Phase 7: Deliverables
Applies to: All staff who compile, review, approve, or distribute patient engagement deliverables
Sequence note: Phases 0-4 sequential; phase 10 anytime; not all phases apply
What you'll learn
- Compile engagement deliverables in accordance with the content authorization, applying de-identification and raw footage handling controls before any content leaves the team
- Execute the required internal review checklist - confirming no PHI, scope alignment, accuracy, and verified consent for every identifiable individual - before seeking client approval or distributing content
- Distribute content only through approved channels, within the bounds of patient consent and contract, with all file transfers logged through DLP monitoring
Lesson
Step 1 - Compile Engagement Deliverables
After an engagement session, compile the deliverables defined in the content authorization. Deliverable types include recaps, executive summaries, survey results, compiled insights, and media assets. All content activities must be defined and approved before execution.
Source: slide 23 - Patient Content Creation and Media Handling_Final_8-2026
Step 2 - De-identify Content Before Sharing
Before sharing any content with a client, review it for PHI and remove or redact any information not authorized for disclosure. Only the minimum necessary information should be included in deliverables. If you are unsure whether something needs to be de-identified, de-identify it.
Source: slide 23 - PHI Handling and HIPAA Safeguards_Final_8-2026
Step 3 - Handle Raw Footage and Recordings on Secure Workstations
Raw footage and recordings may only be handled on secure, organization-managed workstations with restricted access. Raw footage and recordings must never be stored on personal devices or unapproved platforms. If a third-party editor is involved, they must use approved secure methods and be subject to a confidentiality agreement.
Source: slide 23 - PHI Handling and HIPAA Safeguards_Final_8-2026
Step 4 - Verify Content Authorization Before Distribution
Before any content is distributed, verify that a signed media release or content authorization is on file and that the intended use aligns with the patient's consent and contract terms. Any identifiable third party appearing in the content - including family members or others visible in photos, videos, or background materials - must have their own verified consent on file before the content can be used.
Source: slide 23 - Patient Content Creation and Media Handling_Final_8-2026
Step 5 - Complete Internal Review Before Distribution
Before any deliverable is shared outside A*I, an internal review must confirm all four of the following: (1) no PHI has been inadvertently included; (2) the content falls within the scope of what the patient authorized; (3) the content is accurate and does not misrepresent the patient; and (4) every identifiable individual appearing in the content - including family members or others in photos or videos - has verified consent on file.
Source: slide 24 - Patient Content Creation and Media Handling_Final_8-2026
Step 6 - Obtain Client Approval Where Required
Client approval must be obtained where required prior to external use of the deliverable.
Source: slide 24 - Patient Content Creation and Media Handling_Final_8-2026
Distribute Only Through Approved Channels - Never Exceed Consent Scope
Content may only be distributed through approved channels and for purposes that fall within the scope of the patient's consent and contract. Distribution must not exceed what the patient agreed to. All file downloads and transfers must be logged through DLP (Data Loss Prevention) monitoring.
Source: slide 24 - Patient Content Creation and Media Handling_Final_8-2026
Scenario
You are preparing to distribute a patient video recap to a client. The patient's signed media release is on file. During your internal review you notice two things: (1) the patient's adult sibling appears prominently in two frames of the video and no consent documentation exists for the sibling; (2) the video accurately reflects what the patient said and no PHI is visible. The client is waiting for the asset and has asked you to send it as soon as possible.
The patient's sibling appears in the video without verified consent on file. What is the correct action?
Incorrect. The patient's media release covers the patient only. Any identifiable third party - including a family member - must have their own verified consent on file before the content can be used.
Correct. Any identifiable individual in the content requires their own verified consent. You must either redact the sibling from the footage or obtain and file their consent before the video is distributed.
Incorrect. Distribution may not proceed while consent is pending. Sending the content with a note does not satisfy the requirement that consent be verified and on file before use.
Incorrect. The consent requirement applies regardless of whether distribution is internal or external. Third-party consent must be verified before the content is used in any way.
Once the sibling's consent issue is resolved, where may the video be sent, and what transfer controls apply?
Incorrect. Client preference does not determine the distribution channel. Content must go through approved channels regardless of client instruction.
Correct. Distribution is limited to approved channels, must not exceed the scope of the patient's consent and contract, and all file downloads and transfers must be logged through DLP monitoring.
Incorrect. The absence of PHI does not remove the channel and consent-scope restrictions. Approved channels and DLP logging are required for all deliverable transfers.
Incorrect. DLP monitoring applies to all file downloads and transfers, not only certain file types. Email is not the only permitted channel, and DLP logging is required regardless of channel.
Knowledge Check
Select an answer to see feedback. This is practice - it does not affect your score.
Before sharing any content with a client, what must you do if you are unsure whether a piece of information needs to be de-identified?
Incorrect. Waiting for approval does not satisfy the requirement. The SOP states: if you are unsure, de-identify it.
Incorrect. Flagging uncertain content and including it is not permitted. The default action when uncertain is to de-identify.
Correct. The PHI Handling SOP is explicit: if you are unsure whether something needs to be de-identified, de-identify it.
Incorrect. A signed media release does not resolve uncertainty about whether specific information is authorized. When uncertain, de-identify.
Which of the following must be confirmed during the internal review before a deliverable is shared outside A*I? Select all that apply.
Correct. Confirming no inadvertent PHI is a required internal review checklist item.
Correct. Scope alignment with the patient's authorization is a required internal review checklist item.
Correct. Accuracy and fair representation of the patient is a required internal review checklist item.
Correct. Verified consent for every identifiable individual - including family members in photos or videos - is a required internal review checklist item.
Incorrect. Client pre-review of a draft is not listed as a required internal review checklist item. Client approval is a subsequent step after internal review is complete.
Raw footage and recordings may be handled on which of the following?
Incorrect. Not all company devices qualify. The requirement is specifically secure, organization-managed workstations with restricted access.
Incorrect. Personal devices are explicitly prohibited for raw footage and recordings, regardless of password protection.
Correct. Raw footage and recordings may only be handled on secure, organization-managed workstations with restricted access.
Incorrect. Unapproved platforms are prohibited. Third-party editors must use approved secure methods, and a confidentiality agreement - not just an NDA - is required.
Key Controls Recap
- [RULE] Step 2 - De-identify Content Before Sharing
- [WATCH OUT] Step 3 - Handle Raw Footage and Recordings on Secure Workstations
- [RULE] Step 4 - Verify Content Authorization Before Distribution
- [RULE] Step 5 - Complete Internal Review Before Distribution
- [WATCH OUT] Distribute Only Through Approved Channels - Never Exceed Consent Scope
You've completed the Phase 7 learning module.
Return to Dayforce and take the Phase 7 quiz.