When a patient’s PHI is accidentally disclosed, what is the immediate step?

• A. Notify the privacy officer per policy and document the incident; begin breach response
• B. Delete the affected files immediately
• C. Ignore if the disclosure seems minor
• D. Discuss the breach openly in the lobby

Answer: (A)

The immediate action is to trigger the breach response by notifying the privacy officer per policy and documenting the incident. This starts the formal process to contain the exposure, assess potential harm, and determine required steps, including any notifications to affected individuals or regulators. The privacy officer coordinates the response, ensuring actions align with HIPAA and organizational rules, while documentation creates an auditable record of what happened and what was done.

Deleting files or ignoring the disclosure isn’t appropriate because it bypasses the official procedures designed to limit harm and ensure compliance. Discussing the breach in a public area also violates patient confidentiality and can spread the exposure.