Recordkeeping, reporting, and confidentiality requirements
Records, reporting, and confidentiality
This domain tests the lifecycle of the optometric record: what must be created, how long it is kept, when it may be released, and what must be reported.
Core rules
- The record must be accurate, legible, contemporaneous, and sufficient for another optometrist to continue care. Include history, findings, diagnosis, treatment, referrals, informed consent, and patient instructions.
- Release patient information only with a valid authorization or as required by law. Kansas law and HIPAA both apply; a stricter state requirement is not erased by HIPAA.
- Minors and patients without capacity require applicable consent rules; do not release to a parent or spouse automatically without authority.
- Respond to subpoenas through the proper legal process; do not release the entire chart because a lawyer asks.
- Mandatory reporting includes suspected child abuse or neglect and other reports specified by Kansas law. Board complaints and impaired-provider reporting follow separate rules.
- Retain and destroy records under the Board's retention rule and a documented destruction policy.
Worked example
An attorney sends a letter asking for a patient's complete file in a personal-injury case. The optometrist should not release records on the letter alone. Verify a signed HIPAA-compliant authorization or a valid subpoena with the required notice, release only the authorized scope, and document the disclosure. If the request is for a minor, confirm the parent or guardian's authority.
Traps
Releasing records to a spouse; assuming a subpoena is automatically valid; destroying records during a complaint; failing to document a verbal release; missing child-abuse reporting.