Which statement best describes HIPAA privacy in PT practice?

• A. Privacy laws generally apply only to written records.
• B. Conversations may be in public if the patient approves.
• C. To comply with HIPAA — patient information should be kept private and shared only with those directly involved in care.
• D. HIPAA privacy is optional for medical professionals.

Answer: (C)

HIPAA privacy centers on protecting patient information no matter how it’s stored or shared, and on sharing only with people who need it to provide care or to handle related activities. In physical therapy, this means keeping patient details—diagnoses, progress notes, treatment plans, billing info, and other PHI—confidential and limiting access to authorized staff directly involved in that patient’s care. The minimum necessary rule guides what is disclosed, and conversations about a patient should happen in private spaces rather than in hallways or public areas. Consent is important when sharing information with anyone not directly involved in the patient’s care, and electronic records must be securely protected with appropriate access controls. This description aligns with the way HIPAA privacy is intended to function in PT practice: patient information stays private and is shared only as needed for treatment, payment, or health care operations.