A nurse on a medical-surgical unit notices several situations involving protected health information (PHI). Which actions comply with HIPAA requirements? Select all that apply.

HIPAA requires appropriate access controls and reasonable safeguards. A treatment discussion with the assigned physician can occur at the bedside when safeguards such as a low voice and protected screen are used (Choice 1). Logging out, protecting credentials, and preventing unauthorized entry reduce unauthorized access (Choice 2). Staff should report a potential unintended disclosure through the facility's privacy-incident process so the privacy officer can assess whether an impermissible disclosure or reportable breach occurred (Choice 3). Before telephone disclosure, verify both identity and authority using facility-approved procedures; for an outside provider or facility, independently obtained contact information may be used rather than a caller-supplied number (Choice 6). Accessing a chart without a work-related need is unauthorized even when the person is another RN (Choice 4). An admission date and rare diagnosis can make a case identifiable and do not meet HIPAA de-identification requirements merely because the name is omitted (Choice 5).