CDS Documentation & Record Keeping 3 — Questions and Answers
Question 1: When a disability specialist receives a subpoena for client records, the first action should be to:
- Immediately mail the records to the requesting court
- Consult with agency legal counsel before releasing any records (Correct answer)
- Inform the client and shred the sensitive documents
- Deny the request based on HIPAA confidentiality
Correct answer: Consult with agency legal counsel before releasing any records
Legal counsel should be consulted first to determine whether the subpoena is legally sufficient and whether any protections apply before releasing records.
Question 2: In electronic case management systems, audit trails serve primarily to:
- Speed up data entry for busy specialists
- Track who accessed or modified records and when (Correct answer)
- Automatically purge outdated case files
- Generate billing invoices for third-party payers
Correct answer: Track who accessed or modified records and when
Audit trails create an immutable log of user access and edits, supporting accountability and detecting unauthorized record changes.
Question 3: Which statement about 'need-to-know' access to client records is correct?
- All agency staff may access any client file to improve service coordination
- Access should be limited to staff with a direct service or supervisory role for that client (Correct answer)
- Supervisors may share records agency-wide for training purposes without consent
- Administrative assistants automatically have full access to all records
Correct answer: Access should be limited to staff with a direct service or supervisory role for that client
The principle of minimum necessary access limits record access to those with a demonstrated need, protecting client confidentiality.
Question 4: A CDS specialist uses a personal smartphone to photograph a client's medical documents for remote review. This practice:
- Is acceptable if the photos are deleted within 24 hours
- Violates agency data security policies and HIPAA by storing PHI on an unsecured personal device (Correct answer)
- Is encouraged as it improves workflow efficiency
- Is permissible if the client verbally approves
Correct answer: Violates agency data security policies and HIPAA by storing PHI on an unsecured personal device
Storing PHI on personal devices without agency-approved encryption and mobile device management violates HIPAA and most agency security policies.
Question 5: What does the 'minimum necessary' standard under HIPAA require a disability specialist to do?
- Request only the minimum number of client documents per month
- Disclose only the PHI reasonably needed to accomplish the intended purpose (Correct answer)
- Maintain records for the minimum legally required retention period
- Conduct the minimum number of client contacts before case closure
Correct answer: Disclose only the PHI reasonably needed to accomplish the intended purpose
The minimum necessary standard requires limiting PHI disclosure to what is needed for the specific purpose of the request.
Question 6: A client's case file contains a record of a past substance use disorder. Under 42 CFR Part 2, this information:
- May be freely shared with any healthcare provider
- Requires a specific written consent separate from a general HIPAA authorization (Correct answer)
- Can be disclosed to law enforcement without consent
- Is subject only to standard HIPAA rules
Correct answer: Requires a specific written consent separate from a general HIPAA authorization
42 CFR Part 2 provides heightened confidentiality protections for substance use disorder records, requiring separate written consent for disclosure.
Question 7: When closing a case, the documentation package should include all of the following EXCEPT:
- A closure summary with rationale
- The client's employment or outcome status at closure
- Copies of documents shredded during the case (Correct answer)
- A record of services provided and their dates
Correct answer: Copies of documents shredded during the case
Shredded documents are destroyed and cannot be included; the closure file should contain active records, summaries, and outcome documentation.
CDS Documentation & Record Keeping 3
When a disability specialist receives a subpoena for client records, the first action should be to: