HIPAA for Phlebotomy: PHI Rules and Deadlines
A labeled tube or requisition is PHI; use and share only what the task needs, keep it out of sight, and remember the fixed deadlines for patient rights and breaches.
Everyday rules
- PHI is individually identifiable health information in any form: spoken, paper or electronic. A labeled tube, a requisition and an LIS screen all count.
- Students, volunteers and trainees under the facility's direct control are 'workforce' and must follow HIPAA (160.103).
- Treatment, payment and health care operations need no patient authorization (164.506).
- Minimum necessary: use, share or request only the PHI the task needs. It does not apply to disclosures to a provider for treatment, to the patient, under an authorization, to HHS, or when required by law (164.502(b)).
- Incidental disclosures (for example, a name overheard in a waiting room) are allowed only if reasonable safeguards and minimum necessary were applied (164.502(a)(1)(iii)).
- A patient may ask to be contacted by another means or at another place; a provider must accommodate reasonable requests (164.522(b)).
- Each LIS user has a unique login so activity can be traced; never share one (164.312(a)(2)(i)).
- Most uses of psychotherapy notes, marketing and the sale of PHI need written authorization (164.508).
Preview only. 1 more items in this section. The full sheet also covers: Disclosures allowed without authorization (45 CFR 164.512); Patient rights: deadlines; Breaches, retention and penalties.
Sources
- 45 CFR 160.103 Definitions (protected health information, individually identifiable health information, workforce) · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.502 Uses and disclosures of PHI: general rules (minimum necessary) · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.506 Uses and disclosures to carry out treatment, payment, or health care operations · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.508 Uses and disclosures for which an authorization is required (revocation) · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required (law enforcement) · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.522 Rights to request privacy protection (restrictions, confidential communications) · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.524 Access of individuals to protected health information · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.526 Amendment of protected health information · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.528 Accounting of disclosures of protected health information · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.530 Administrative requirements (privacy official, training, safeguards, complaints, sanctions, mitigation, retaliation, documentation) · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.312 Technical safeguards (unique user identification, automatic logoff) · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.404 Notification to individuals · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.406 Notification to the media · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 45 CFR 164.408 Notification to the Secretary · U.S. Government Publishing Office (govinfo), Code of Federal Regulations
- 42 U.S.C. 1320d-6 Wrongful disclosure of individually identifiable health information · U.S. Government Publishing Office (govinfo), United States Code
- Purl v. U.S. Department of Health and Human Services, No. 2:24-cv-228-Z (N.D. Tex. June 18, 2025), Memorandum Opinion and Order, ECF No. 110 (status re-checked 2026-10-26: no HHS appeal; intervenor appeal dismissed Sept. 10, 2025) · U.S. District Court, N.D. Texas, via GovInfo
Free Safety and Compliance practice questions
- Question 1A coworker tells a phlebotomist that adding a splash of ammonia-based glass cleaner to diluted bleach makes a stronger wipe for the draw chairs. How…
- Question 2Which abbreviations may a phlebotomist use when documenting in the patient record?
- Question 3A phlebotomist printing labels on a computer-on-wheels in a patient's room is paged to the emergency department. The patient's electronic record is…