"First, I would make sure I saw or heard correctly, which is easily verified by the commonly used sign-ins and sign-offs on the electronic health records. But some results are accessible to anyone on the pathology team contributing to the medical information related to the patient--to benefit both that patient and the physician. My approach would be to ask my resident colleague the purpose of the suspicious inquiry; it may be innocent. However, if it were inappropriate, I would report it up the chain of command according to the protocol for reporting HIPAA violations here at your institution."

Answer along the lines of following the law and the institution's protocol for handling such problems. Stress that you are familiar with the HIPAA laws and would always act on any violations you witness.