Patient confidentiality is the duty to keep a patient’s health information private and share it only when the law or the patient allows. For a medical practice, it is also a daily operational task: it touches the front desk, phone calls, billing, texts, email, and every vendor that sees patient data. This 2026 patient confidentiality guide explains what HIPAA allows and requires, where practices most often slip, how breach rules work, and a checklist your staff can follow.
What Patient Confidentiality Means in a Medical Practice
Confidentiality covers any information that identifies a patient and relates to their health, care, or payment, called protected health information (PHI). That includes medical records, test results, insurance details, appointment times, billing statements, and even the fact that a person is a patient. It applies to paper, screens, conversations, and electronic messages alike.
Protecting patient confidentiality matters for two reasons. Patients share more complete histories when they trust the practice, which leads to better care and better documentation. And a privacy failure can bring federal penalties, state action, and lasting damage to the practice’s reputation.
What HIPAA Allows and Requires
The HIPAA Privacy Rule sets the main standards for practices in the United States:
- Treatment, payment, and operations: a practice may share PHI without written authorization to treat the patient, bill for care, and run the practice, such as sending claims or coordinating with a referring physician.
- Minimum necessary: for payment and operations, share only the information needed for the task. This rule does not limit sharing between providers for treatment.
- Authorization: most other uses, such as marketing, need the patient’s written authorization.
- Right of access: patients can request copies of their records, and practices generally must respond within 30 days.
- Business associates: every vendor that handles PHI, including billing and IT companies, must sign a Business Associate Agreement.
State laws can add stricter rules for certain records, such as mental health, HIV status, or minors’ care, and those rules apply on top of HIPAA.
Substance Use Disorder Records: The 2026 Part 2 Deadline
Records from federally assisted substance use disorder programs are also protected by 42 CFR Part 2. A 2024 final rule brought Part 2 closer to HIPAA, allowing a single patient consent for future treatment, payment, and operations disclosures, and applying HIPAA-style breach notification. Programs had to comply by February 16, 2026. Practices that receive these records should confirm that their consent forms and record handling follow the updated rule.
Common Patient Confidentiality Mistakes in Practices
- Front desk conversations: discussing diagnoses or balances where other patients can hear.
- Voicemail and calls: leaving detailed results on a shared voicemail, or confirming information to a caller without verifying identity.
- Unsecured email and texts: sending PHI by personal email or text without the patient’s agreement or proper safeguards.
- Staff snooping: employees viewing records of family, coworkers, or public figures without a work reason.
- Lost or shared devices: unencrypted laptops or phones, and shared logins to the EHR.
- Missing BAAs: vendors with access to PHI but no signed agreement.
What Happens After a Breach
When unsecured PHI is accessed or shared improperly, the practice must assess the risk and, in most cases, notify affected patients without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS and the media within 60 days. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. Our guide to HIPAA audit preparation covers the documents to keep ready.
Patient Confidentiality Checklist for Your Staff
- Complete and update a HIPAA security risk analysis at least once a year.
- Train every staff member at hire and every year, and keep sign-in records.
- Give each user a unique EHR login, use role-based access, and review access logs.
- Encrypt laptops and phones, and turn on multifactor authentication.
- Verify identity before sharing information by phone, and record patients’ contact preferences.
- Keep signed BAAs for every vendor with PHI access.
- Shred paper records and wipe devices before disposal.
- Write a breach response plan with a named privacy officer.
For wider rules on billing and privacy, see our guide to medical compliance in 2026, and our article on data security and privacy in healthcare IT.
Frequently Asked Questions
What is patient confidentiality?
It is the legal and ethical duty to keep a patient’s health information private and share it only as the law or the patient allows.
Can a practice share records with another doctor without consent?
Yes, for treatment. HIPAA allows sharing between providers to treat the patient without written authorization.
Can we leave appointment reminders on voicemail?
Yes, with limited details such as the practice name and a callback number, unless the patient has asked for another method.
How fast must a practice give patients their records?
Generally within 30 days of the request, with one 30-day extension allowed if the patient is told in writing.
Does a billing company need a BAA?
Yes. Any vendor that handles protected health information on the practice’s behalf must sign a Business Associate Agreement.
How Pyramids Global Supports Practices
Since 2013, Pyramids Global has supported more than 500 practices across 20+ specialties. Our medical billing services and front desk support teams work inside your existing EHR under role-based access, patient data follows HIPAA standards, and a Business Associate Agreement is signed with every client. To review how your billing and front desk workflows handle patient information, book a free consultation with our team.
Sources: HHS HIPAA Privacy Rule, HHS Breach Notification Rule, and HHS 42 CFR Part 2 final rule fact sheet.