What are we actually allowed to say about patients?

HIPAA is not a rule that says "never mention patients." It is a rule that says who can hear what, for which purpose, and with how much detail.

Treatment conversations are usually allowed

When two clinicians both care for the same patient, they generally can discuss the case to coordinate treatment. That is one of the core reasons HIPAA exists—to make care work—while still protecting the patient from unnecessary exposure.

Still use good judgment: private space, low voice, only the details needed.

The waiting room is not a private chart

Calling out full names, reasons for visit, or test results where others can hear is a common mistake. Use initials, desk slips, or private windows when you can.

If a patient asks you to speak louder about something sensitive, invite them to a side room instead.

Family and friends

Do not assume a spouse, parent, or adult child may hear results. Many families are close—but HIPAA defaults to the patient's choice. Look for documentation that says who may be looped in, or ask the patient when they are present.

When in doubt, say less and involve your privacy officer.

Social media: a hard no for patient stories

Even "no names" stories can be identifying in small towns or rare cases. Do not post about patients. If marketing wants a testimonial, use a formal authorization process.

What to say when someone fishes for information

If someone asks about another person and you have no authorization, a calm line is: "I can't discuss another person's health information. They can contact us directly." You usually do not have to confirm they are a patient.