Quote from lucy2811
It is my understanding the as long as the "story" doesn't include identifying information such as name, date of birth, SSN, hospital name, dates of stay, etc (anything that could link the story to that particular individual) then it would be considered de-identified and therefore not a HIPAA violation. Here's a link to the government page that describes it:
Summary of the HIPAA Privacy Rule
Hope that helps.
It's a little more complicated than that. Your own reference states that protected information is any information "that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.
" So, as azhiker noted, you could talk in public about a case without giving any name, dates, or numbers, but, because of a specific diagnosis/injury, sequence of events leading to the hospitalization/injury, color of the person's hair
, it could still be entirely possible that someone who knows the individual (but is not authorized to receive any information) could figure out who you are talking about. (Esp. in small towns ...
This is why it's much safer and better practice to just get in the habit of not talking about work (or school) outside of work (or school). Any time there are other people around, you just don't know
who may be listening and be able to identify who you're talking about.