Patient Records, Confidentiality, and Informed Consent
What this domain covers
This domain tests the content, retention, release, and protection of patient records, plus the informed consent discussion that must precede care. Connecticut law and federal HIPAA both apply; the stricter or more specific rule controls in practice.
Core rules
- Record content. The record should identify the patient, date, history, examination findings, diagnoses, treatment, prescriptions, referrals, informed consent, and the optometrist responsible. Entries must be timely, dated, and authenticated.
- Retention. Connecticut regulations set retention periods for health records. A practical compliance rule is to retain adult records for at least seven years after the last service and to retain records of minors longer, until the age required by regulation. Never destroy records that are subject to an open complaint, audit, or litigation hold.
- Access. A patient or authorized representative may request records. Release generally requires a valid written authorization that identifies the information, recipient, and expiration. Exceptions include treatment, payment, operations, public health reporting, and valid legal process.
- Fees. A copying fee may be charged only as permitted by Connecticut law; records cannot be withheld solely because a bill is unpaid.
- Confidentiality. Do not confirm care to a spouse, employer, or school without authorization unless a specific exception applies.
- Informed consent. Explain diagnosis, proposed test or treatment, material risks, alternatives, and the consequences of declining. Document the discussion, especially for contact lens wear, dilation, and pharmaceutical treatment.
Worked example
A patient's adult daughter calls and asks for the mother's records "to help with scheduling." The office should not release them on an informal call. Staff should verify the patient's identity, obtain a signed authorization from the patient or a legally authorized representative, confirm the scope of the request, and document the release. If the daughter has a health care power of attorney, the office should obtain and retain a copy.
Traps that cost marks
- Releasing records to a spouse by phone without authorization.
- Charging a fee that exceeds the statutory limit.
- Destroying records after a complaint is filed.
- Documenting "consent obtained" without recording what was discussed.
- Assuming HIPAA preempts stricter Connecticut confidentiality rules.