Question

Difficulty: EasyConfidentiality and Privacy

A 19-year-old woman is evaluated in the university health clinic for dysuria and vaginal discharge. She is diagnosed with *Neisseria gonorrhoeae* cervicitis, treated appropriately, and discharged. The patient explicitly asks the physician not to tell her parents about the visit. Two days later, the patient's mother calls the clinic. She states that she is the primary policyholder for her daughter's health insurance and demands to know the results of the recent laboratory tests. Which of the following is the most appropriate response by the physician?

  1. State that no information can be shared, including whether the daughter is a patient at the clinic.Answer
  2. B
    Disclose the test results to the mother because she is the primary health insurance policyholder.
  3. C
    Confirm the clinic visit occurred but refuse to disclose the specific laboratory results.
  4. D
    Inform the mother of the diagnosis because the infection is a state-reportable disease.
  5. E
    Ask the mother to provide a written request in order to release the medical records.

Answer

State that no information can be shared, including whether the daughter is a patient at the clinic.
The patient is a competent adult (age ≥ 18), meaning her medical information is fully protected by confidentiality laws. A physician cannot disclose any protected health information to family members, even if they are the primary insurance policyholder, without the patient's explicit authorization. Furthermore, merely confirming that the patient was evaluated at the clinic is a breach of confidentiality because the very fact that a person sought medical care is protected. The only appropriate response is to politely state that no information can be discussed, including confirming or denying the individual's status as a patient.

Step-by-Step Solution

1
Determine the patient's legal status.
The patient is 19 years old, making her a legal adult with full decision-making capacity and privacy rights.
Age determines whether parental consent or notification is legally required or permitted.
2
Identify the core ethical and legal rule at play.
Under HIPAA and general medical ethics, protected health information (PHI) cannot be disclosed without the patient's explicit authorization.
This establishes the baseline appropriate action for the physician.
3
Evaluate the mother's justifications for requesting the information.
The mother's status as the insurance policyholder does not grant her legal access to an adult dependent's medical records.
Financial responsibility does not equate to a right to health information for adult patients.
4
Select the appropriate response that maintains strict confidentiality.
The physician must refuse to share any information, going so far as to not confirm or deny that the individual is even a patient at the clinic.
Merely acknowledging that a person was evaluated at a clinic is considered a breach of PHI.

Key Concept

Patient Confidentiality and Privacy for Adult Dependents
Estimated Time:45s
Rate this question