Compliance, Confidentiality, and Release of Information
Compliance and confidentiality questions test whether you know which rule controls, what a valid authorization contains, and when disclosure is permitted without authorization. HIPAA's Privacy Rule governs uses and disclosures; the Security Rule governs electronic protected health information (ePHI). Treatment, payment, and health care operations (TPO) permit disclosure without authorization, but the minimum necessary standard applies to most non-treatment uses. Minimum necessary does not apply to treatment disclosures to providers or to disclosures to the individual.
A valid HIPAA authorization must include the patient's identification, the person or class receiving the information, a specific description of the information, purpose, expiration date or event, signature and date, and statements about the patient's right to revoke and the potential for redisclosure. Psychotherapy notes require a separate authorization. Substance use disorder records under 42 CFR Part 2 have stricter rules, and state laws on HIV, mental health, and minors may be more stringent. When laws conflict, follow the more stringent rule unless a specific federal exception applies.
Release of information requests may come from patients, legal representatives, attorneys, courts, insurers, or other providers. A subpoena alone generally is not enough under HIPAA; the provider needs a court order, a patient authorization, or satisfactory assurances that the requesting party notified the patient and allowed time to object. Verify identity and authority, log the disclosure, and provide only the minimum necessary. Patients have a right to access their records, request amendments, request restrictions, receive an accounting of disclosures, and receive a notice of privacy practices. Do not deny access solely because a bill is unpaid.
Worked example: An attorney sends a subpoena for records without a court order or patient authorization. The correct response is to not release yet; verify whether a qualified protective order or patient authorization exists.
Rule of thumb: When federal and state requirements differ, follow the more stringent one.