If you cannot obtain two identifiers for a patient before releasing information, what is the appropriate course of action?

• A. Release with one identifier.
• B. Release after calling the patient.
• C. Release after verifying with a third party.
• D. Do not release information and escalate per policy.

Answer: (D)

Protecting patient privacy relies on confirming identity before sharing information. Two identifiers help verify that the person requesting data is authorized and that you’re releasing information about the correct patient. When two identifiers can’t be obtained, you should not disclose any information. Instead, escalate according to your organization’s policy—this might mean pausing the release, contacting a supervisor or privacy officer, or following a formal verification process through approved channels. Document the attempt and the reason for not releasing yet, and proceed only after proper verification or an authorized exception is granted.

In practice, releasing with only one identifier or attempting to verify via a casual phone call can still leave the patient’s information vulnerable to disclosure to the wrong person. Third-party verification can introduce risk if it isn’t a sanctioned, secure process. Escalating to the proper policy framework ensures the right steps are taken to protect confidentiality.