communications. For example, your co-worker/friend that is not involved in your patient's care does not need to know individually identifiable health information concerning your patient. Do not discuss information concerning your patient with your co-worker/friend.

Verification of identity

Verifying the identity of individuals that request individually identifiable health information is a way of establishing and authenticating the requestor's need to know.

Previous | TOC | Next