Termination, a Board Letter, and a Public Reply

Treat it as a legal and clinical event, not a personal insult.

• Respond within the Board's stated deadline, in writing, and confirm receipt.
• Notify his malpractice carrier and consult an attorney experienced in licensing matters before sending a substantive response.
• Provide the complete record as requested, unaltered. Do not add, backdate, or "clarify" notes; if he recalls something not documented, he may explain it in a separate narrative, clearly labeled as later recollection.
• Explain the clinical reasoning: boundary discussions, the escalation pattern, the termination session, the three referrals, and the absence of abandonment because a workable path was provided.
• Address the HIPAA allegation factually by describing the practice's authorization and disclosure procedures.
• Do not contact Leah directly, and do not discuss the complaint with colleagues who are not involved, on social media, or in the community.
• Keep a copy of everything submitted.

Tone matters. A concise, factual, non-defensive response that acknowledges the difficulty of the termination is more persuasive than a lengthy attack on the complainant. Dr. Boone should also reflect honestly on whether his frustration affected the timing of termination and be prepared to discuss that if asked.

Leah's request. Under HIPAA she has a right of access to her record, subject to limited exceptions, and Kentucky law permits copying with a reasonable, cost-based fee. Psychotherapy notes are treated separately under HIPAA and are generally excluded from the patient-access right, though state law and Board requests may reach them. Dr. Boone should provide the chart, keep a copy, log the date and what was sent, and consult counsel before withholding anything.

Ms. Grant's request. A request from a new therapist is not self-authorizing. Dr. Boone needs a signed authorization from Leah that names the practice, identifies Ms. Grant and her practice, specifies the records and purpose, states an expiration date, and includes Leah's right to revoke. The phrase "all records, including psychotherapy notes" requires a specific, separate authorization for psychotherapy notes; a general release is not enough.

If the Board requests records, that is a separate legal basis and should be handled through counsel, with the Board's authority confirmed in writing.

Do not send records to Ms. Grant on the strength of her fax alone, and do not release anything to Leah's family or employer. Document each request and each response.

The employee's reply is the urgent problem. It confirmed that Leah is a patient and disclosed a diagnosis. That is an impermissible use or disclosure of protected health information and likely a reportable breach under HIPAA.

Steps:

• Have the reply removed immediately and preserve a screenshot.
• Conduct a breach risk assessment; a disclosure of diagnosis by the practice is hard to characterize as low probability of harm, so assume notification obligations apply and follow the practice's breach policy, including notice to Leah.
• Document the incident, the corrective action, and staff retraining on social media and patient privacy.
• Consider whether the incident must be reported to the Board or to the practice's malpractice carrier; obtain advice.
• Address the employee's conduct through normal personnel channels without retaliation against Leah.

The review itself. Dr. Boone should not respond with any detail about Leah's care, diagnosis, or even confirmation that she was a patient. A generic statement such as "we take privacy seriously and cannot discuss any individual's care" is the outer limit. He may ask the platform to remove content that discloses his own protected information under its policies, but he should not threaten Leah or imply consequences for the complaint.