Confidentiality, Record Retention, and HIPAA Considerations
Domain 7: Confidentiality, record retention, and HIPAA
This domain tests how client information moves and how long it is kept. Expect questions on authorization, minimum necessary, breaches, and records requests.
Core rules
- Disclose protected health information only with a valid authorization or as required or permitted by law. Use the minimum necessary information.
- HIPAA applies to covered entities and their business associates; an OT in a non-covered private practice may still be bound by state confidentiality law and professional ethics.
- Do not discuss clients in public areas or on social media. Secure paper and electronic records; use encryption and access controls.
- Retain clinical records for the period required by Board rule and payer contracts. For minors, retain until the age of majority plus the applicable retention period. Do not destroy records under investigation or litigation hold.
- HIPAA's six-year retention applies to HIPAA documentation, not automatically to the clinical record.
Worked example
A client's adult child calls and asks for the OT's progress notes. Without a signed authorization or evidence of legal representative status, the OT declines to disclose. The OT documents the request and the reason for denial. If the client is incapacitated and the caller is the court-appointed guardian, verify the appointment before releasing.
Traps
Do not assume HIPAA permits any family disclosure. Do not send unencrypted email or text with PHI unless policy and law allow it. Do not destroy records while a Board complaint or lawsuit is pending.