Start practicing

Ethics & Law · single question

A patient requests their records be sent via social media. Which of the following is the BEST response regarding HIPAA?

  1. Send records via secure encrypted email or secure patient portal only
  2. Social media is a covered entity and is HIPAA-compliant
  3. Refuse to release records unless the patient signs a waiver
  4. Send records via any method requested by the patient
Show answer and explanation

Correct answer: A. Send records via secure encrypted email or secure patient portal only

  • A. Correct. HIPAA requires that protected health information (PHI) be transmitted through secure, encrypted methods. Standard social media platforms are not HIPAA-compliant. Records must be sent via a secure, encrypted system (secure email, patient portal, certified mail) regardless of patient preference.
  • B. Social media platforms (Facebook, Instagram, WhatsApp, etc.) are NOT HIPAA-covered entities and do not provide the required security safeguards.
  • C. Patients have a legal right to access their records (HIPAA Privacy Rule); refusal to release records is not appropriate unless specifically exempted.
  • D. Patients may request records in a specific format, but providers are not obligated to use non-HIPAA-compliant methods — patient preference does not override security requirements.

Practice Ethics & Law questions Ethics & Law study notes

More Ethics & Law practice questions