HIPAA - Frequently Asked Questions (FAQs) - The University of Oklahoma Health Sciences Center

13. Can physician offices use patient sign-in sheets or call out the names of patients in their waiting rooms?

Yes, covered entities such as physician offices may use patient sign-in sheets or call out patient names in waiting rooms, so long as the information disclosed is appropriately limited. The Privacy Rule explicitly permits certain “incidental disclosures” that occur as a by-product of an otherwise permitted disclosure – for example, the disclosure to other patients in the waiting room of the identity of the person whose name is called. However, these “incidental” disclosures are permitted only to the extent that the covered entity has applied reasonable and appropriate safeguards, and implemented the minimum necessary standard, where appropriate. For example, the sign-in sheet may not display medical information that is not necessary for the purpose of signing in (e.g. medical problem).