HIPAA quick reference for healthcare staff
A concise guide to the everyday HIPAA rules that apply to anyone who handles patient data on a work device or network — what you must do and what to avoid.
This is a quick-reference guide, not legal advice. Your practice or employer may have additional requirements.
What counts as Protected Health Information (PHI)
Any information that can identify a patient AND relates to their health, treatment, or payment. Common examples:
- Name, address, date of birth, phone number (when combined with health information)
- Medical record numbers, insurance IDs
- Lab results, diagnoses, prescriptions, clinical notes
- Photos or recordings that identify a patient
Your everyday obligations
| Situation | Required action |
|---|---|
| Emailing PHI externally | Use your organisation's approved secure-message system — not standard email |
| Storing PHI on your device | Use only approved, encrypted drives or cloud storage |
| Sharing a screen during a video call | Minimise windows containing PHI before sharing |
| Printing PHI | Collect printouts immediately; never leave them in the tray |
| Disposing of documents | Shred or use the secure document-destruction bin |
| Accessing PHI from a public network | Always use the VPN before connecting |
Breach reporting
If you believe PHI has been accidentally disclosed (email sent to the wrong person, device lost or stolen):
- Report it immediately to your Privacy Officer or IT contact — do not wait.
- Do not attempt to recover the information yourself.
- Document what happened, when, and what data was involved.
Early reporting allows your organisation to assess whether the breach triggers a formal HIPAA notification obligation (which has strict timelines).
Common mistakes to avoid
- Do not text PHI using personal messaging apps (WhatsApp, iMessage, standard SMS).
- Do not take photos of patient records or screens with a personal phone.
- Do not leave a workstation unlocked when you step away — use Windows + L to lock it instantly.
- Do not discuss patient cases in public areas where others can hear.
Questions? Contact your organisation's Privacy Officer or call the help desk: (972) 961-7711 Option 2.