Confidential Minor Visit, Employer Call, and a Misdirected Subpoena
A 16-year-old patient, A.J., visits the clinic for a confidential sexual health visit. The state allows minors to consent to STI testing and contraception without parental consent, but the practice's general policy is to release records to a parent or guardian. A.J. pays in cash and asks that the visit not appear on the insurance claim or in the portal. Two days later, A.J.'s mother calls and says, 'I'm his mother; I have a right to know what's going on,' and asks for the test results. Later that morning, A.J.'s employer calls asking to confirm that A.J. was seen because he missed a shift. The front desk also receives a fax from a law firm with a subpoena for 'all records' for another patient, and the fax number matches the practice but the patient name does not. The office manager is out.
1. How should the assistant handle the mother's request for A.J.'s test results?
Read the worked answer
Do not confirm or deny that A.J. was seen or what services were provided. State law allows minors to consent to STI testing and contraception, and under HIPAA a parent is not automatically the minor's personal representative for services the minor can legally consent to. The assistant should verify the practice's minor-consent policy and consult the privacy officer or provider before releasing anything. The mother can be told that the practice needs to check its privacy rules before responding. If the mother has a legal right to other records, release only those records. Document the call, the request, and the decision.
2. What should the assistant tell A.J.'s employer, and why?
Read the worked answer
The assistant should give no information. Confirming that A.J. was seen, or even that he is a patient, can disclose protected health information. The assistant should say the practice cannot confirm or deny patient information and offer to take a message or direct the employer to the employee. FMLA certification must go through the provider and only with a valid authorization from the patient or the person legally authorized to sign for the minor. The employer cannot receive clinical details directly. Document the call and the response.
3. How should the assistant handle the subpoena and the fax mismatch?
Read the worked answer
Do not fax any records. The subpoena is for another patient and the patient name does not match, which creates a serious misdirection risk. Verify the subpoena with the privacy officer or legal counsel; a subpoena is not automatically sufficient without patient authorization or a court order, depending on state law. For the misdirected fax, send nothing back, notify the privacy officer, document the incident, and assess whether any protected health information was disclosed. If information was sent to the wrong number, follow the practice's breach-assessment process. Confirm recipient fax numbers and patient identity before every release.