A therapist's client requests an accounting of disclosures of their medical record. What should that therapist do?

Question

Options

• APull the file with the accounting of disclosures for the client
• BExplain that disclosures are allowed as long as the client's information is deidentified or the client
• CRefer the client to the agency's Privacy Officer
• DReview the client's releases of information with the client

• A
  4% (1)
• B
  15% (4)
• C
  73% (19)
• D
  8% (2)

Explanation

Under HIPAA, clients have a formal right to request an accounting of disclosures of their Protected Health Information (PHI), and this request must be handled through the agency's designated Privacy Officer - the person legally responsible for HIPAA compliance, maintaining disclosure logs, and responding to such requests within the required timeframe (60 days, extendable by 30).

Why the distractors are wrong:

• A is wrong because individual therapists don't maintain the accounting of disclosures log - that's an organizational-level record kept by the Privacy Officer, not in the client's clinical file.
• B is wrong because it conflates two separate concepts: de-identification rules govern whether data can be shared without authorization, which is unrelated to the client's right to know what disclosures have already occurred.
• D is wrong because client-signed releases of information (ROIs) are not the same as an accounting of disclosures - ROIs authorize future or past disclosures, but the accounting covers all disclosures made, including those that don't require client authorization (e.g., mandatory reports).

Memory tip: When in doubt, think: "Formal privacy rights = Privacy Officer." Any HIPAA-based client rights request - accounting of disclosures, amendment requests, restriction requests - routes through the Privacy Officer, not the treating clinician.

No community discussion yet for this question.