Client Rights, Informed Consent, Confidentiality, and Records
This domain tests the client-facing duties: what the client must be told, what you must keep private, and what you must write down.
Informed consent
Obtain consent before the first session and renew it whenever the plan changes: techniques, areas to be worked and avoided, draping, expected sensations, risks, alternatives, and the right to refuse or stop at any time. Consent is a process, not a signature - a signed form does not authorize contact the client verbally refuses. Minors require parent or guardian consent. Sensitive areas such as the gluteal region, chest, and inner thigh need specific, unambiguous consent, and pressure to obtain it destroys the consent.
Confidentiality
Do not disclose who your clients are or what they say without written authorization, except where law requires or permits it: child abuse reporting (ORS 419B.010), elder and disabled adult abuse (ORS 124.050), mandatory reporting of practitioner misconduct (ORS 676.150), court order or subpoena after advice, and narrow imminent-risk situations. HIPAA applies when you transmit health information electronically for billing; the Board's confidentiality rules apply either way, including for cash-only practices.
Records
Document date, health history and updates, consent, areas worked, techniques, objective observations, client response, referrals, and your signature. Keep records secure and retain them per Board rule; because Oregon's personal injury limitation period is two years (ORS 12.110), keeping adult records at least seven years and minor records longer is prudent. Release copies on request.
Worked example
A client's spouse calls asking whether she kept her appointment. You confirm nothing and offer to pass along a message.
Traps
Charting opinions as findings; assuming a signed form waives the right to stop; assuming cash-only practice erases privacy duties.