Board Complaint After a Record Release to an Employer
A former client, Danielle, files a complaint with the Oregon Board of Licensed Professional Counselors and Therapists. She alleges that her LPC, Robert, sent her entire psychotherapy record to her employer's HR department and then called HR to discuss her diagnosis. HR had emailed Robert asking for 'all records regarding Danielle's fitness for duty.' Danielle's intake form authorized release of information to 'insurance, employer, and other necessary parties.' Robert sent 42 pages, including session notes about her divorce and a prior suicide attempt. Danielle had not signed a separate authorization, and Robert did not review the file for minimum-necessary content. Robert now receives a letter from the board investigator requesting a written response and copies of the records. He asks whether he should send the records and whether he can call Danielle to explain.
1. Evaluate whether Robert's disclosures were permitted. Address the validity of the intake authorization and any Oregon or federal requirements.
Read the worked answer
Issue. Whether the intake release and HR's request authorized Robert to send the full record and discuss Danielle's diagnosis.
Rule. Oregon ethics rules require informed consent for disclosure, limit disclosure to what is necessary for the stated purpose, and protect confidentiality. If HIPAA applies, psychotherapy notes require a separate authorization, and a valid authorization must be specific, plain-language, signed, dated, identify the recipient and purpose, state an expiration, and advise the client of the right to revoke. A general intake release to 'insurance, employer, and other necessary parties' is not a specific authorization for an employment fitness-for-duty request.
Analysis. HR's request is not treatment, payment, or health care operations. Robert disclosed 42 pages, including sensitive psychotherapy notes about divorce and a suicide attempt, and then called HR to discuss the diagnosis. The intake form is too broad to cover this disclosure, and there is no separate authorization. Robert also failed to perform a minimum-necessary review. The disclosures were likely impermissible under both Oregon ethics rules and HIPAA, if HIPAA applies to his practice.
Conclusion. Robert should treat the disclosure as a serious error. The board will focus on the lack of a valid authorization, the breadth of the disclosure, and the follow-up phone call.
2. How should Robert respond to the board's investigation letter? What must he do and what must he not do?
Read the worked answer
Issue. The obligations of a licensee during a board investigation.
Rule. Licensees are expected to cooperate with board investigations, provide requested records, and respond truthfully. They must not alter, destroy, or conceal records, retaliate against the complainant, or mislead the investigator. The board's process may include an investigation, an offer of settlement, or a contested case hearing under the Administrative Procedures Act.
Analysis. Robert should send the requested records, but he should first consult an attorney and his malpractice insurer because the matter may involve both licensing and civil exposure. He should preserve the original records and the intake form, write a factual chronology, and acknowledge the authorization problem rather than argue that the form covers everything. He should not call Danielle to pressure her to withdraw the complaint; that would look like retaliation and could create a new violation. He may respond to the board through counsel and provide a corrective plan.
Conclusion. Cooperation, candor, and preservation of evidence are mandatory. Defensiveness or contact with the complainant is likely to worsen the outcome.
3. What corrective actions and potential disciplinary outcomes should Robert anticipate, and what should he have done when HR made the request?
Read the worked answer
Issue. Remediation and likely board action after an improper record release.
Rule. The board may impose a range of actions, from a letter of reprimand to probation, suspension, or revocation, and may require continuing education, supervision, or a corrective plan. HIPAA may also require breach notification and mitigation.
Analysis. Robert should audit his release forms, revise them to require specific authorizations, train staff on minimum necessary, document the breach analysis, and notify Danielle as required. At the time of the request, he should have verified the authorization, limited the response to the minimum necessary, excluded psychotherapy notes, and declined to provide a fitness-for-duty opinion without a proper release or court order. He could have asked HR for a specific authorization signed by Danielle or sought legal advice.
Conclusion. The board is likely to focus on whether Robert understands the error and has corrected his forms and practices. A written corrective plan, evidence of training, and a candid response are more persuasive than a claim that the intake form was sufficient.