Privacy, Confidentiality, and Access to Health Information
What the candidate must know
Candidates must distinguish privacy (a person's right to control information), confidentiality (the duty to protect information entrusted to you), and security (the safeguards). Know the elements of valid consent and the exceptions to consent, such as emergencies, statutory reporting, and legal compulsion. Understand minimum necessary access, role-based access, the right of access and correction, and the process for handling requests from third parties, insurers, and law enforcement. Be able to explain breach notification concepts, privacy impact assessments, and the consequences of unauthorized access even when no harm is evident.
Traps in questions
A classic trap is confusing "need to know" with "nice to know"; curiosity-driven access by staff is a breach even if the patient is a colleague or celebrity. Another trap is assuming consent is always required, when law may permit or require disclosure without it. Questions may also blur the roles of the privacy officer and security officer, or imply that de-identification is risk-free; re-identification risk must be assessed. Watch for items that treat a subpoena as automatically sufficient without verification.
Worked rule of thumb
Apply the three-part access test: is there a legal authority or valid authorization, is the request verified, and is the disclosure limited to the minimum necessary? If any answer is no, stop and escalate to the privacy officer.
Example
A lawyer sends a subpoena for a patient's records. The correct response is not automatic release; the record custodian verifies the subpoena's validity and jurisdiction, confirms any required notice or patient authorization, and releases only the specified minimum data with documentation of the disclosure.