You've been a care coordinator at CamMed for eight months. You know most of your patients by name — their medications, their family situations, which ones call in just to chat and which ones only call when something's wrong.
It's 4:47 PM on a Tuesday. Your shift ends in 13 minutes. You're finishing your last chart note when the phone rings.
You pick up. The caller sounds urgent.
"Hi — I'm calling about my father, Robert Meadows. He called me about an hour ago, and he sounded really confused. He thinks he took his blood pressure medication twice this morning, but he can't remember. I need to know what he's on and what the dose is — please, I don't have a lot of time here."
How do you respond?
"You just shared that you're accessing Robert's chart with an unverified caller. You have no way to confirm this is his daughter — or that she's authorized to receive his information. HIPAA requires identity verification before disclosing PHI, even when the urgency feels real. Especially then."
The urgency was real. But verification had to come first.
The pressure you felt was real — that's by design. Try the call again with the sequence in mind: safety first, then identity.
"You protected Robert's privacy — but you left his daughter without direction in a potential emergency. A possible medication overdose isn't a reason to come in. It's a reason to call 911. Privacy protection and patient safety aren't in conflict here. They both have an answer. You only gave one."
You were half right. See what a complete response looks like.
"You did two things in the right order. You redirected to emergency services first — removing urgency from the information request. Then you moved to verify identity before accessing any record. That sequence is the principle: Safety. Verify. Inform. In that order, every time — whether the caller is a worried daughter or a stranger with a story."
You used the correct sequence — Safety, then Verify, then Inform. Restart to build the habit, or go back and explore the other paths.