Massage & Bodywork Licensing Examination (MBLEx) Quiz: Confidentiality
20 questions · exam conditions
0:00
ConfidentialityQuestion 1 of 20

A massage therapist working in a wellness center uses an online scheduling and charting service.

To comply with HIPAA standards regarding client confidentiality, what is the most critical feature the therapist should ensure the service provides?

The ability to export records to a PDF format.
A user-friendly interface for quick note-taking.
Secure, encrypted data transmission and storage.
Integration with social media for marketing purposes.
← Back to quizzes

Massage & Bodywork Licensing Examination (MBLEx) Quiz

Massage & Bodywork Licensing Examination (MBLEx) Quiz: Confidentiality

Practice Confidentiality in Massage & Bodywork Licensing Examination (MBLEx) with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Confidentiality, giving you a quick way to practice the rules, question types, and explanations that matter most for Massage & Bodywork Licensing Examination (MBLEx).

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A massage therapist working in a wellness center uses an online scheduling and charting service.

To comply with HIPAA standards regarding client confidentiality, what is the most critical feature the therapist should ensure the service provides?

  1. The ability to export records to a PDF format.
  2. A user-friendly interface for quick note-taking.
  3. Secure, encrypted data transmission and storage. (correct answer)
  4. Integration with social media for marketing purposes.
Explanation: When handling electronic Protected Health Information (ePHI), HIPAA requires technical safeguards to protect the data. Secure, encrypted transmission and storage are fundamental to preventing unauthorized access. Choices A and B relate to convenience and functionality, not security. Choice D would be a direct violation of client privacy.

Question 2

A massage therapist posts on their professional social media page, "What a rewarding day! A client with chronic sciatic pain reported being able to walk without a limp for the first time in years. So glad our work is helping!" The post does not include the client's name.

Why is this social media post a breach of confidentiality?

  1. The therapist should not discuss specific clinical outcomes online.
  2. It reveals specific health information that could make the client identifiable to others. (correct answer)
  3. The post is a form of advertising, which is unprofessional.
  4. The therapist did not state which techniques were used.
Explanation: Even without a name, specific details about a client's condition and treatment progress can make them identifiable to people in their social circle who are aware of their health issues. All protected health information (PHI) must be kept confidential without explicit consent. Choice A is too general. Choice C is incorrect, as advertising is a normal business practice. Choice D is irrelevant to confidentiality.

Question 3

A therapist works in a clinic with a reception area where other clients are waiting. While a client is checking out, the therapist says, "Let's schedule your next appointment. The work we did on your piriformis today should really help with the sciatica you've been experiencing."

This conversation is a breach of confidentiality because it was conducted:

  1. without first receiving payment.
  2. within earshot of other people. (correct answer)
  3. before the client put their coat on.
  4. by the therapist instead of the receptionist.
Explanation: Discussing specific and sensitive client health information (piriformis, sciatica) in a public or semi-public area where others can overhear is a violation of confidentiality. Administrative tasks like scheduling should be handled discreetly. Choices A, C, and D are not relevant to the ethical principle of confidentiality.

Question 4

A therapist provides massage to two close friends who come for appointments separately. Friend A mentions during her session that she is trying to get pregnant. Later, Friend B asks the therapist if she knows why Friend A has seemed so stressed lately.

What is the therapist's most ethical response to Friend B?

  1. Suggest that Friend A might be stressed due to personal matters.
  2. Say, "I cannot discuss any information about another client." (correct answer)
  3. Change the subject and ask Friend B about her own well-being.
  4. Hint that Friend A shared some exciting but stressful news.
Explanation: This response is direct, professional, and clearly upholds the boundary of confidentiality without being rude. It educates the questioner about the therapist's professional duty. Choice A and D are both breaches of confidentiality, as they confirm that the therapist has private information. Choice C avoids the issue but does not clearly state the professional boundary, which can lead to future questions.

Question 5

A client's adult son calls the therapist's office. He states his mother has dementia and he is now managing her healthcare. He requests a summary of her recent treatments.

What must the therapist obtain before releasing any information?

  1. Verbal permission from the client, even if she has dementia.
  2. A letter from the client's primary care physician.
  3. Legal documentation, such as a healthcare power of attorney, naming the son as the agent. (correct answer)
  4. A written request from the son detailing the information he needs.
Explanation: When a third party claims to have legal authority to make healthcare decisions for a client, the practitioner must verify this authority by reviewing legal documentation, such as a power of attorney. Releasing information without this proof is a breach of the client's confidentiality. The other options are not sufficient legal proof of authority.

Question 6

A massage therapist sends a follow-up email with exercise recommendations to a client, but accidentally sends it to the wrong person with a similar email address. The email contains the client's name and details about their condition.

What is the therapist's first ethical responsibility after realizing this error?

  1. Contact the incorrect recipient and ask them to delete the email.
  2. Inform the actual client about the breach of their personal information. (correct answer)
  3. Document the error in the client's file and in an office incident log.
  4. Change the client's email address in the system to prevent a recurrence.
Explanation: The primary ethical duty is transparency with the person who was harmed. The therapist must promptly notify the client whose confidentiality was breached, explain what happened, and describe the steps being taken to mitigate the situation. While A, C, and D are all reasonable follow-up actions, informing the client is the immediate and most critical ethical step.

Question 7

A police officer, not in uniform and without a warrant, enters a massage practice and asks for the name of a client who was present at a specific time, stating it relates to a minor traffic incident outside. What is the therapist's correct course of action?

  1. Provide the name since it is for a police investigation.
  2. Politely decline the request, citing client confidentiality and the need for a warrant or subpoena. (correct answer)
  3. Ask the officer to wait outside while the therapist calls the client for permission.
  4. Confirm if the client was there but refuse to give the name.
Explanation: A massage therapist has an ethical and often legal duty to protect client information. A request from law enforcement without a proper legal instrument like a warrant or subpoena does not override this duty. Choice A is a breach. Choice C places the client in an unfair position. Choice D is still a breach, as it confirms the client's presence.

Question 8

A therapist is updating office procedures and needs to dispose of paper client files from 10 years ago, which is beyond the state's required retention period. What is the most appropriate method for disposal to ensure client confidentiality?

  1. Placing the files in a sealed box in a commercial trash dumpster.
  2. Blacking out the client's name on each page with a marker.
  3. Shredding the documents. (correct answer)
  4. Placing the files in a municipal recycling bin.
Explanation: Shredding is the standard and most secure method for destroying paper documents containing sensitive information, making it unreadable and protecting client confidentiality. Choices A and D are insecure, as the documents could be easily retrieved and read. Choice B is insufficient, as other identifying information and health details would still be visible.

Question 9

A client provides a glowing testimonial to be used on the therapist's website. What is the most critical element the therapist must secure to ethically use the testimonial?

  1. A verbal agreement from the client recorded during a session.
  2. An email from the client containing the text of the testimonial.
  3. A signed, written consent form explicitly stating how and where the testimonial and client's name will be used. (correct answer)
  4. A photograph of the client to post alongside the testimonial.
Explanation: Using a client's words and name for marketing is a release of information that requires explicit, informed, written consent. This document protects both the client and the therapist by clearly defining the scope of the release. A verbal agreement (A) or an email (B) may not be legally sufficient. A photograph (D) would require even more specific consent and is not the foundational requirement.

Question 10

The duty of confidentiality to a client:

  1. ends as soon as the client stops receiving treatment at the practice.
  2. applies only to medical information, not to scheduling or billing.
  3. is absolute and can never be breached under any circumstances.
  4. extends beyond the client's death. (correct answer)
Explanation: The ethical and legal duty to protect a client's private information continues even after the client has died. Records can only be released to a person with the legal authority to act on behalf of the estate, such as an executor. Confidentiality does not end with the therapeutic relationship (A), applies to all information including the fact that someone is a client (B), and has legal exceptions like subpoenas or mandated reporting (C).

Question 11

When submitting a claim to an insurance company, a therapist must provide certain client data. This action is permissible under HIPAA regulations provided:

  1. the therapist has a signed release from the client for billing purposes. (correct answer)
  2. the insurance company promises to keep the data secure.
  3. the therapist only submits claims for clients they have known for over a year.
  4. the therapist calls the client to get verbal permission before each submission.
Explanation: Sharing information with third-party payers like insurance companies is a permitted disclosure under HIPAA, but it requires prior authorization from the client. This is typically done via a signature on the intake forms that authorizes the release of information for the purposes of billing and payment. The other conditions are either insufficient (D), assumed (B), or irrelevant (C).

Question 12

A massage therapist learns that a client has passed away. The client's brother, who the therapist has met before, calls to ask for a copy of the deceased's records, stating he needs them to file a claim with the client's life insurance company.

What is the therapist's ethical obligation regarding the records?

  1. Release the records to the brother since the client is deceased and the request is for a legitimate purpose.
  2. Destroy the records immediately to protect the deceased client's ultimate privacy.
  3. Provide a verbal summary of the treatment to the brother but refuse to release the written records to maintain confidentiality.
  4. Explain that the duty of confidentiality survives death and the records can only be released to the legally appointed executor or administrator of the estate with proper documentation. (correct answer)
Explanation: When you encounter questions about client records and confidentiality, remember that massage therapists have strict ethical and legal duties that don't simply disappear when circumstances change—including when a client dies. The correct approach is D because the duty of confidentiality continues even after a client's death. Client records remain protected health information, and only someone with proper legal authority can access them. This means the legally appointed executor or administrator of the estate, who must provide documentation proving their legal standing (such as letters testamentary or letters of administration from the court). A is incorrect because familiarity with the brother and the seemingly legitimate purpose don't override confidentiality requirements. Insurance claims don't automatically grant access rights, and being a family member doesn't establish legal authority over the deceased's records. B is wrong because immediately destroying records could violate record retention requirements and potentially harm the estate's legitimate needs. Records should be maintained according to professional and legal standards, not destroyed to avoid confidentiality issues. C fails because any disclosure of treatment information—whether verbal or written—violates confidentiality. The format of the information doesn't matter; the content is equally protected regardless of how it's communicated. Study tip: For MBLEX confidentiality questions, remember that client privacy protections are robust and persistent. They survive death, don't bend for family relationships, and require proper legal documentation to override. When in doubt, err on the side of maintaining confidentiality until proper authorization is established.

Question 13

In a clinic with multiple practitioners, which practice best ensures client record confidentiality?

  1. Storing all client files in an unlocked cabinet in a staff-only area.
  2. Leaving a client's chart on the counter of the treatment room between sessions.
  3. Using a single, shared login for the electronic health record system for convenience.
  4. Keeping paper files in a locked cabinet and using an electronic system with unique, password-protected user accounts. (correct answer)
Explanation: This option describes the industry standard for securing both paper and electronic records. Locked cabinets prevent unauthorized physical access, and unique user accounts for electronic systems create an audit trail and ensure that only authorized individuals can access information. The other options all represent significant security vulnerabilities.

Question 14

A massage therapist working in a wellness center receives a subpoena from an attorney representing the opposing party in a client's personal injury lawsuit. The subpoena requests a complete copy of the client's treatment records, including intake forms and all session notes. The therapist has not spoken to the client about this lawsuit.

What is the therapist's most appropriate initial action upon receiving the subpoena?

  1. Immediately comply by sending a copy of the requested records to the attorney to avoid legal penalties.
  2. Contact the client to inform them of the subpoena and obtain a signed release of information before taking any further action. (correct answer)
  3. Disregard the subpoena because it is not a court order and therefore does not override client confidentiality.
  4. Release only the objective portions of the notes, such as dates of service and techniques used, but withhold subjective client comments.
Explanation: A subpoena is a legal demand for records, but it does not automatically nullify a therapist's duty of confidentiality. The proper first step is to notify the client, who has the right to consent to the release or to challenge the subpoena through their own attorney. Releasing records without client consent or a direct court order would be a breach of confidentiality. Ignoring a subpoena is legally risky, and selectively releasing records is not the appropriate response.

Question 15

A client posts a public review on the therapist's social media page, stating: "Thanks to [Therapist's Name], my chronic back pain from my car accident is finally gone! The detailed notes she sent to my doctor really helped my case." The therapist wants to acknowledge the positive review.

What is the most professional and ethically sound way for the therapist to publicly respond?

  1. Reply: "You are so welcome! I'm thrilled we could get those notes to your doctor and help with your recovery."
  2. Send the client a private message to thank them and ask them to edit the review to remove the specific health details.
  3. Reply with a general statement, such as: "Thank you for your kind words. I appreciate you sharing your experience." (correct answer)
  4. Like the comment but do not reply, as any engagement could be seen as a confirmation of the therapeutic relationship.
Explanation: Even when a client discloses information publicly, a therapist must not confirm the therapeutic relationship or any Protected Health Information (PHI). Replying with a generic thank you (C) is polite without breaching confidentiality. Acknowledging the specific details (A) is a clear breach. Privately messaging (B) is a good secondary action but not the best initial public response. Simply 'liking' the comment (D) can also be interpreted as confirming the relationship, making a neutral, general reply the safest option.

Question 16

A police detective visits a therapist's office without a warrant or subpoena. The detective is investigating a hit-and-run incident that occurred nearby and asks to see the appointment log for that afternoon to check for potential witnesses or suspects.

What is the therapist's most appropriate and legal response?

  1. Cooperate by showing the detective the appointment log but covering the clients' names to protect their privacy.
  2. Politely state that client records are confidential and cannot be shared without a warrant or a court order. (correct answer)
  3. Ask the detective for a description of the suspect and only confirm if a client matching that description had an appointment.
  4. Provide the detective with the contact information for the clients scheduled that day so the detective can contact them directly.
Explanation: A client's name and the fact they had an appointment are confidential information. Without a legal mandate like a warrant, subpoena, or court order, a therapist has an ethical and legal duty to protect this information. Cooperating in any form, such as showing a partial log (A), confirming a client's presence (C), or providing contact information (D), constitutes a breach of confidentiality. The correct response is to uphold confidentiality and explain the legal requirement for a warrant.

Question 17

A therapist wants to use a client's story as a case study in a presentation for a massage therapy conference. The case is unique and could be very educational. The therapist plans to change the client's name and city of residence.

To proceed ethically, what is the most critical step the therapist must take?

  1. Ensure all identifying details are thoroughly removed so the client is completely anonymous, making consent unnecessary.
  2. Obtain specific, written, and informed consent from the client that details how and where the information will be used. (correct answer)
  3. Ask for the client's verbal permission to share their story, as written consent is only required for legal record releases.
  4. Use the case study but combine details from several clients to create a composite profile that doesn't represent any single person.
Explanation: While de-identification (A, D) is crucial, it does not replace the need for consent when using a client's specific story. Because unique case details might still make the person identifiable to themselves or others, obtaining specific, written, and informed consent is the primary ethical requirement. Verbal permission (C) is not sufficient for this level of information sharing. The client must understand the context, audience, and potential risks before agreeing in writing.

Question 18

A client's spouse calls the massage therapist's office to cancel an upcoming appointment for the client. While on the phone, the spouse asks about the therapist's findings from the client's last session, saying, "They said their shoulder felt much better, what did you find was the problem?"

What is the therapist's most appropriate response?

  1. Share general information, such as "we worked on some tight muscles in the rotator cuff," to be helpful without revealing sensitive details.
  2. Thank the spouse for calling to cancel the appointment but state that all session details are confidential and cannot be discussed. (correct answer)
  3. Tell the spouse that the client's records can only be released if the client provides verbal authorization over the phone.
  4. Suggest the spouse ask the client directly, as the therapist cannot act as an intermediary for their health information.
Explanation: Confirming any details of a client's session, even seemingly harmless ones, with a third party without explicit consent is a breach of confidentiality. The most professional and ethically sound response is to politely but firmly uphold the confidential nature of the therapeutic relationship. Sharing general information (A) is still a breach. Requiring verbal consent (C) is not the best practice (written is preferred) and puts the therapist in a difficult position. While telling them to ask the client (D) is true, the therapist's primary responsibility is to state their own professional boundary first.

Question 19

A massage therapist is closing their solo practice after 15 years. Their state law requires that massage therapy records be maintained for a minimum of 5 years after the last date of service. The therapist has records dating back the full 15 years.

What is the most appropriate and legally compliant procedure for managing these client records?

  1. Transfer all 15 years of records to a professional records management company for secure storage.
  2. Contact all former clients and offer them their original records to manage themselves.
  3. Securely shred records for clients whose last visit was more than 5 years ago and notify recent clients of how to access their records going forward. (correct answer)
  4. Place all records in a secure personal storage unit and leave instructions in their professional will for their destruction after 5 more years.
Explanation: The therapist must balance the legal requirement for record retention with the duty to securely dispose of records that are no longer needed. The most correct procedure is to destroy records beyond the statutory retention period (in this case, 5 years) using a secure method like shredding. For more recent clients whose records must be maintained, the therapist should have a plan, which usually involves notifying them and arranging for the transfer or continued secure storage of their files.

Question 20

A client sends a text message to their therapist's personal cell phone an hour after a session, saying, "I think you went too deep on my neck, it feels really weird and painful now. What should I do?" The therapist is out with family.

What is the most professional response that respects both client care and confidentiality?

  1. Immediately text back detailed medical advice and self-care instructions to address the client's pain.
  2. Wait until the next business day to respond through an official channel, like an office phone call.
  3. Reply via text, acknowledging the message and stating a specific time you will call them from the office to discuss their concerns confidentially. (correct answer)
  4. Text back and ask the client to send a picture of their neck so you can better assess the situation.
Explanation: Texting is not a secure or confidential method for discussing detailed health concerns. Providing medical advice via text (A) is risky and unprofessional. Asking for a picture (D) further compromises privacy. However, ignoring a message about adverse effects (B) is poor client care. The best response is to use the insecure medium (text) only to acknowledge receipt and move the conversation to a secure and appropriate channel (a phone call) at a designated time. This shows responsiveness while maintaining professional boundaries and confidentiality.