Question

A patient calls the insurance company’s call center to be directed to the on-call nurse. The patient provides his Social Security number, date of birth, and policy number to the call center employee so his call can be transferred appropriately. The employee makes sure not to say the patient’s Social Security number out loud.

Respect confidentiality of data.

Protect passwords and system access of users.

Be fair and honest with customers.

Answer 1

Short answer: Mostly compliant, but a couple of improvements are needed.

What was done well
- Respect confidentiality: The employee avoided saying the SSN aloud, which reduces the risk of exposing a highly sensitive identifier.
- Be fair and honest: Transferring the caller to the on‑call nurse as requested is consistent with being responsive and honest about next steps.

What’s missing / risks
- Collecting a full SSN and DOB on an unscreened call is risky — both are protected health information (PHI). Prefer the minimum necessary data for identification (e.g., last 4 digits of SSN plus DOB or policy number).
- The “Protect passwords and system access” rule still applies indirectly: employees must not ask callers for account passwords or share their own credentials, and must ensure any transfer uses secure systems so credentials/records aren’t exposed.
- Documentation and system handling: if the full SSN or other PHI were entered into logs or screen fields, ensure it’s masked in the record and handled per policy (retention, access controls, audit logging).

Practical guidance / best practices
- Verify identity using the minimum necessary info (last 4 of SSN, DOB, policy number or other agreed verification). Don’t ask for or record full SSN unless absolutely required and permitted.
- Mask sensitive fields in call systems and avoid reading them aloud.
- Never ask callers for system passwords or share your credentials. Use secure transfer/consultation features rather than conference bridges that expose PHI.
- Tell the caller what you will do and approximate wait/transfer expectations (be honest about time and next steps).
- If PHI must be entered into the system, follow retention, access-control, and audit requirements (HIPAA/your org policy).

If you want, I can draft a short caller verification script and a list of fields that should always be masked in call logs.