Did I violate HIPAA?

[IreneTouTheou]

Non-nurse hospital worker, member of the care team here. I was talking to a patient's family member in the course of my day when they said, about another patient, "Hey, so-and-so from our community is/was a patient in this unit, and I wonder what their outcome is. Do you know?" I knew, at least I was pretty sure, of which patient they were talking about. I responded, "Well, people who work in hospitals have confidentiality." The family member talked about the person a little more, and I said something like, "This person is from your community, you say? I'm sorry." (this wasn't verbatim, but was the gist of what I said). I worry now that by saying, "this person is from your community" (which they had told me) may have been an acknowledgement from me that the other patient was indeed a patient - or was it? 

[FullGlass, BSN, MSN, NP]

You are fine.  You did not confirm or deny the person was from their community; they told you the person was in their community and you just repeated that in a question.  The key for HIPAA is the information can't be used to identify a patient.  If the person lives in Brooklyn, for example, that alone is hardly enough to identify one person!  Even for a smaller area, say a few block radius, hundreds of people likely live there so I don't know how that information would identify a particular person.

In the future, just say, "due to HIPAA, I am not able to discuss this."  That's it.  

[IreneTouTheou]

Thank you, the family member actually gave a first name of the patient, and as I said, I was pretty sure (based on the community they stated and the other patient's situation) that I knew which patient they were referring to. I should add that when I wrote, "community" I meant "community organization" - a smaller group of people who know each other. Anyway, my saying, "People who work in hospitals are confidental (or have confidentiality), which was my attempt to soften the "sorry I can't tell you that because of HIPAA" line. My fear was about my asking that final question, "They're someone from your (Community organization)?..." I really was just trying to restate what they had already told me, and adding my concern for their concern ("I'm sorry"). I thought about this a lot and think that when someone asks another question like this, I may say,  "I can't help you there, I'm sorry", and that if they persist, I'll cite HIPAA. THANK YOU for your insight.