Confidentiality & Privacy
This federal law protects client health information.
What is HIPAA?
Posting identifiable information about a client (or student) online is generally prohibited.
What is true?
AI-generated information should always be checked for accuracy before use.
What is verification?
Documentation should be accurate, timely, and this.
What is objective?
Using organization-approved platforms for communication helps ensure this.
What is security and compliance?
A therapist leaves their laptop unlocked while stepping away from their desk.
What is a confidentiality risk?
A former client (or student) sends you a friend request on Facebook.
What is a boundary issue?
Entering student names and sensitive details into a public AI tool may create this risk.
What is a confidentiality/privacy breach?
Texting with families through personal phones without agency approval may create this issue.
What is a confidentiality or documentation risk?
Before sending an email containing confidential information, you should always do this.
What is verify the recipient(s)?
You receive a request for records from a parent but do not see a valid Release of Information.
What should you verify before sharing information?
Even if a student's name is omitted, sharing enough details that others could identify them is called this.
What is indirect identification?
This ethical principle requires clinicians to understand the limitations of technology they use.
What is professional competence?
Deleting a clinical email without documenting important information could affect this.
What is the clinical record?
This includes mis. notes for consultants!
Leaving a shared computer without logging out creates this risk.
What is unauthorized access?
A staff member discusses a student case in a crowded coffee shop.
What is an inappropriate disclosure of confidential information?
Staff should review this before posting on behalf of their organization.
What is the social media policy?
AI suggests a treatment recommendation that conflicts with clinical judgment.
Who remains responsible for the final clinical decision? (The clinician.)
You discover an error in a progress note from last week.
What should be corrected according to agency policy?
Staff should avoid discussing sensitive client information through this type of communication unless approved and secure.
What are personal messaging apps or social media platforms?
You accidentally send an email containing PHI to the wrong recipient.
What should be reported immediately as a potential privacy breach to your supervisor?
A therapist posts a photo from school without realizing student names are visible in the background.
What is a confidentiality violation?
A clinician uses AI to draft progress notes but never reviews them before signing.
What is unethical documentation practice?
A therapist copies and pastes the same note for multiple sessions without updating details.
What is inaccurate or fraudulent documentation?
You discover another staff member is using your login credentials.
What is a security violation?