Is It a HIPAA Violation to Leave Biopsy Results on Voicemail?

Carolyn Buppert, NP, JD


September 06, 2012


Can I report a patient's biopsy results on his or her voicemail? Is this a HIPAA violation?

Response from Carolyn Buppert, NP, JD
Attorney, Law Office of Carolyn Buppert PC, Bethesda, Maryland

Leaving biopsy results on voicemail could be a Health Insurance Portability and Accountability Act (HIPAA) violation. If a clinician has queried the patient with "How would you like me to communicate the results?" and the patient says, "Leave it on my voicemail at xxx-xxx-xxxx," then it would not violate HIPAA to do so. However, unless the patient has directed the clinician to leave the results on the voicemail, the clinician cannot assume that the voicemail is private and restricted to that individual. Certainly, it could be a shock to an uninformed family member to check household voicemail and find that a loved one's biopsy was positive.

Under HIPAA, protected health information is individually identifiable health information transmitted or maintained in any form or medium. Individually identifiable information includes diagnoses, procedures done, results, name, address, birth date, and other identifying numbers.

Ideally, whenever a clinician orders a test, the clinician will ask the patient to specify a means of communicating the results. One way to cover any potential HIPAA concerns is to have each patient authorize, in writing, specified disclosures in specified ways. For example, a clinic's authorization form could read as seen in the Figure.


Release of information (sample form).

If you don't have a form like this filled out and signed and you don't have the patient's authorization to leave the results on voicemail, leave this message: "This is [your name] at [your office or facility]. Please call me at [number]."

Under certain circumstances, even this is too much information. If the office is a sexually transmitted disease clinic, Planned Parenthood, or even a plastic surgery office, it is best to leave a messaging saying you are calling from "the doctor's office" or "the clinic."