Client Confidentiality and HIPAA Flashcards

Which federal law specifically requires notification to affected individuals when unsecured PHI has been breached?

Answer: The HIPAA Breach Notification Rule

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, the HHS Secretary, and in some cases the media following a breach of unsecured PHI.

A BHT is asked by a researcher to identify clients who might qualify for a study. Without client authorization, the BHT may:

Answer: Assist in a limited way under an IRB-approved waiver of authorization that meets HIPAA requirements

HIPAA allows disclosure of PHI for research without authorization if an IRB or Privacy Board has approved a waiver that meets specific regulatory criteria.

A client using telehealth behavioral health services has the same HIPAA confidentiality rights as a client seen in person. This is because:

Answer: HIPAA protections apply to all forms of PHI regardless of the medium of service delivery

HIPAA protections extend to all forms and mediums in which PHI is created, stored, or transmitted, including telehealth platforms.

A client gives verbal consent for a BHT to speak with their spouse about treatment progress. According to HIPAA, this verbal permission:

Answer: May be sufficient for incidental disclosures but a written authorization is preferable for substantive disclosures

HIPAA allows providers to use professional judgment when a client verbally agrees to involve a family member, but written authorizations provide clearer documentation for substantive disclosures.

Which of the following is an example of a permissible incidental disclosure under HIPAA?

Answer: A client's name being called in a waiting room during normal check-in procedures

Incidental disclosures like calling a client's name in a waiting room are permitted if reasonable safeguards are in place and the disclosure results from an otherwise permitted communication.

A BHT learns that a client has been sharing their own treatment information on social media. The BHT's obligation to maintain confidentiality:

Answer: Remains unchanged; the client's own disclosure does not eliminate the BHT's duty to protect PHI

A client's voluntary self-disclosure of their own health information does not waive the provider's independent HIPAA obligations to protect PHI.

The HIPAA Notice of Privacy Practices (NPP) must be provided to clients:

Answer: At the first service delivery encounter and upon request thereafter

Covered entities must provide the NPP no later than the date of first service delivery and must make it available upon request at any time thereafter.