Which of the following is NOT a core protection offered by the HIPAA Privacy Rule?

• A. It protects patient health information
• B. It requires patients to sign consent forms for every disclosure
• C. It sets consent/notice requirements and safeguards for PHI
• D. It requires minimum necessary disclosure

Answer: (B)

The main concept here is that HIPAA Privacy Rule protects PHI by giving patients privacy rights, requiring notices, and limiting disclosures to the minimum necessary. It does not require patients to sign consent forms for every disclosure. In practice, covered entities can use and disclose PHI for treatment, payment, and health care operations without a separate consent, as long as they follow the minimum necessary principle and provide a Notice of Privacy Practices. For disclosures outside those routine uses, an authorization is required, detailing who will receive the information and for what purpose. This distinction is why signing consent forms for every disclosure is not a core protection of the HIPAA Privacy Rule. The rule also emphasizes safeguarding PHI and applying the minimum necessary standard to disclosures, which align with the protections described in the other options.