A patient asks that her daughter take part in her treatment planning decisions. You have the patient sign an authorization covering the daughter's participation. This protects her privacy while honouring her wishes. This is an example of:

Correct answer: C. Compliance with HIPAA through a written patient authorization

• A. Presence in the operatory is not consent to disclosure. HIPAA does allow informal agreement when the patient is present and does not object, but a signed authorization is the documented and defensible route.
• B. An authorization is not a waiver. The patient retains all her rights, defines the scope of what may be shared, and can revoke the authorization at any time.
• C. CORRECT. HIPAA permits disclosure of protected health information to a family member when the PATIENT has authorized it. Documenting that authorization in writing is precisely how the rule is satisfied: the patient's autonomy is respected, the daughter can participate, and the practice has a record that the disclosure was permitted.
• D. There is no blanket family exception. Being a relative confers no automatic right of access to an adult patient's records.

Note: Where HIPAA does allow disclosure without written authorization: to other providers for treatment purposes, for payment and healthcare operations, when required by law such as abuse reporting or a subpoena, and in emergencies when the patient cannot communicate and disclosure is in their best interest. When in doubt, get it in writing.