Unauthorized Disclosure

Q. A patient who carries his or her own state-issued identification card or work-issued identification card loses the card. Is this considered an unauthorized disclosure? Must we notify all parties specified by the relevant regulations?

Does the answer depend on whether the patient has a legal guardian? Also, does the answer differ depending on whether the lost card is a state-issued identification card or a work-issued identification card that includes the patient's full name, photograph, work address, and telephone number?

A. If a patient loses an identification card issued for legitimate business reasons, you are not responsible for any disclosures resulting from the patient's loss of the card. Similarly, if you gave a patient a copy of his or her medical records at his or her request, and the patient loses or discards the records where others could access the information, you would not be liable for the patient's actions.