CBHT Client Confidentiality and HIPAA 2 — Questions and Answers
Question 1: A BHT overhears a coworker discussing a client's diagnosis loudly in the break room with another staff member who is not involved in that client's care. What is the most appropriate action?
- Interrupt and remind the coworker that this conversation should occur in a private area (Correct answer)
- Report the coworker to law enforcement immediately
- Join the conversation since all staff are bound by confidentiality anyway
- Do nothing because staff members are covered by HIPAA
Correct answer: Interrupt and remind the coworker that this conversation should occur in a private area
HIPAA's minimum necessary standard requires that PHI be discussed only in appropriate settings with those who have a need to know, so the BHT should redirect the conversation.
Question 2: Under HIPAA, which of the following best describes 'protected health information' (PHI)?
- Any individually identifiable health information held or transmitted by a covered entity (Correct answer)
- Only written medical records stored in a hospital
- Diagnostic codes that do not include a client's name
- General wellness information published on a public health website
Correct answer: Any individually identifiable health information held or transmitted by a covered entity
PHI is any individually identifiable health information created, received, maintained, or transmitted by a covered entity in any form or medium.
Question 3: A client's employer calls the facility asking whether the client is currently receiving treatment there. How should the BHT respond?
- Neither confirm nor deny the client's presence without a signed authorization from the client (Correct answer)
- Confirm the client is a patient but share no further details
- Ask the employer to call back during business hours when a supervisor is available
- Transfer the call to the client's treating clinician for approval
Correct answer: Neither confirm nor deny the client's presence without a signed authorization from the client
Even confirming or denying enrollment constitutes a disclosure of PHI, which requires client authorization unless an exception applies.
Question 4: Which of the following is a permissible disclosure of PHI without client authorization under HIPAA?
- Reporting a gunshot wound to law enforcement as required by state law (Correct answer)
- Sharing a client's treatment records with their neighbor who expressed concern
- Sending a client's full psychiatric history to a prospective employer
- Posting a client's progress notes in an anonymous online support group
Correct answer: Reporting a gunshot wound to law enforcement as required by state law
HIPAA permits disclosure without authorization for certain public health and law enforcement activities, including mandatory reporting required by state law.
Question 5: A BHT accidentally sends an email containing a client's treatment summary to the wrong address. What is the FIRST step the BHT should take?
- Immediately report the incident to a supervisor or the privacy officer (Correct answer)
- Send a follow-up email to the wrong recipient asking them to delete it
- Wait to see if any harm results before reporting
- Document the error only in the client's chart and take no further action
Correct answer: Immediately report the incident to a supervisor or the privacy officer
A misdirected email containing PHI is a potential breach that must be reported to the privacy officer promptly so a breach assessment can occur.
Question 6: Which individual right is guaranteed to clients under the HIPAA Privacy Rule?
- The right to request an amendment to their health records if they believe information is incorrect (Correct answer)
- The right to prevent all staff from accessing their chart under any circumstances
- The right to receive a copy of all staff training materials related to their case
- The right to choose which specific staff members may provide their care
Correct answer: The right to request an amendment to their health records if they believe information is incorrect
The HIPAA Privacy Rule grants clients the right to request amendments to inaccurate or incomplete PHI in their records.
Question 7: A minor client's parent demands to see the child's full behavioral health treatment records. Under HIPAA, when may access be restricted?
- When the minor consented to treatment without parental consent as allowed by state law (Correct answer)
- Whenever the minor requests that the parent be excluded
- Only if the minor is over 15 years old
- Access may never be restricted for a parent regarding a minor's records
Correct answer: When the minor consented to treatment without parental consent as allowed by state law
When a minor has legally consented to treatment on their own under applicable state law, HIPAA may permit restrictions on parental access to protect the minor's privacy.
CBHT Client Confidentiality and HIPAA 2
A BHT overhears a coworker discussing a client's diagnosis loudly in the break room with another staff member who is not involved in that client's care.
What is the most appropriate action?