Question

Difficulty: MediumConfidentiality and Privacy

A 29-year-old man is evaluated in the clinic for a 4-week history of chronic cough, night sweats, and weight loss. Sputum acid-fast bacilli smear and culture confirm a diagnosis of active pulmonary tuberculosis. The patient is employed as a public transit bus driver. He has not signed any documents authorizing the release of his protected health information. Based on medical ethics and federal privacy regulations, which of the following disclosures regarding this patient's medical information are permissible WITHOUT his explicit consent? (Select all that apply)

  1. Notifying the local department of public health about the patient's confirmed tuberculosis diagnosisAnswer
  2. Sharing the patient's laboratory results with a consulting infectious disease specialist to optimize the pharmacological regimenAnswer
  3. C
    Informing the management of the public transit authority about the patient's diagnosis to prevent potential transmission to passengers
  4. D
    Discussing the details of the patient's treatment plan with his sister, who contacts the clinic expressing concern about his health
  5. E
    Releasing the patient's identifiable clinical records to a university research team conducting an observational study, without an institutional review board waiver

Answer

The legally permissible disclosures without explicit consent are notifying the local public health department regarding the tuberculosis diagnosis, and sharing clinical information with a consulting infectious disease specialist for treatment optimization.
The preservation of patient confidentiality is a fundamental ethical and legal obligation. However, there are established exceptions where explicit authorization is not required. First, the HIPAA Privacy Rule permits covered entities to use and disclose protected health information (PHI) for Treatment, Payment, and Healthcare Operations (TPO). Sharing laboratory results with a consulting physician falls directly under 'treatment'. Second, all states mandate the reporting of certain communicable diseases (including active pulmonary tuberculosis, HIV, syphilis, and measles) to the local or state department of public health. This mandatory reporting exception is designed to protect public safety and facilitates official contact tracing and outbreak management.

Step-by-Step Solution

1
Analyze the clinical scenario and the specific requests for protected health information (PHI).
The patient has active tuberculosis and works in a public setting. He has not provided consent for the release of his medical records.
Establishing the baseline consent status and the nature of the disease is necessary to apply confidentiality rules and their exceptions.
2
Evaluate the public health reporting exception.
Active tuberculosis is a universally reportable communicable disease. Disclosure to public health authorities is mandatory.
State laws require the reporting of certain infectious diseases to monitor and control outbreaks, overriding standard HIPAA consent requirements.
3
Evaluate the treatment exception under HIPAA.
Sharing information with an infectious disease consultant is permissible.
The HIPAA Privacy Rule explicitly allows the sharing of PHI among healthcare providers for the purpose of treatment and care coordination without needing individual patient authorization.
4
Evaluate the remaining requested disclosures against legal and ethical boundaries.
Disclosures to the employer, family members, and researchers without a waiver all fall outside permissible exceptions.
Direct employer notification, unauthorized family discussions, and non-waived research data sharing constitute breaches of confidentiality.

Key Concept

Under federal privacy regulations, explicit patient authorization is not required for disclosures related to Treatment, Payment, and Healthcare Operations (TPO), or for legally mandated public health reporting of specific communicable diseases.
Rate this question