A 21-year-old patient attends with his mother, who will be paying for his treatment. She asks about the plan and its costs. What is the correct approach?

Correct answer: C. Discuss the treatment and fees with the mother only after obtaining the patient's consent to share his information

• A. Withholding information from the patient himself inverts the entire principle.
• B. Payment does not create a right of access to another adult's health information.
• C. CORRECT. At 21 the patient is a legally competent ADULT and holds his own right to confidentiality under HIPAA and to autonomous decision-making. Who pays the bill does not confer a right to protected health information. The correct step is to ask the patient — ideally in a moment alone — whether he authorizes disclosure to his mother, then document that authorization. In practice most patients agree readily, but the permission must come from the patient.
• D. A blanket refusal is unnecessary and unhelpful — the patient may fully consent, and family involvement often improves care.

Note: The rule generalizes: spouses, adult children, and employers all require the patient's authorization before disclosure.