Patient Privacy, Confidentiality, and Health Information Law
What this domain tests
This domain tests the HIPAA Privacy Rule, Mississippi confidentiality law, authorization requirements, permitted disclosures, and breach response in an optometric practice.
Core rules
- Protected health information may be used or disclosed for treatment, payment, and health care operations without authorization. Other uses require a valid written authorization.
- The authorization must identify the information, the recipient, the purpose, an expiration, and the patient's right to revoke. A verbal "OK" is not a valid authorization for non-routine disclosures.
- Disclosures required by law, court orders, public health reporting, and abuse reporting are permitted or mandated under specific conditions. The minimum-necessary standard applies to many disclosures.
- Mississippi confidentiality law can be stricter than HIPAA; follow the stricter rule. HIPAA does not preempt more protective state law.
- Breach notification is required when unsecured PHI is impermissibly accessed. Business associates must have written assurances.
- Minors: a parent or guardian generally acts as personal representative, subject to exceptions.
Worked example
A patient's spouse calls asking for the eyeglass prescription and diagnosis. Reasoning: the spouse is not automatically a personal representative. The practice may disclose only if the patient has authorized it or the patient is present and does not object. The staff should verify authorization, offer to contact the patient, and document the request and response.
Traps
Assuming a spouse or adult child can always obtain records; leaving detailed messages on voicemail; faxing to the wrong number without verification; treating HIPAA as preempting stricter Mississippi law.
Key points
- Treatment, payment, and operations permit use without authorization.
- Non-routine disclosures require a valid written authorization.
- Follow the stricter of HIPAA or Mississippi law.
- Minimum necessary applies to many disclosures.
- Breach notification is required for unsecured PHI.