Patient rights, confidentiality, and HIPAA interactions
What the domain tests
This domain tests patient rights, confidentiality, and the interaction between Montana law and HIPAA. Patients have rights to privacy, access, informed consent, and nondiscriminatory care. HIPAA sets a federal floor; Montana law or board rules may be stricter, and the stricter rule controls.
Core rules
- Use and disclose protected health information only for treatment, payment, operations, or with valid authorization, unless a legal exception applies.
- Give patients notice of privacy practices and honor access and amendment requests within applicable deadlines.
- Apply the minimum-necessary principle; do not confirm whether someone is a patient without authorization.
- A subpoena is not automatically an authorization; verify legal validity and follow the practice’s process.
- Minors’ confidentiality is limited by parental rights and state law; know who may consent.
- Secure records and devices; report breaches as required.
Worked example
An attorney calls asking whether a named person is a patient and what was treated. The receptionist should not confirm or deny. The request goes to the privacy officer, who checks for a valid authorization or legal process and releases only the permitted minimum.
Traps
Treating HIPAA as the only rule; assuming a police badge or subpoena removes all limits; texting clinical details on personal phones; discussing cases in elevators.