Which statement best describes when disclosure of confidential information is permissible?

• A. You may disclose PHI freely to anyone who asks.
• B. You may disclose PHI whenever you want to help the clinician.
• C. You may disclose PHI if the patient authorizes it in general terms.
• D. You may disclose only when required by law or policy or to protect patient safety, otherwise maintain confidentiality.

Answer: (D)

Confidentiality of PHI means it should only be shared under limited, legitimate circumstances. The statement that best fits this principle says you may disclose PHI only when required by law or policy or to protect patient safety, otherwise you keep it confidential. This captures the essential boundaries: disclosures must have a clear basis in law, policy, or a real safety concern, and anything beyond that undermines privacy.

Think about why this is the correct standard. Laws and organizational policies define when sharing information is allowed without patient authorization (for example, mandatory reporting requirements or public health obligations). Safety concerns—assessing or preventing harm to the patient or others—also justify disclosure. Outside of these specific purposes, the default is to maintain confidentiality and protect the patient’s privacy.

The other statements imply broader or vague permission to disclose. Freely sharing PHI with anyone who asks ignores privacy protections. Disclosing whenever you want to help the clinician ignores patient rights and the need for justification. A general authorization is not sufficient because permissions must be specific about who may receive information, what can be disclosed, and for what purpose.