Tough Questions? Scripts Provide Easy Answers (HIPAA on the Job)

by Margret Amatayakul, RHIA, FHIMSS, CHPS

What do members of your work force say when:

  • a patient asks what the notice of privacy practices is
  • an individual states that her mother already signed the notice of privacy practices
  • a physician office claims that authorization from the patient isn’t needed for your hospital to send a copy of the discharge summary to the office
  • an individual asks for access to lab results that have just become available

These and many other questions may surprise members of your work force even if they have received training on HIPAA policies and procedures. To best prepare those staff members with direct patient contact, it is a good idea to anticipate the types of questions that will be asked and write a brief script that can be used in response.

What Is Scripting?

Scripting is anticipating patient questions and writing short responses, providing workers with key words to use or not use, and giving directions for when to refer questions to others. It’s common for public relations departments to use prewritten scripts to help them respond appropriately to questions from the press. In a healthcare organization, scripting responses for patient questions is an excellent way to prepare members of the work force.

When Are Scripts Needed?

Every member of the work force who has direct contact with patients may be in the position of responding to HIPAA questions, although those in patient access, HIM, patient financial services, and patient relations are likely to be asked the most questions. See “Who Needs Scripts?” below, for categories of workers and common questions.

Who Needs Scripts?
Worker Categories Potential Questions
Patient access: Including admission, registration, schedulers, call centers, and other staff members where patient access may occur without a registrar (for example, emergency department charge nurse, retail pharmacy)

  • Why do I have to sign the notice? I already signed the notice.I don’t want to sign the notice.
  • What does this notice mean?
  • I don’t want anyone to know I’m here. How do I keep [a person or class of persons] outside of the organization from knowing I’m here? I don’t want [a person] inside the organization knowing I’m here.

Switchboard operators

  • I’d like to speak to [patient name]. (Patient is on the do not publish list.)
  • Is [patient name] in the hospital?
  • Is [patient name] ready to go home from clinic?

Unit coordinators

  • How do I keep [a person or class of people] outside of the organization from knowing I’m here? I don’t want [a person] inside the organization knowing I’m here.
  • How do I get a copy of my records?
  • I want to know who has seen my record.
  • We [another provider] need information about [patient name].

HIM and patient financial services

  • I want to correct my record. I want my record changed.
  • I want to know who has seen my record.
  • I don’t want my records sent to my [provider or facility name].

Healthcare professionals

  • I don’t want anyone/[name] to know I am here.
  • Did you tell [person or class of persons] I was here/what was wrong with me?
  • That information is wrong.
  • I want to see everything written in my record.

Patient relations/information privacy officer

  • What does this [statement or phrase] mean in the notice of privacy practices?
  • Why was I sent [marketing material] when I had requested information be sent only to [alternative address for confidential communication].

Consistency and accuracy are the primary reasons for scripting. The questions at the beginning of this article are examples of the types of questions for which answers can be scripted.

While scripting can be extremely effective, be cautious about overscripting responses or using scripts when professional judgment should be applied. Further, staff members who must memorize or make reference to a scripting resource will only be able to effectively handle a relatively small number of scripts, with a minimum of verbiage. They may also spend too much time searching the script to find the question and deliver the answer. Remember that scripts are aids. They should instill confidence that the response is correct and complete—not give the impression that the staff member does not know the answer.

The number of scripted questions and answers for each type of staff member should be limited to three to six, with guidance that refers the individual asking the question to a limited number of resources. For example, complaints or detailed questions about the notice should be directed to the information privacy officer or patient relations while questions about the designated record set should go to HIM or patient financial services. All other questions should be referred to a thoroughly knowledgeable person, such as the information privacy officer.

Beyond staff members committing the responses to memory, scripting resources may include a quick reference guide that includes a set of questions and check boxes on the computer or a flip chart device placed on an easel or attached to the computer monitor. The resource should be easily accessible (see “Sample Quick Reference Guide,”below).

Sample Quick Reference Guide
HIPAA Privacy Standard Related Questions See Our Policy and Procedure on
Safeguard against incidental disclosures of protected health information (PHI) because disclosures can be perceived as lax privacy protection.
  • How do I discard labels?
  • Should I report a misdirected fax?
  • The patient sent me PHI via e-mail. How should I respond?
  • Confidentiality/security of PHI
  • Transmission via fax or e-mail
Give patients an opportunity to accept or reject disclosure of limited information to a family member or friend for their involvement in the patient’s care.
  • How do I know if I can disclose information to a person accompanying a patient?
  • Can I disclose information to the parent?
  • Opportunity to accept/reject uses and disclosures of PHI
  • Personal representatives
Other than for use in treatment, use or disclose only the minimum necessary information needed to perform the task.
  • What is a minimum necessary use?
  • How much is minimum necessary for a specific disclosure?
  • Minimum necessary uses, disclosures, and requests
Get an authorization from the patient or an institutional review board waiver for use of PHI in all research on human subjects. To use PHI preparatory to research, you must present a representation that you will not remove any PHI.     N/A
  • Uses and disclosures of PHI for research
Patients have new or enhanced rights in their information.
  • What restrictions requested by patients can we accept?
  • Where do we record a patient’s request for confidential communications to be sent to an alternative address?
  • Handling patient requests for
    restrictions/confidential communications

Generally, scripts are not appropriate for situations requiring professional judgment. HIPAA includes a number of references to the fact that a licensed healthcare professional should use judgment in making certain decisions. For example, HIPAA permits a covered entity to “reasonably infer from the circumstances, based on the exercise of professional judgment, that the individual does not object to a disclosure” relative to a person’s involvement in care. In these cases, the professional should be sufficiently knowledgeable about HIPAA requirements as well as professional protocols to make a case-by-case decision.

How Should Scripts Be Written?

Write scripts in a style that will most closely reflect the nature of the question and the manner in which the response should be given. HIPAA requires the notice of privacy practices to be written in plain language. Despite this, some of the required content results in use of phrases and terms that may not be commonly understood words. For example, many questions about the notice of privacy practices may simply be related to the meaning of words like disclosure, amendment, accounting, and restriction.

Scripts are often useful when there is a choice of actions. For example, if the patient refuses to sign the acknowledgment of receipt of the notice of privacy practices, there may be different ways to proceed based on date of service, or reason given by patient. See “Sample Scripts,” below, for some choices. You will need to customize the script for your facility to reflect its procedures.

Sample Scripts

Notice of Privacy Practices
Check YES on registration screen for “Acknowledgment Signed.” If NO:
This is our notice of privacy practices. It tells you about how we may use your information in caring for you, getting your bill paid, and ensuring quality services. It also describes your privacy rights for your information. Please sign this page so we know you have received this notice.
Patient Question Action/Script
Why do I need to sign this? It helps us keep track that we gave you the notice.
Does this mean you can give out my information? The notice describes when we may release your information and when we need to get your permission.
I already signed this.

Thank you for letting us know. Do you recall when you got it and who may have given it to you?

If within our organized healthcare arrangement (OHCA):
Thanks. You may keep that as an extra copy.
Record that patient claimed that notice was signed [approximate date/location in facility] and extra copy provided.

If not within our OHCA:
I do not seem to have a record that you signed it. If you wouldn’t mind signing it again I’d appreciate it.

If patient objects:
All right, please keep that copy anyway.

  • Patient claimed that notice was signed [approximate date/location in facility] andextra copy provided
  • Patient refused to sign and copy provided
  • Patient refused to sign and copy rejected

Will Scripts Work?

While writing the script, be sure to request input from those who will be required to use it. While those writing the policies and procedures will know what message needs to be conveyed, the staff members delivering the message must feel comfortable with it. The same staff members often can anticipate questions because they may have the same questions as they are being trained. It may also be useful to test the scripts using volunteers from other departments.

As staff members become more familiar with the questions and learn which responses work best, the scripts may not be needed. However, the questions and answers should still be monitored. With repeated use, the responses may be altered slightly for convenience, but result in a different message than intended. Furthermore, questions may change over time, especially as more patients will have read privacy notices.

Finally, workers need to have confidence that the message in the script is, in fact, the message the organization wants to convey and will stand behind. Some messages may relate to denial of patient rights, or directions to other providers that may not seem convenient. Well-written scripts are intended to minimize negative effects of potentially negative messages or messages where the organization must stand firm to afford proper privacy protection. Staff members who find that patients or others respond negatively should immediately report the issue to their supervisors. Then, the supervisors can review procedures and consider rewriting scripts. Like other HIPAA preparations, scripting may be an evolving process.

Margret Amatayakul ( is president of Margret\A Consulting, LLC, an independent consulting firm based in Schaumburg, IL.

Article citation:
Amatayakul, Margret. "Tough Questions? Scripts Provide Easy Answers (HIPAA on the Job series)." Journal of AHIMA 74, no.5 (May 2003): 16A-D.