hipaa.systems
Free training episode · front desk · about 7 minutes · no sign-up

8:47 a.m. One shift. Seven decisions.

A short scenario for front-desk and office staff at outpatient practices. You run the desk at the busy start of a shift: a colleague's slip, a family caller and a health plan's request. Every decision explains the rule behind it. All people and records are fictional.

Decision 1 of 7

Decision 1 of 7

Three things at once

8:47 a.m. You're new at the front desk of Lakeview Health Partners. Your first patient arrives at 8:50.

Dana Front desk colleague

I sent a patient's file link to the wrong person. What do I do?

Grace Patient's daughter · on the phone

Can you read me my dad's test results? I need them before work.

Email · Bayview Health Plan

Records needed for a claim.

None of these is a medical emergency.

Where do you start? Choose one

Right

Start the response while access might still be limited. Grace and the claim stay on your list.

Dana

Thanks. Reporting it now.

Grace

Sure, I'll hold.

Your practice's policy Report a possible slip through your practice's route right away. Why: 45 CFR 164.308(a)(6)

Why the other answers are wrong
  • Handle Grace's results request first; take Dana's report next. Not yet. None of these tasks is a medical emergency; Lakeview gives the possible exposure priority. Five minutes later Dana writes: “The access history shows two opens.” Waiting can leave the link available.
  • Handle the payer's records request first; take Dana's report next. Not yet. Keep the claim request queued. Lakeview's procedure gives the possible exposure priority while access might still be limited; no medical emergency changes that order here.

Decision 2 of 7

The link is still open

You've reported it to Ms. Ruiz, today's incident contact.

Previous conversation

Dana: I sent a patient's file link to the wrong person. What do I do?

Grace: Can you read me my dad's test results? I need them before work.

Email · Bayview Health Plan: Records needed for a claim.

None of these is a medical emergency.

Dana: Thanks. Reporting it now.

Grace: Sure, I'll hold.

Ms. Ruiz Office manager · privacy contact

Got your report. Our procedure lets Dana disable the misdirected link.

Dana Front desk colleague

The link still works. Should I delete the sent message too?

Which steps should Dana take now? Choose all that apply

Right

Access is limited and the facts are kept. Ms. Ruiz decides whether it was a breach — not you.

Dana

Disabled. Message kept.

Ms. Ruiz

Received. I'll handle the assessment and follow-up.

HIPAA requires The practice must respond to suspected security incidents and document what happened. 45 CFR 164.308(a)(6)(ii)

Why the other answers are wrong
  • Clear the sent message after reporting the incident. Not yet. Reporting the incident doesn't establish that the message and access history have been preserved elsewhere. Keep those records for the response; the report isn't a substitute for them.
  • Get the recipient's reply before turning off the link. Not yet. Don't make containment depend on a recipient replying. Lakeview already permits disabling this misdirected link; preserve the facts and let the response process handle recipient follow-up.

Decision 3 of 7

I'm his daughter

Back to line 2.

Previous conversation

Dana: I sent a patient's file link to the wrong person. What do I do?

Grace: Can you read me my dad's test results? I need them before work.

Email · Bayview Health Plan: Records needed for a claim.

None of these is a medical emergency.

Dana: Thanks. Reporting it now.

Grace: Sure, I'll hold.

Ms. Ruiz: Got your report. Our procedure lets Dana disable the misdirected link.

Dana: The link still works. Should I delete the sent message too?

Dana: Disabled. Message kept.

Ms. Ruiz: Received. I'll handle the assessment and follow-up.

Grace Patient's daughter · on the phone

Dad is 68. I drive him to his appointments. Can you read me his results?

What tells you whether Grace may receive his results? Choose one

Right

Check what sharing is allowed, not only who is calling.

Grace

Okay. I'll wait.

HIPAA permits Family involvement can permit some sharing — not automatic access to everything. 45 CFR 164.510(b)

Why the other answers are wrong
  • Whether the caller knows the patient's identity details. Not yet. A matching birth date may help check who is calling, but it doesn't establish who may receive results. Check what the patient has allowed before sharing.
  • How the caller is related to the patient. Not yet. A family relationship doesn't by itself establish permission to receive this adult's results. Review his sharing instructions; any claimed representative authority needs its own check.

Decision 4 of 7

But I have power of attorney

You open his record.

Previous conversation

Dana: I sent a patient's file link to the wrong person. What do I do?

Grace: Can you read me my dad's test results? I need them before work.

Email · Bayview Health Plan: Records needed for a claim.

None of these is a medical emergency.

Dana: Thanks. Reporting it now.

Grace: Sure, I'll hold.

Ms. Ruiz: Got your report. Our procedure lets Dana disable the misdirected link.

Dana: The link still works. Should I delete the sent message too?

Dana: Disabled. Message kept.

Ms. Ruiz: Received. I'll handle the assessment and follow-up.

Grace: Dad is 68. I drive him to his appointments. Can you read me his results?

Grace: Okay. I'll wait.

Patient's sharing instruction

“Call me directly about results. Do not discuss results with Grace.”

You don't read that instruction aloud.

Grace Patient's daughter · on the phone

I have his health care power of attorney.

Nothing on file shows her claimed authority has been checked.

His current record says he makes his own health-care decisions.

What do you do with Grace's request now? Choose one

Right

Don't give Grace the results now. Ms. Ruiz checks whether the document applies; you don't decide its legal effect at the desk. Keep his instruction in place unless a valid basis for sharing is established.

Ms. Ruiz

Later: we reached him directly. He agreed to a limited discussion with Grace. Clinical staff will call her.

Your practice's policy Ask your practice's privacy contact to resolve unclear authority. Why: 45 CFR 164.502(g) — personal representatives

Why the other answers are wrong
  • Accept Grace's claim and arrange for clinical staff to call her. Not yet. Saying she has a document doesn't establish that it lets her act for him here. Keep the results private while Ms. Ruiz checks the document and applicable rules.
  • Keep results private and tell Grace her paperwork cannot authorize sharing. Not yet. Not giving her results now respects his instruction. But saying her document cannot authorize sharing is a legal conclusion you haven't checked. Ms. Ruiz reviews whether it applies; his current capacity alone doesn't settle every document under every state's law.

Decision 5 of 7

A familiar logo

The health plan writes again.

Previous conversation

Dana: I sent a patient's file link to the wrong person. What do I do?

Grace: Can you read me my dad's test results? I need them before work.

Email · Bayview Health Plan: Records needed for a claim.

None of these is a medical emergency.

Dana: Thanks. Reporting it now.

Grace: Sure, I'll hold.

Ms. Ruiz: Got your report. Our procedure lets Dana disable the misdirected link.

Dana: The link still works. Should I delete the sent message too?

Dana: Disabled. Message kept.

Ms. Ruiz: Received. I'll handle the assessment and follow-up.

Grace: Dad is 68. I drive him to his appointments. Can you read me his results?

Grace: Okay. I'll wait.

Patient's sharing instruction: “Call me directly about results. Do not discuss results with Grace.”

You don't read that instruction aloud.

Grace: I have his health care power of attorney.

Nothing on file shows her claimed authority has been checked.

His current record says he makes his own health-care decisions.

Ms. Ruiz: Later: we reached him directly. He agreed to a limited discussion with Grace. Clinical staff will call her.

Email · Bayview Health Plan · Claim BHP-20817

Please upload the visit note and supporting report for October 6. Upload here → bayview-claims-docs.net

The plan's name is familiar. The upload address is new.

Which route do you use to check the payer's identity? Choose one

Right

The known portal confirms the request and the claim.

HIPAA requires Check an unknown requester's identity and authority before this payment disclosure. 45 CFR 164.514(h)

Why the other answers are wrong
  • Use the page linked in the email to check the payer's identity. Not yet. The new address is part of the request you haven't verified. A convincing page or logo there doesn't establish who controls it.
  • Use a reply to the email to check the payer's identity. Not yet. The reply reaches whoever controls this message. Get confirmation through an independent route, not the same unverified correspondence.

Decision 6 of 7

Build the packet

The portal confirms the request.

Previous conversation

Dana: I sent a patient's file link to the wrong person. What do I do?

Grace: Can you read me my dad's test results? I need them before work.

Email · Bayview Health Plan: Records needed for a claim.

None of these is a medical emergency.

Dana: Thanks. Reporting it now.

Grace: Sure, I'll hold.

Ms. Ruiz: Got your report. Our procedure lets Dana disable the misdirected link.

Dana: The link still works. Should I delete the sent message too?

Dana: Disabled. Message kept.

Ms. Ruiz: Received. I'll handle the assessment and follow-up.

Grace: Dad is 68. I drive him to his appointments. Can you read me his results?

Grace: Okay. I'll wait.

Patient's sharing instruction: “Call me directly about results. Do not discuss results with Grace.”

You don't read that instruction aloud.

Grace: I have his health care power of attorney.

Nothing on file shows her claimed authority has been checked.

His current record says he makes his own health-care decisions.

Ms. Ruiz: Later: we reached him directly. He agreed to a limited discussion with Grace. Clinical staff will call her.

Email · Bayview Health Plan · Claim BHP-20817: Please upload the visit note and supporting report for October 6. Upload here → bayview-claims-docs.net

The plan's name is familiar. The upload address is new.

Ms. Ruiz Office manager · privacy contact

The health plan's request checks out in the payer portal. It's for payment of our claim.

Payer portal · Claim BHP-20817

Requested: the October 6 visit note and the supporting test report.

Ms. Ruiz

Billing checked: no restriction prevents sending these records for this claim. Can you build the packet?

Which documents go in the packet? Choose all that apply

Right

Enough for the purpose, nothing unrelated. Check the attachments, send through the approved portal and record the release.

Ms. Ruiz

Sent through the portal and recorded. Thanks.

HIPAA requires Send enough for the permitted purpose, not unrelated extras. Minimum necessary — 45 CFR 164.502(b), 164.514(d)

Why the other answers are wrong
  • Visit-note bundle Not yet. This bundle isn't part of the verified request, and no need for those prior records has been established for this claim. Keep it out of this packet; a broader request would need review.
  • Message thread Not yet. The verified request asks for the visit note and supporting report. Nothing in this case establishes a payment need for the appointment-message thread.

Decision 7 of 7

One more call

A new situation, a different patient.

Previous conversation

Dana: I sent a patient's file link to the wrong person. What do I do?

Grace: Can you read me my dad's test results? I need them before work.

Email · Bayview Health Plan: Records needed for a claim.

None of these is a medical emergency.

Dana: Thanks. Reporting it now.

Grace: Sure, I'll hold.

Ms. Ruiz: Got your report. Our procedure lets Dana disable the misdirected link.

Dana: The link still works. Should I delete the sent message too?

Dana: Disabled. Message kept.

Ms. Ruiz: Received. I'll handle the assessment and follow-up.

Grace: Dad is 68. I drive him to his appointments. Can you read me his results?

Grace: Okay. I'll wait.

Patient's sharing instruction: “Call me directly about results. Do not discuss results with Grace.”

You don't read that instruction aloud.

Grace: I have his health care power of attorney.

Nothing on file shows her claimed authority has been checked.

His current record says he makes his own health-care decisions.

Ms. Ruiz: Later: we reached him directly. He agreed to a limited discussion with Grace. Clinical staff will call her.

Email · Bayview Health Plan · Claim BHP-20817: Please upload the visit note and supporting report for October 6. Upload here → bayview-claims-docs.net

The plan's name is familiar. The upload address is new.

Ms. Ruiz: The health plan's request checks out in the payer portal. It's for payment of our claim.

Payer portal · Claim BHP-20817: Requested: the October 6 visit note and the supporting test report.

Ms. Ruiz: Billing checked: no restriction prevents sending these records for this claim. Can you build the packet?

Ms. Ruiz: Sent through the portal and recorded. Thanks.

Alex Caller about Morgan's bill

I'm sorting out Morgan's bill. Did Morgan come in yesterday?

Morgan's record

“Alex may discuss appointment attendance and billing.”

Morgan is an adult. Lakeview's caller checks are complete. No conflicting instruction is on file.

Which reply fits Morgan's recorded permission? Choose one

Right

Checking first showed you how to help — not just when to refuse.

Alex

Thanks, that's all I needed.

HIPAA permits Share only what fits the person's involvement and the patient's agreement. 45 CFR 164.510(b)

Why the other answers are wrong
  • I can confirm yesterday's attendance once Morgan's signed release reaches us. Not yet. A new signed authorization isn't needed for this attendance answer: Morgan's recorded choice and the completed caller checks already support the limited conversation.
  • I can confirm yesterday's attendance and go through the clinical note with you. Not yet. The clinician's explanation goes beyond the attendance question and the recorded billing/attendance permission. Answer that question without expanding into the care provided.

Shift complete

The first patient is here

Dana

I nearly waited until lunch.

You

I'm glad you didn't.

Report the slip. Check before sharing. Send what's needed — not everything you have.

Episode complete. Your employer must also teach its own policies and procedures.

All episodes

The whole front-desk add-on

Every front-desk episode: $19 per learner on top of the $29 core course every role needs. With a final check, a certificate of completion and a training record.

See pricing

Front desk: one practice scenario, not a complete HIPAA training program. HIPAA requires your employer to train you on its own policies and procedures (45 CFR 164.530(b)) and to run a security awareness program (164.308(a)(5)). Sources checked 2026-10-19. More: all episodes by role · HIPAA training for new employees.