Yes, physician offices may use patient sign-in sheets or call out patient names in waiting rooms, so long as the information disclosed is appropriately limited to the minimum necessary. The Privacy Rule explicitly permits certain “incidental disclosures” that occur as a by-product of an otherwise permitted disclosure – for example, the disclosure to other patients in the waiting room of the identity of the person whose name is called. However, these “incidental” disclosures are permitted only to the extent that the covered entity has applied reasonable and appropriate safeguards, and implemented the minimum necessary standard, where appropriate. For example, the sign-in sheet may not display medical information that is not necessary for the purpose of signing in (e.g., medical problem) and staff calling patients from the waiting room should call the name only.
