HCP 514 Week 3 HIPAA Privacy and Security in Practice Example

A Mother on the Phone, a Request for Therapy Notes and a Laptop Left on a School Bus: Applying HIPAA and Substance Use Record Rules in a Behavioral Health System

[Student Name]

University of Phoenix

HCP/514: Leading Compliance in Health Care Organizations

Week 3 Assignment

[Instructor Name]

[Date]

The behavioral health system, its patients and incidents are composites written for a model paper; rules and research come from the sources listed.

The privacy officer of a composite regional behavioral health system keeps a log of questions. In one week in October, four entries stood out: a mother calling the crisis unit about her adult son, a patient asking to read her therapist's private notes, a health plan requesting addiction treatment records and a school-based counselor who left a laptop on a school bus. The compliance director reviewed each with the privacy officer. This paper applies HIPAA and the federal rules for substance use disorder records to the four cases.

Why Privacy Is a Clinical Matter

In behavioral health, privacy is part of treatment. Patients share information about suicidal thoughts, substance use and trauma only if they trust it will be protected. A national survey found that most respondents were concerned about breaches when their information was transferred between providers, and 12.3% had withheld information from a health care provider because of security concerns, more often among those who felt they had little say over how their records were used (Agaku et al., 2014).

Case One: The Mother on the Phone

A mother called the crisis unit to ask whether her 24-year-old son had been admitted overnight. Under the privacy rule, staff may tell a relative who is part of the patient's care what that relative needs to know, as long as the patient says yes or, once asked, raises no objection. If the patient is incapacitated or in an emergency, staff may share information they judge to be in the patient's best interest. A separate provision allows disclosure when staff believe in good faith that it is needed to head off serious, imminent danger to the patient or someone else.

Resolving Case One

The son was alert and able to decide. The nurse told the mother she would check with her son, asked him and learned he wanted his mother to know he was safe but not the details of his treatment. The nurse shared exactly that. Had he objected, the nurse could have listened to the mother's concerns, which HIPAA does not restrict, without confirming his presence. Staff had often refused to speak with families at all, believing the law required it; the privacy officer used the case in training.

Case Two: The Therapy Notes

A patient in outpatient therapy requested a copy of her entire record, including her therapist's notes. Patients have a right to access their records, but psychotherapy notes, kept separately from the medical record by a mental health professional and documenting or analyzing conversation in a counseling session, are excluded from that right. Session start and stop times, medications, diagnoses, treatment plans and progress summaries are part of the medical record and must be provided.

Resolving Case Two

The clinic provided the medical record within the required time frame and explained what psychotherapy notes are. The therapist offered to review her notes with the patient in session, which the patient accepted. The review also found that some therapists stored notes in the general record, where they lose special protection; training clarified the difference.

Case Three: Addiction Records and a Health Plan

A Medicaid health plan requested records from the system's opioid treatment program to process claims. Addiction treatment records from programs that receive federal support fall under their own federal confidentiality rule, not HIPAA alone. Since the 2024 revision, one signed consent can cover every later sharing of those records for care, billing and routine operations, and after that recipients that are covered by HIPAA may redisclose as HIPAA permits, while records still cannot be used against the patient in legal proceedings without consent or a court order (Substance Abuse and Mental Health Services Administration, 2024).

Resolving Case Three

The program updated its consent form to the new single-consent format, verified that the patient had signed it and sent the minimum necessary records with the required notice. The 2024 change made sharing for payment easier, but it did not make these records ordinary. Records are labeled in the electronic record so staff recognize them.

Case Four: The Lost Laptop

A school-based counselor left a laptop on a school bus; it was recovered two days later from the bus company's lost and found. The breach rule treats lost patient information as a reportable breach unless the organization can document, after weighing four factors, that compromise is unlikely: how sensitive the data are and how easily patients could be identified, who might have had the device, whether anyone in fact opened or took the data and how far the organization reduced the risk afterward.

Resolving Case Four

The laptop was encrypted to federal standards and required a password; logs showed no login attempts while it was missing. Encrypted information rendered unusable to unauthorized people is not considered unsecured, so notification was not required. The privacy officer documented the assessment. Had the laptop been unencrypted, notification of the students' families and possibly federal regulators would have been required.

Security Lessons

The case confirmed the value of encryption. A proposed 2025 update to the security rule would make encryption and multifactor authentication explicit requirements with limited exceptions (U.S. Department of Health and Human Services, 2025). The system's audit found 14 devices at school sites without full-disk encryption, all corrected within a month.

The Minimum Necessary Standard

A thread ran through three of the cases: sharing only what is needed. The nurse told the mother only that her son was safe; the program sent the health plan only the records needed for the claims. The privacy rule's minimum necessary standard applies to most uses and disclosures other than those for treatment, and it asks staff to think before they send. In behavioral health, where a single note may reveal trauma, sexuality or substance use, that pause matters.

Staff Knowledge

A short survey of 180 staff before the review found that 61% believed HIPAA prohibited any conversation with a patient's family without written authorization and 44% did not know psychotherapy notes had special protection. Both misunderstandings harmed patients: families were shut out of care, and some notes lost protection by being stored in the wrong place. Training now uses the four cases, since real situations teach better than rule summaries.

What the System Changed

The system updated family communication guidance for inpatient and crisis staff, clarified the separation of psychotherapy notes, adopted the new substance use consent form, encrypted every device and added a quarterly privacy case review for clinic liaisons.

Conclusion

Four ordinary events showed HIPAA in practice: permitting families to be involved when patients agree, protecting psychotherapy notes while honoring access rights, applying the 2024 rule for addiction records and assessing a lost device. Getting these decisions right protects patients who share their most sensitive information only when they trust it will be handled well.

References

Agaku, I. T., Adisa, A. O., Ayo-Yusuf, O. A., & Connolly, G. N. (2014). Concern about security and privacy, and perceived control over collection and use of health information are related to withholding of health information from healthcare providers. Journal of the American Medical Informatics Association, 21(2), 374-378. https://doi.org/10.1136/amiajnl-2013-002079

Substance Abuse and Mental Health Services Administration. (2024). Confidentiality of substance use disorder (SUD) patient records. Federal Register, 89, 12472. https://www.federalregister.gov/d/2024-02544

U.S. Department of Health and Human Services. (2025). HIPAA Security Rule to strengthen the cybersecurity of electronic protected health information. Federal Register, 90, 898. https://www.federalregister.gov/d/2024-30983