HIPAA Privacy Walk-Through

A workplace inspection template for checking HIPAA privacy safeguards, including visible PHI, workstation security, fax handling, shred bin use, and protection against overheard conversations.

Visible PHI and Public Exposure

• No visible PHI on desks, counters, or monitors in public view
  Check for charts, labels, schedules, screens, or documents containing PHI visible from hallways, waiting areas, or visitor paths.
• Patient names or identifiers are not displayed in unsecured locations
  Verify whiteboards, sign-in sheets, appointment lists, and call-out boards do not expose PHI beyond the minimum necessary.
• Computer screens are positioned to prevent shoulder surfing
  Confirm monitors are angled away from public traffic and privacy filters are used where needed.
• Paper records are stored face-down or otherwise shielded when unattended
  Check whether charts, requisitions, and printed reports are protected from casual viewing.

Workstation Security

• Workstations are locked or logged off when unattended
  Observe whether staff use screen locks, logoff procedures, or proximity controls when stepping away.
• Access to PHI is limited to authorized personnel only
  Verify shared work areas, terminals, and paper files are not accessible to visitors or unauthorized staff.
• Printed PHI is collected promptly from printers and copiers
  Check for abandoned printouts, misdirected documents, or stacked reports left in output trays.

Fax, Print, and Document Handling

• Incoming faxes are received in a secure location
  Confirm fax machines or electronic fax systems are placed so incoming PHI cannot be viewed by unauthorized persons.
• Fax cover sheets and recipient verification are used before transmission
  Verify staff confirm recipient number and use appropriate cover sheets or secure fax procedures for PHI.
• Misrouted or misprinted documents are handled as privacy incidents
  Check whether staff know how to escalate, document, and correct fax or print errors involving PHI.

Shred Bin and Disposal Controls

• Shred bins are labeled and placed in secure locations
  Confirm shredding containers are clearly identified and not accessible to the public or unauthorized staff.
• PHI is placed in shred bins rather than regular trash
  Observe whether staff dispose of paper records, labels, and notes containing PHI in approved destruction containers.

Conversation Privacy and Sound Control

• PHI conversations are not audible in waiting or public areas
  Listen for discussions at reception, in hallways, and near exam rooms that could disclose patient information.
• Staff use lowered voices or private spaces for sensitive discussions
  Verify staff move conversations containing PHI to enclosed rooms or otherwise reduce the risk of being overheard.