Documentation, Confidentiality & Record-Keeping Flashcards

An agency contracts with an outside IT company that will handle participant records. What agreement allows this under Part 2 without individual consent?

Answer: A qualified service organization agreement (QSOA)

A QSOA lets a Part 2 program share information with a contractor providing services, as long as the contractor agrees to follow Part 2 protections.

Which statement best describes a recovery coach's documentation scope?

Answer: Recording peer support activities, goals, and observable progress within the peer role

Coaches document within the non-clinical peer role and avoid diagnosing or clinical interpretation.

A coach accidentally emails a participant's progress summary to the wrong outside agency. What should the coach do?

Answer: Report it promptly to the supervisor or privacy officer per breach policy

Unauthorized disclosures must be reported internally so the agency can assess the breach and meet notification requirements.

Under HIPAA, when a breach of unsecured information affects an individual, notification must generally occur within how long after discovery?

Answer: No later than 60 days

HIPAA's Breach Notification Rule requires notifying affected individuals without unreasonable delay and no later than 60 calendar days after discovery.

A coach remembers an important detail from a session three days ago that was left out of the note. How should it be documented?

Answer: Add a clearly labeled late entry with the current date and a reference to the original session

Late entries should be clearly marked with the current date and reference the original session to keep the record honest.

How long must participant records be kept?

Answer: As long as state law, funder requirements, and agency policy require

Record retention periods vary by state law, funding sources, and agency policy, so coaches follow their organization's retention schedule.

When disposing of old paper participant records after the retention period, which method is appropriate?

Answer: Shredding or other secure destruction that makes them unreadable

Secure destruction such as cross-cut shredding prevents unauthorized access to confidential information.