Choose an answer, then open any option to work its reasoning.
Ethics and Communication
Confidentiality, Disclosure, and the Duty to Protect
Protect the patient's privacy, then look for the narrow permission or duty that changes the default.
What this page makes you able to do
- Choose when to ask permission, disclose without authorization, or seek legal guidance.
- Distinguish treatment disclosures from minimum-necessary rules and nonroutine authorization.
- Use SPIKES and patient preferences to communicate serious news without deceptive withholding.
- Recognize public health, serious-threat, and EPT questions as law-sensitive exceptions.
- Dr. Fatima Ali, DOPsychiatry residentPhysician reviewed
Reviewed
From the Attending.
Family concern is not consent. Ask the capable patient first.
Prove it
Opening question
A capable adult has just received a new cancer diagnosis. The patient's sibling asks the physician in the hallway for the diagnosis, but the patient has not authorized disclosure to family.What is the best next response?
- Why this is rightCapacity and the absence of authorization preserve the patient's control over disclosure to family. Ask privately before sharing.
- Why this failsKinship alone does not replace a capable patient's permission. A concerned relative is not automatically entitled to protected information.
- Why this failsLimiting the amount does not create permission. First identify a valid disclosure pathway.
- Why this failsThe patient may want family involved. Patient-centered care asks for the patient's preference instead of imposing permanent exclusion.
Work the reasoning
A capable patient controls whether a relative receives the diagnosis unless a recognized exception applies.
Capable patient plus no authorization plus family request equals ask the patient before sharing.
Prove it
Five original board walkthroughs
'Use the narrowest defensible route. Default, purpose, exception trigger, recipient, and local-law check.'
The privacy default
The default is locked. No sharing without permission or a valid exception.
Confidentiality protects everything you learn through care. For a capable patient, what a relative gets to hear follows the patient's preference, or a real legal basis that has nothing to do with how worried the relative looks.
The classic trap. A relative is helpful, loving, and standing right there. None of that authorizes protected information. The patient's choice does.
Open each card and name the controlling rule.
Do not disclose identifiable patient information without permission or a recognized exception.
Ask the capable patient what may be shared and with whom.
Patient capacity, recipient identity, purpose, and exception status determine the route.
Pearl. Mnemonic. C-PREP. Capacity, Person requesting, Reason, Exception, Permission.
HIPAA map. Routine care versus authorization
Classify the actor, the information, and the purpose before you pick a pathway. The wrong classification is the wrong disclosure.
HIPAA reaches covered entities and how they handle protected health information. PHI is individually identifiable health information in a protected context.
Treatment, payment, and health care operations ride on the Privacy Rule's routine permission. Everything else needs a valid authorization, unless another specific permission or requirement applies.
Compare the disclosure pathways.
Pearl. Pearl. Classify purpose before quantity. Permission comes before minimization.
Provider treatment disclosure
Provider to provider for treatment. No authorization, no minimum necessary. That pairing is the whole rule.
HIPAA lets one provider share PHI with another for treatment without the patient's authorization. That is the routine lane.
And the minimum-necessary standard does not govern those treatment disclosures. But specific is specific. This is not a license to overshare because everyone involved happens to be a provider.
Select the single accurate treatment rule.
Provider to provider for treatment. May occur without authorization, and the HIPAA minimum-necessary requirement does not apply to this treatment disclosure. Provider to family for reassurance. Always allowed because reassurance supports treatment. Provider to employer for planning. Always allowed if only a summary is sent. Provider to media for public education. Allowed when the patient is not named aloud.
Pearl. Board trap. Minimum necessary is not the reason treatment disclosure is permitted, and it does not govern provider treatment disclosures.
A serious-news conversation in motion
The rule is to establish privacy preferences before walking through the serious-news sequence.
SPIKES gives serious-news talk a spine. Setting, Perception, Invitation, Knowledge, Emotion, Strategy or summary.
Before a single word in front of a relative, lock the patient's privacy preference. Only then assess understanding and how much detail the patient wants, and only then share knowledge.
Follow Jordan Brooks through the room.
'Setup: a relative asks. Signal: Jordan has not chosen privacy. Consequence: disclosure may breach trust. Locked rule: ask Jordan first.' 1 / 5
Privacy starts by asking the patient who may be present and what may be shared. Public-domain image: NIDDK, NIH.Jordan Brooks · Capable patient receiving serious news
Set the room
Jordan Brooks receives serious news while a relative asks for details. Establish privacy preference before continuing.
Setup: ask Jordan who should stay and what may be shared.
Board pattern. Privacy preference
Check perception
Ask what Jordan already understands about the situation.
Signal: baseline understanding guides the next sentence.
Board pattern. Perception
Invite
Ask how much detail Jordan wants now.
Invitation respects the patient's desired depth.
Board pattern. Invitation
Share knowledge
Give clear information in small portions and check comprehension.
Knowledge follows warning and permission to proceed.
Board pattern. Knowledge
Emotion to strategy
Name and respond to emotion, then agree on the next-step strategy.
Consequence becomes support; the locked rule remains patient-led disclosure.
Board pattern. Emotion and strategy
Pattern card. Privacy preference first, then perception, invitation, knowledge, emotion, and strategy.
Pearl. Pearl. Privacy preference is the doorway to SPIKES when relatives are present.
Permitted and required exceptions
No authorization? Then the disclosure has to ride the exact duty or permission that fits the facts. No fit, no disclosure.
The Privacy Rule allows what the law requires and what specified public health duties permit, and the applicable authority sets the exact recipient and scope.
For a serious and imminent threat, HIPAA may permit good-faith disclosure to someone reasonably able to prevent or lessen it. State rules vary, so when the clock is short, local legal or policy guidance matters.
Order the shortest route to an exception question.
Identify whether the issue is treatment, public health, required law, or threat prevention.
Confirm that the facts satisfy the specific disclosure pathway.
Disclose only to the authorized or reasonably able recipient.
Check controlling state law and institutional process when the duty varies.
Pearl. Shortest route. Name the exception, test its trigger, choose its recipient, then check local law.
Board risk screen, not a legal formula
Use the score as a prompt to think about urgency, never as a legal formula.
Threat disclosure stands on two legs. A good-faith assessment that the threat is serious and imminent, and a recipient reasonably able to prevent or lessen it.
This teaching screen is not a statute, a validated tool, or a legal formula. It cannot replace state law, professional judgment, emergency action, or consultation.
Rate the board-stem urgency signals.
Score 0 teaching points
Pearl. At or above 6 teaching points, pause for urgent threat analysis. The number never creates legal permission.
EPT. Treatment with a jurisdiction check
Treating the partner is clinical; whether you are allowed to is legal. The board answer needs both halves.
Expedited partner therapy treats the sex partners of a person diagnosed with certain sexually transmitted infections without examining them first, where the jurisdiction allows it and it is clinically appropriate.
Legality and logistics vary by state. Never assume EPT is universally allowed or universally banned.
Separate the clinical concept from the legal gate.
Pearl. Pattern recognition. EPT in the stem means clinical eligibility plus a jurisdiction check.
Truthful, patient-centered disclosure
Truth, paced with compassion, never concealed.
Withholding pertinent information without the patient's knowledge or consent is generally ethically unacceptable. You may pace the information; you may not deceive.
Patient-centered communication is a loop. Ask preferences, give understandable information, respond to emotion, and build the plan together.
Open the communication tools.
Learn how much the patient wants to know and who should be present.
Prepare the patient briefly before difficult information.
Give manageable information and assess understanding.
Acknowledge emotion and make a concrete next-step strategy.
Pearl. Caution. Therapeutic privilege is not a shortcut for avoiding a hard conversation.
Lock the board pattern
Always take the narrowest defensible route.
Every confidentiality stem resolves the same way. Name the capacity, the recipient, the purpose, and the specific permission or duty that fits.
Treatment coordination, public health, required law, serious threat, and EPT each fire on their own triggers. Exceptions that sound alike are not interchangeable.
Select the single best master rule.
Privacy first, exception second. Protect confidentiality, then apply only the specific permission or duty supported by the facts. Family first. Disclose to close relatives whenever they appear supportive. Minimum necessary first. Reduce the amount and disclosure becomes permissible. Federal rule only. Ignore state variation whenever HIPAA is mentioned.
Pearl. Punch. Permission answers whether; minimum necessary may answer how much.
Clinical walkthrough
