Legal and Ethical Standards Flashcards

A telehealth psychologist practicing in a compact state wants to treat a patient who recently moved to another compact state. What does the Psychology Interjurisdictional Compact (PSYPACT) allow?

Answer: The psychologist may practice telehealth across PSYPACT member states with an Authority to Practice Interjurisdictional Telepsychology (APIT)

PSYPACT grants eligible psychologists an APIT credential allowing them to provide telepsychology services to patients in other member states without obtaining additional full licenses.

During a telehealth session, a provider suspects child abuse based on information shared by a minor patient. What is the provider's legal obligation in all US states?

Answer: Report the suspected abuse to the appropriate child protective services as a mandated reporter

Healthcare providers are mandated reporters in all US states and must report suspected child abuse to child protective services regardless of confidentiality considerations.

What is the purpose of obtaining 'informed consent' specifically for telehealth services, beyond standard medical consent?

Answer: To ensure patients understand the unique risks, limitations, and technology aspects of telehealth care

Telehealth-specific informed consent educates patients about technology risks, privacy limitations, what to do during technical failures, and differences from in-person care.

A telehealth provider learns that a former patient (now deceased) had HIV, and the patient's spouse contacts the provider asking for that information. Under HIPAA, the provider should:

Answer: Disclose only with the written authorization of the patient's estate representative

HIPAA protects deceased patients' PHI for 50 years after death; disclosure to family requires authorization from a personal representative of the estate.

Which ethical principle is MOST relevant when a telehealth provider recommends a treatment option that serves the patient's long-term wellbeing even if the patient initially resists?

Answer: Beneficence

Beneficence refers to the obligation to act in the patient's best interest and promote their wellbeing.

A telehealth company operating in multiple states is considered a 'covered entity' under HIPAA. Which action would constitute a HIPAA violation?

Answer: Using PHI for treatment, payment, or healthcare operations without patient authorization

While using PHI for treatment, payment, and operations is actually permitted, sharing PHI for purposes beyond these without explicit authorization is a HIPAA violation — however, option B as stated (using for TPO without authorization) is actually allowed; the violation occurs when PHI is used for non-TPO purposes without consent.

A telehealth provider discovers a data breach affecting 600 patients' PHI. Under HIPAA's Breach Notification Rule, the provider must notify affected individuals within how many days?

Answer: 60 days of discovery

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals no later than 60 days after discovering a breach.