Medical Ethics, Legal and Regulatory Issues

At the assistant level, HIPAA is a short list of things you do not say out loud. At the technician level it is a working rule set with defined exceptions, defined clocks, and defined dollar limits, and the exam tests the exceptions.

The three permitted purposes. Protected health information may be used and disclosed without authorization for treatment, payment, and health care operations — the TPO triad. Nearly everything else needs a written authorization, and a handful of categories (public health reporting, mandated abuse reporting, court orders, workers' compensation as state law directs) are permitted or required by law. Marketing and the sale of PHI require authorization, subject to narrow carve-outs: a face-to-face communication with the patient and a promotional gift of nominal value are excepted, and treatment communications and refill reminders are not marketing in the first place. The sale of PHI has no such carve-out. That is why a clinical photograph used to teach inside the practice sits in a different category from the same photograph on the practice's website.

Minimum necessary and where it stops. The standard limits routine uses and disclosures to the information the task actually requires — the reason you do not read a neighbor's chart, and the reason a scheduler does not need imaging. But it does not apply to: disclosures to or requests by a health care provider for treatment; disclosures to the patient; disclosures made under the patient's own authorization; disclosures required by law; and disclosures to HHS for a compliance investigation. This matters practically. Assembling a referral packet for a consulting retina specialist, you send the clinically relevant record — prior fields, imaging, pressures, medication history — because the treatment exception applies and because a consultant needs the trend, not the latest snapshot.