Choose an answer, then open any option to work its reasoning.
Ethics and Communication
Confidentiality, Disclosure, and the Duty to Protect
Protect the patient's privacy, then look for the narrow permission or duty that changes the default.
What this page makes you able to do
- Choose when to ask permission, disclose without authorization, or seek legal guidance.
- Distinguish treatment disclosures from minimum-necessary rules and nonroutine authorization.
- Use SPIKES and patient preferences to communicate serious news without deceptive withholding.
- Recognize public health, serious-threat, and EPT questions as law-sensitive exceptions.
- Dr. Fatima Ali, DOPsychiatry residentReview pending
Assigned · Pending physician review
From the Attending:
Family concern is not consent. Ask the capable patient first.
Prove it
Opening question
A capable adult has just received a new cancer diagnosis. The patient's sibling asks the physician in the hallway for the diagnosis, but the patient has not authorized disclosure to family.What is the best next response-
- Why this is rightCapacity and the absence of authorization preserve the patient's control over disclosure to family. Ask privately before sharing.
- Why this failsKinship alone does not replace a capable patient's permission. A concerned relative is not automatically entitled to protected information.
- Why this failsLimiting the amount does not create permission. First identify a valid disclosure pathway.
- Why this failsThe patient may want family involved. Patient-centered care asks for the patient's preference instead of imposing permanent exclusion.
Work the reasoning
A capable patient controls whether a relative receives the diagnosis unless a recognized exception applies.
Capable patient plus no authorization plus family request equals ask the patient before sharing.
Prove it
Five original board walkthroughs
'Use the fastest defensible route: default, purpose, exception trigger, recipient, and local-law check.'
The privacy default
The rule is to keep information confidential until permission or a valid exception applies.
Confidentiality protects information learned through care. For a capable patient, disclosure to relatives ordinarily follows the patient's preference or another valid legal basis.
Board trap: being helpful, related, or physically present does not by itself authorize a family member to receive protected information.
Open each card and name the controlling rule.
Do not disclose identifiable patient information without permission or a recognized exception.
Ask the capable patient what may be shared and with whom.
Patient capacity, recipient identity, purpose, and exception status determine the route.
Pearl. Mnemonic: C-PREP. Capacity, Person requesting, Reason, Exception, Permission.
HIPAA map: routine care versus authorization
The rule is to classify the actor, information, and purpose before choosing a disclosure pathway.
HIPAA applies to covered entities and their handling of protected health information. PHI is individually identifiable health information in a protected context.
A covered entity may use or disclose PHI for treatment, payment, and health care operations as permitted by the Privacy Rule. Other uses often require a valid authorization unless another permission or requirement applies.
Compare the disclosure pathways.
Pearl. Pearl: classify purpose before quantity. Permission comes before minimization.
Provider treatment disclosure
The rule is that minimum necessary does not apply to provider treatment disclosures.
HIPAA permits one health care provider to disclose PHI to another provider for treatment without the patient's authorization.
The minimum-necessary standard does not apply to disclosures to or requests by a health care provider for treatment. This exception is specific, not a license for casual overdisclosure.
Select the single accurate treatment rule.
Provider to provider for treatment. May occur without authorization, and the HIPAA minimum-necessary requirement does not apply to this treatment disclosure. Provider to family for reassurance. Always allowed because reassurance supports treatment. Provider to employer for planning. Always allowed if only a summary is sent. Provider to media for public education. Allowed when the patient is not named aloud.
Pearl. Board trap: minimum necessary is not the reason treatment disclosure is permitted, and it does not govern provider treatment disclosures.
A serious-news conversation in motion
The rule is to establish privacy preferences before moving through the serious-news sequence.
SPIKES organizes serious-news communication around setting, perception, invitation, knowledge, emotion, and strategy or summary.
Before speaking in front of a relative, establish the patient's privacy preference. Then assess understanding and desired detail before sharing knowledge.
Follow Jordan Brooks through the room.
'Setup: a relative asks. Clue: Jordan has not chosen privacy. Consequence: disclosure may breach trust. Locked rule: ask Jordan first.' 1 / 5
Privacy starts by asking the patient who may be present and what may be shared. Public-domain image: NIDDK, NIH.Jordan Brooks · Capable patient receiving serious news
Set the room
Jordan Brooks receives serious news while a relative asks for details. Establish privacy preference before continuing.
Setup: ask Jordan who should stay and what may be shared.
Board pattern. Privacy preference
Check perception
Ask what Jordan already understands about the situation.
Clue: baseline understanding guides the next sentence.
Board pattern. Perception
Invite
Ask how much detail Jordan wants now.
Invitation respects the patient's desired depth.
Board pattern. Invitation
Share knowledge
Give clear information in small portions and check comprehension.
Knowledge follows warning and permission to proceed.
Board pattern. Knowledge
Emotion to strategy
Name and respond to emotion, then agree on the next-step strategy.
Consequence becomes support; the locked rule remains patient-led disclosure.
Board pattern. Emotion and strategy
Pattern card. Privacy preference first, then perception, invitation, knowledge, emotion, and strategy.
Pearl. Pearl: privacy preference is the doorway to SPIKES when relatives are present.
Permitted and required exceptions
The rule is to disclose without authorization only through the exact public duty or permission that applies.
The Privacy Rule permits disclosures that are required by law and permits specified public health disclosures. The exact recipient and scope come from the applicable authority.
For a serious and imminent threat, HIPAA may permit a good-faith disclosure to a person reasonably able to prevent or lessen the threat. State duties and permissions vary, so urgent local legal or policy guidance matters.
Order the quickest route to an exception question.
Identify whether the issue is treatment, public health, required law, or threat prevention.
Confirm that the facts satisfy the specific disclosure pathway.
Disclose only to the authorized or reasonably able recipient.
Check controlling state law and institutional process when the duty varies.
Pearl. Quickest route: name the exception, test its trigger, choose its recipient, then check local law.
Board risk screen, not a legal formula
The rule is to use the score only as an urgent evaluation cue, never as a legal formula.
Threat disclosure turns on a good-faith assessment of a serious and imminent threat and on disclosure to someone reasonably able to prevent or lessen it.
This educational screen is not a statute, clinical instrument, or legal formula. It cannot replace state law, professional judgment, emergency action, or consultation.
Rate the board-stem urgency signals.
Score 0 teaching points
Pearl. At or above 6 teaching points, pause for urgent threat analysis. The number never creates legal permission.
EPT: treatment with a jurisdiction check
The rule is that partner treatment requires the right clinical criteria and a jurisdiction check.
Expedited partner therapy allows treatment of sex partners of a person diagnosed with certain sexually transmitted infections without first examining those partners, where legally permissible and clinically appropriate.
EPT legality and implementation vary by jurisdiction. A board answer should not assume universal permission or prohibition.
Separate the clinical concept from the legal gate.
Pearl. Pattern recognition: EPT in the stem means clinical eligibility plus a jurisdiction check.
Truthful, patient-centered disclosure
The rule is to deliver information truthfully and compassionately, without concealment.
Withholding pertinent medical information without the patient's knowledge or consent is generally ethically unacceptable. Information may be paced sensitively, but clinicians should not deceive the patient.
Patient-centered communication asks about preferences, gives understandable information, responds to emotion, and creates a shared plan.
Open the communication tools.
Learn how much the patient wants to know and who should be present.
Prepare the patient briefly before difficult information.
Give manageable information and assess understanding.
Acknowledge emotion and make a concrete next-step strategy.
Pearl. Caution: therapeutic privilege is not a shortcut for avoiding a hard conversation.
Lock the board pattern
The rule is to choose the narrowest defensible disclosure route.
Confidentiality questions are solved by identifying capacity, recipient, purpose, and a valid permission or duty.
Treatment coordination, public health, required law, serious threat, and EPT each have distinct triggers. Similar-sounding exceptions are not interchangeable.
Select the single best master rule.
Privacy first, exception second. Protect confidentiality, then apply only the specific permission or duty supported by the facts. Family first. Disclose to close relatives whenever they appear supportive. Minimum necessary first. Reduce the amount and disclosure becomes permissible. Federal rule only. Ignore state variation whenever HIPAA is mentioned.
Pearl. Punch: permission answers whether; minimum necessary may answer how much.
Clinical walkthrough
