NAPLEX Quiz: Ethical Principles And Patient Confidentiality
20 questions · exam conditions
0:00
Ethical Principles And Patient ConfidentialityQuestion 1 of 20

A 38-year-old male with alcohol use disorder requests disulfiram and asks that no mail or phone messages be left because he shares a home phone with roommates. Your automated system is set to send refill reminders with medication names. Under HIPAA and reasonable safeguards, what is the most appropriate action for the pharmacist to take?

Leave the system as-is because automated reminders are considered operational and not subject to patient preference
Offer an alternative confidential communication method (for example, opt out of detailed messages or use generic reminders) consistent with the patient's request where feasible
Refuse to dispense disulfiram because the patient's communication restrictions make counseling impossible
Send reminders with the medication name but remove the pharmacy name to reduce privacy risk
← Back to quizzes

NAPLEX Quiz

NAPLEX Quiz: Ethical Principles And Patient Confidentiality

Practice Ethical Principles And Patient Confidentiality in NAPLEX with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Ethical Principles And Patient Confidentiality, giving you a quick way to practice the rules, question types, and explanations that matter most for NAPLEX.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A 38-year-old male with alcohol use disorder requests disulfiram and asks that no mail or phone messages be left because he shares a home phone with roommates. Your automated system is set to send refill reminders with medication names. Under HIPAA and reasonable safeguards, what is the most appropriate action for the pharmacist to take?

  1. Leave the system as-is because automated reminders are considered operational and not subject to patient preference
  2. Offer an alternative confidential communication method (for example, opt out of detailed messages or use generic reminders) consistent with the patient's request where feasible (correct answer)
  3. Refuse to dispense disulfiram because the patient's communication restrictions make counseling impossible
  4. Send reminders with the medication name but remove the pharmacy name to reduce privacy risk

Explanation: This scenario addresses HIPAA's requirement to accommodate reasonable requests for confidential communications, such as altering reminder methods. The key factor is the patient's shared living situation and request to avoid detailed messages for disulfiram, a sensitive medication. Option B is the best choice as it offers alternatives like generic reminders, respecting the request feasibly. Option A ignores patient rights; option C refuses dispensing unnecessarily; option D still risks disclosure. Implement system flags for preferences. A framework involves evaluating request feasibility, adapting processes, and documenting to enhance patient-centered confidentiality management.

Question 2

A 60-year-old female with metastatic breast cancer is picking up morphine ER. A pharmaceutical sales representative is in the store and asks you which patients are receiving their company's opioid so they can offer coupons and adherence programs. This is a confidentiality and professional conduct issue under HIPAA marketing rules. What is the most appropriate action for the pharmacist to take?

  1. Provide a list of patient names and contact information because coupons benefit patients financially
  2. Decline to share any patient-identifying information and explain that HIPAA generally prohibits disclosure for marketing without patient authorization (correct answer)
  3. Share the information if the representative signs a confidentiality agreement with the pharmacy
  4. Provide only the patient phone numbers without names, since that is not protected health information

Explanation: The principle here is HIPAA's prohibition on using PHI for marketing without authorization, including sharing with pharmaceutical representatives. The key situational factor is the rep's request for patient details to offer coupons, which constitutes marketing despite potential benefits. Option B is the best action as it refuses disclosure, explaining HIPAA rules to prevent breaches. Option A justifies based on benefits, ignoring rules; option C's agreement does not supersede HIPAA; option D wrongly assumes phone numbers are not PHI. Educate on marketing policies. Ethically, distinguish marketing from care, obtain authorizations, and prioritize patient consent in commercial interactions.

Question 3

A 50-year-old male with chronic kidney disease brings a prescription for sildenafil and requests discreet handling. Later, his friend calls and says the patient asked them to "check if it's ready," then asks what the medication is for. There is no explicit authorization on file beyond pickup. Under HIPAA and ethical standards, what is the most appropriate action for the pharmacist to take?

  1. Tell the friend the medication name and indication because the patient allowed them to call
  2. Confirm only whether a prescription is ready for pickup if appropriate, but do not disclose medication name or indication without patient authorization (correct answer)
  3. Disclose the indication but not the medication name to protect privacy
  4. Provide the full details if the friend can verify the patient's address and date of birth

Explanation: The ethical principle tested is the limited scope of disclosures without explicit authorization, even for pickup inquiries from friends. The key factor is the patient's request for discreet handling of sildenafil, with the friend's call implying pickup permission but not extending to details. Option B is the best action as it confirms readiness minimally without revealing PHI, adhering to HIPAA. Option A exceeds by disclosing name and indication; option C arbitrarily limits; option D uses insufficient verification. Document such requests carefully. Ethically, clarify authorization scope, err on caution, and educate patients on privacy options for sensitive medications.

Question 4

A 28-year-old male presents to the pharmacy counter requesting an early refill of oxycodone for chronic back pain, stating his supply was stolen. He becomes agitated and says he will "hurt someone" if he cannot get it today, then leaves. You have his name and contact information in the pharmacy system. This raises a potential conflict between patient confidentiality and safety-related disclosure under state law and HIPAA provisions for preventing or lessening a serious and imminent threat. What is the most appropriate action for the pharmacist to take in this scenario?

  1. Call law enforcement to report the threat and share only the information necessary to address the imminent safety risk, documenting the rationale (correct answer)
  2. Call the patient's employer to warn them, since they may be affected by the threat
  3. Post the patient's photo from the security camera in the pharmacy to alert staff at nearby stores
  4. Do nothing because HIPAA never allows disclosure without patient authorization

Explanation: This scenario tests the HIPAA exception allowing disclosure to prevent serious and imminent threats to health or safety, balanced with the principle of confidentiality. The key situational factor is the patient's explicit threat of harm upon denial of an early opioid refill, indicating potential imminent danger. Option A is the best action as it limits disclosure to law enforcement with only necessary details, documenting the rationale to comply with HIPAA's threat prevention provision. Option B is incorrect as warning an employer exceeds minimum necessary and lacks direct relevance; option C violates privacy by publicizing identifiable information; option D is wrong because HIPAA does permit limited disclosures for safety without authorization. Pharmacists must assess threat credibility and use professional judgment in reporting. Ethically, weigh confidentiality against beneficence and nonmaleficence, ensuring disclosures are proportionate and documented for accountability.

Question 5

A 16-year-old male comes alone to the pharmacy requesting a refill of his inhaled corticosteroid for asthma and asks that his parents not be notified. A parent calls later asking whether the prescription was filled and how often the patient is using it. You must consider HIPAA, state minor-consent laws, and the ethical principle of respecting patient autonomy when permitted by law. What is the most appropriate action for the pharmacist to take in this scenario?

  1. Disclose refill information to the parent because minors cannot have any health privacy rights
  2. Refuse to discuss any information with the parent and direct them to the patient, unless state law clearly grants parental access or the patient authorizes disclosure (correct answer)
  3. Provide adherence details but not the medication name, because partial disclosure is always permitted
  4. Call the parent proactively to encourage monitoring, since beneficence overrides confidentiality for chronic conditions

Explanation: This scenario examines minors' privacy rights under HIPAA and state minor-consent laws for conditions like asthma, testing the balance of autonomy and parental access. The key factor is the 16-year-old's request for confidentiality in refilling an inhaled corticosteroid, where state laws may allow minors to consent to treatment without parental notification. Option B is the best choice as it protects the minor's privacy by refusing disclosure unless authorized or required by law, promoting trust and adherence. Option A is incorrect as minors can have privacy rights under certain state frameworks; option C arbitrarily permits partial disclosure without basis; option D violates beneficence by proactively breaching confidentiality. In practice, consult state-specific laws on minor consent. A transferable framework involves verifying legal allowances for minor autonomy, obtaining consent when possible, and prioritizing patient well-being in ethical decisions.

Question 6

A 23-year-old female with depression and a history of self-harm asks for a refill of fluoxetine and tells the pharmacist she has a specific plan to attempt suicide tonight. She refuses to allow you to contact her family and asks you not to tell anyone. Under HIPAA and professional standards, you must decide whether disclosure is permissible to prevent harm. What is the most appropriate action for the pharmacist to take in this scenario?

  1. Maintain confidentiality and only advise her to call a hotline because disclosure without consent is always prohibited
  2. Contact emergency services or a crisis team and disclose only the minimum information necessary to address an imminent risk, documenting the disclosure rationale (correct answer)
  3. Call her employer to ensure she is not scheduled to work, since that reduces risk
  4. Post a warning to local pharmacies with her name so staff can monitor her medication refills

Explanation: The ethical principle here is the duty to prevent imminent self-harm under HIPAA's threat exception, overriding confidentiality when necessary to protect life. The key factor is the patient's detailed suicide plan and refusal of disclosure, indicating an immediate risk requiring intervention. Option B is the best action as it involves emergency services with minimal disclosure, documenting the rationale for the exception. Option A is insufficient as it fails to address imminent danger; option C unnecessarily involves the employer; option D risks further breaches. Pharmacists must prioritize safety in crises. Ethically, use a framework of assessing risk severity, intervening proportionately, and following up to integrate beneficence with respect for autonomy.

Question 7

A 44-year-old female with rheumatoid arthritis receives a specialty medication shipped to her home. She asks the pharmacy to ship to her workplace instead, but she does not want the package to reveal the pharmacy name or medication type. Under HIPAA and professional conduct standards, the pharmacy must balance patient privacy with operational requirements and state shipping/labeling rules. What is the most appropriate action for the pharmacist to take?

  1. Refuse to ship to the workplace because HIPAA prohibits delivery to any address other than the home
  2. Accommodate the alternate shipping address when feasible and use reasonable safeguards (for example, discreet packaging) while meeting any required labeling and documentation rules (correct answer)
  3. Ship to the workplace but label the outside of the package with the medication name to prevent delivery errors
  4. Call the patient's supervisor to confirm the best delivery time and disclose the medication to avoid mishandling

Explanation: This scenario tests HIPAA's accommodation of alternative confidential communications, including shipping addresses, with reasonable safeguards. The key factor is the patient's request for workplace shipping of a specialty medication without revealing details, balancing privacy with operational rules. Option B is the best choice as it accommodates when possible, using discreet packaging to minimize disclosure risks. Option A is incorrect as HIPAA allows flexibility; option C risks exposure via labeling; option D breaches by disclosing to the supervisor. Verify shipping regulations. Ethically, prioritize patient preferences, implement safeguards, and document to support autonomy in delivery practices.

Question 8

A 55-year-old male with major depressive disorder fills bupropion. A coworker who is also a friend of the pharmacist asks, in casual conversation, whether the patient is "on antidepressants" because they are concerned about workplace performance. There is no patient authorization and the conversation is outside any treatment purpose. Which ethical principle is most relevant to this situation?

  1. Justice, because coworkers have equal rights to access health information for workplace fairness
  2. Confidentiality (fidelity), because the pharmacist has a duty to protect the patient's protected health information from unauthorized disclosure (correct answer)
  3. Nonmaleficence, because the pharmacist should avoid dispensing antidepressants when coworkers are concerned
  4. Veracity, because the pharmacist should answer honestly when asked direct questions by acquaintances

Explanation: The ethical principle most relevant is confidentiality (fidelity), as it underscores the pharmacist's obligation to safeguard protected health information from casual or unauthorized inquiries. The key situational factor is the coworker's non-treatment-related question about the patient's antidepressant use, lacking authorization and tied to workplace concerns. Option B is the best choice because it directly applies the duty to protect PHI, preventing breaches in informal settings. Option A misapplies justice to justify access; option C twists nonmaleficence to withholding care; option D confuses veracity with mandatory honesty in private matters. Pharmacists must recognize and deflect such inquiries. A transferable framework involves identifying the core principle, assessing disclosure justification, and redirecting to maintain ethical integrity in social contexts.

Question 9

A 33-year-old female with newly diagnosed tuberculosis is prescribed rifampin and is concerned about her immigration status. She tells the pharmacist she has not notified public health authorities and asks you not to share any information. Your state has mandatory reporting requirements for certain communicable diseases, and HIPAA permits disclosures required by law to public health authorities. What is the most appropriate action for the pharmacist to take?

  1. Maintain confidentiality because immigration concerns override public health reporting requirements
  2. Report to the appropriate public health authority as required by state law and limit disclosure to the information required, explaining the requirement to the patient (correct answer)
  3. Notify the patient's landlord and employer to prevent spread, since they are most affected
  4. Post a notice at the pharmacy warning customers about the patient's tuberculosis exposure risk

Explanation: This question tests the ethical principle of patient confidentiality under HIPAA and the legal requirements for mandatory reporting of communicable diseases to protect public health. The key situational factor is the patient's newly diagnosed tuberculosis, a reportable condition under state law, combined with her concerns about immigration status and request for non-disclosure. The most appropriate action is to report to the public health authority as required by law while limiting disclosure to necessary information and explaining the requirement to the patient, as this balances legal obligations with patient autonomy and minimizes unnecessary breaches of confidentiality. Maintaining confidentiality as in choice A is incorrect because public health reporting requirements supersede individual concerns when mandated by law to prevent disease spread. Notifying the landlord and employer as in choice C or posting a notice as in choice D violates HIPAA by disclosing protected health information to unauthorized parties without legal justification and could lead to discrimination or stigma. In pharmacy practice, always prioritize mandatory reporting for public health threats while adhering to the minimum necessary disclosure rule under HIPAA. Pharmacists should educate patients on reporting requirements to foster trust and encourage compliance with treatment.

Question 10

A 30-year-old male with opioid use disorder is treated with buprenorphine/naloxone. His probation officer calls the pharmacy requesting confirmation of adherence and pickup dates, stating it is required for probation compliance, but provides no patient authorization or court order. Under HIPAA and typical state regulations, what is the best way to handle this confidentiality issue?

  1. Disclose adherence and pickup dates because probation officers are part of law enforcement and can request medical information at will
  2. Decline to disclose without a valid patient authorization or appropriate legal process (for example, court order), and offer to provide a form for the patient to authorize release if desired (correct answer)
  3. Disclose only the last fill date because dates are not protected health information
  4. Call the prescriber and share the probation officer's request along with the patient's full profile without consent

Explanation: The principle examined is HIPAA's requirement for authorization or legal process before disclosing PHI to law enforcement entities like probation officers, unless specific exceptions apply. The key factor is the absence of patient consent or a court order for the probation officer's request regarding buprenorphine adherence. Option B is the best action as it protects confidentiality by declining disclosure without proper documentation, offering authorization options to the patient. Option A is incorrect as probation officers do not have automatic access; option C wrongly assumes dates are not PHI; option D breaches by sharing with the prescriber unnecessarily. In practice, verify all law enforcement requests rigorously. Ethically, balance justice with confidentiality, ensuring disclosures are legally justified and minimally invasive to maintain trust.

Question 11

A 34-year-old female requests emergency contraception and asks that no information be shared with her spouse. Later, a man claiming to be her husband calls and demands to know what she purchased and whether she is pregnant. There is no authorization on file, and the patient has not agreed to share information. What is the best way to handle this confidentiality issue consistent with HIPAA and professional ethics?

  1. Confirm the purchase because spouses are automatically treated as personal representatives under HIPAA
  2. Decline to disclose any information and offer to have the patient contact the pharmacy if she wishes to authorize disclosure (correct answer)
  3. Disclose only whether she is pregnant, since that is not considered protected health information
  4. Provide the information if the caller can answer identity verification questions such as address and date of birth

Explanation: The principle tested is HIPAA's protection of sensitive reproductive health information and the prohibition on unauthorized disclosures to spouses without consent. The key factor is the patient's explicit request for confidentiality regarding emergency contraception, indicating a need for privacy in potentially abusive or controlling situations. Option B is the best action as it fully upholds confidentiality by declining disclosure and offering patient-authorized channels, consistent with HIPAA and ethical respect for autonomy. Option A is incorrect because spouses are not automatically personal representatives; option C wrongly assumes pregnancy status is not PHI; option D risks breach via insufficient verification. Pharmacists should prioritize patient safety and privacy in sensitive cases. Ethically, assess for signs of coercion, offer resources if needed, and document requests to guide future confidentiality management.

Question 12

A 29-year-old male with epilepsy is applying for a job and brings a form asking the pharmacy to verify his medication history and adherence. He says, "Just send them whatever they ask for," but he has not signed a HIPAA-compliant authorization and the employer has faxed a request for his full profile, including diagnoses. HIPAA generally requires a valid written authorization for disclosure to employers and the disclosure should be limited to the minimum necessary for the stated purpose. What is the most appropriate action for the pharmacist to take in this scenario?

  1. Send the requested information to the employer because the patient verbally agreed and the employer initiated the request
  2. Send only a verbal confirmation of adherence because that is not protected health information
  3. Obtain a completed written authorization specifying what information may be released and to whom, then disclose only the minimum necessary information consistent with the authorization (correct answer)
  4. Refuse all requests from employers even with authorization because employment-related disclosures are prohibited under HIPAA

Explanation: This scenario examines proper authorization requirements for employment-related disclosures under HIPAA. The key factors are the patient's verbal consent, lack of written authorization, and the employer's broad request for information including diagnoses. Option C is the BEST choice because it follows HIPAA's requirement for written authorization for employment disclosures and limits information to the minimum necessary for the stated purpose. Option A violates HIPAA by relying on verbal consent alone for an employment disclosure. Option B incorrectly claims adherence information isn't protected when it reveals the patient is taking medication. Option D is overly restrictive as HIPAA permits employment disclosures with proper authorization. The transferable framework for employment-related requests is: always obtain HIPAA-compliant written authorization specifying what information will be disclosed and to whom, limit disclosure to the minimum necessary for the stated employment purpose, and never rely on verbal consent alone for third-party disclosures.

Question 13

A 30-year-old female presents to the pharmacy with a prescription for oxycodone after a dental procedure. She is accompanied by a friend who answers most questions and asks the pharmacist to "just tell me how she should take it" while the patient remains quiet. Under HIPAA and professional standards, the pharmacist should make reasonable efforts to involve the patient and share information only with the patient or a person the patient agrees may receive it. How should the pharmacist address this ethical dilemma?

  1. Provide full counseling to the friend because the patient's silence implies consent to disclose information
  2. Ask the patient privately whether she wants the friend involved in counseling and, if she agrees, limit discussion to necessary information for safe use (correct answer)
  3. Refuse to counsel anyone and dispense without counseling to avoid a potential confidentiality breach
  4. Call the prescriber to report suspected coercion and disclose the patient's medication history without first assessing the situation

Explanation: This scenario examines the ethical principle of patient autonomy and the pharmacist's duty to ensure informed consent in medication counseling. The key patient-specific factor is that the patient appears passive while a friend attempts to control the interaction, raising concerns about whether the patient can freely participate in her own care. Option B is the BEST choice because it respects patient autonomy by directly engaging the patient to determine her preferences while allowing for appropriate support if she consents. Option A incorrectly interprets silence as consent and fails to verify the patient's wishes. Option C abandons the professional duty to counsel and could compromise patient safety. Option D makes unfounded assumptions about coercion and violates confidentiality by disclosing information to the prescriber without first assessing the situation. The transferable framework is: always attempt to engage directly with the patient to determine their preferences for information sharing, obtain explicit consent before involving third parties in counseling, and document the patient's wishes while ensuring safe medication use.

Question 14

A 16-year-old female requests emergency contraception and asks to pay cash, stating she does not want her parents to find out through insurance. Her parent later calls the pharmacy asking for a list of all medications the teen has received "for my records." Under HIPAA and state minor-consent laws (which vary), a minor may have privacy rights for certain reproductive health services, and disclosure to parents may be restricted when the minor can legally consent. What is the most appropriate action for the pharmacist to take?

  1. Provide the parent the full list because parents have an absolute right to all minor health information
  2. Refuse to dispense emergency contraception to minors to avoid confidentiality conflicts
  3. Decline to disclose specific information without the patient's authorization and follow state minor-consent and pharmacy privacy policies; offer to speak with the patient about involving a trusted adult if she wishes (correct answer)
  4. Disclose the medication name but not the indication because that is not protected health information

Explanation: This scenario addresses the intersection of minor consent laws, reproductive health privacy, and parental inquiry about adolescent healthcare. The key factors are that the minor sought emergency contraception, explicitly requested confidentiality, and state law likely permits minors to consent to this service independently. Option C is the BEST choice because it protects the minor's privacy rights under applicable laws while offering supportive guidance about involving trusted adults if the patient chooses. Option A incorrectly assumes parents have absolute rights to all minor health information, ignoring state-specific minor consent laws. Option B creates an inappropriate barrier to care by refusing to provide legally available services. Option D misunderstands HIPAA by claiming medication names aren't protected when they reveal protected health information. The transferable principle for minor confidentiality is: understand state-specific minor consent laws for reproductive health services, protect minor privacy rights when they can legally consent to care, and offer supportive resources while maintaining confidentiality unless specific exceptions apply.

Question 15

A 62-year-old female with chronic obstructive pulmonary disease and depression picks up a new prescription for sertraline. Her adult son arrives later and asks for her medication list because he is "helping manage her pills," but the patient is not present and there is no documentation of personal representative status. You must decide whether disclosure is permitted under HIPAA and professional ethics. How should the pharmacist address this ethical dilemma?

  1. Provide the full medication list because family members involved in care are always permitted access
  2. Provide only over-the-counter recommendations but not prescription information, because prescriptions are the only protected data
  3. Ask the son to have the patient contact the pharmacy to provide consent or documentation of personal representative authority before any disclosure (correct answer)
  4. Disclose the medication list if the son can verify the patient's date of birth and address

Explanation: The ethical principle tested here is the duty to maintain confidentiality under HIPAA, particularly regarding personal representatives and family involvement without explicit authorization. The key factor is the absence of documentation establishing the son as a personal representative, despite his claim of helping with care, and the patient not being present to consent. Option C is the best choice as it respects patient autonomy by requiring consent or proof of authority before disclosure, aligning with HIPAA's rules on personal representatives. Option A is incorrect because family involvement does not automatically permit access without verification, violating confidentiality; option B is suboptimal as it arbitrarily distinguishes between OTC and prescription data, both of which can be PHI; option D risks unauthorized disclosure based on insufficient verification. In practice, pharmacists should request documentation like power of attorney for representatives. A broader framework involves evaluating the relationship, obtaining patient consent when possible, and limiting sharing to minimum necessary to promote ethical care coordination.

Question 16

A 45-year-old male with hypertension and type 2 diabetes fills lisinopril and metformin at your pharmacy. His employer calls and says the patient is applying for a safety-sensitive job and asks whether the patient takes any medications that could affect performance. The patient has not provided authorization, and the request is not accompanied by a subpoena or other legal process. What is the best way to handle this confidentiality issue under HIPAA?

  1. Disclose the medication list because workplace safety concerns automatically permit disclosure to an employer
  2. Decline to disclose and request a valid, patient-signed HIPAA authorization or appropriate legal documentation before releasing any information (correct answer)
  3. Confirm only that the patient is a customer of the pharmacy, since that is not protected health information
  4. Fax the medication profile to the employer but remove diagnosis codes to comply with the minimum necessary standard

Explanation: This question examines HIPAA's restrictions on disclosing protected health information (PHI) to employers without authorization, emphasizing the principle of confidentiality in non-treatment contexts. The situational factor is the employer's request for medication details related to job performance without patient consent or legal compulsion, such as a subpoena. Option B is the best action as it protects patient privacy by requiring signed authorization or legal documentation, complying with HIPAA's safeguards against unauthorized disclosures. Option A is incorrect because workplace safety does not automatically permit disclosure without consent, breaching HIPAA; option C is suboptimal as confirming customer status could imply PHI and is not necessary; option D fails the minimum necessary standard by sharing more than needed and without authorization. Pharmacists should always verify the legitimacy of requests and limit disclosures to essential information. For ethical decision-making, use a framework of confirming the requestor's authority, assessing disclosure necessity, and documenting decisions to ensure compliance and patient trust.

Question 17

A 29-year-old female who is 10 weeks pregnant fills sertraline. A nurse from an obstetrics clinic calls requesting the patient's full medication profile "for chart completion," but the pharmacy has not received a release and the request is not clearly tied to treatment coordination. Under HIPAA, disclosures for treatment are permitted, but the minimum necessary and verification principles still apply. What is the most appropriate action for the pharmacist to take?

  1. Fax the entire medication profile immediately because any request from a clinic is automatically allowed
  2. Verify the caller's identity and role, confirm the request is for treatment, and disclose only the information reasonably necessary for the stated treatment purpose (correct answer)
  3. Refuse all disclosures to prescribers without a patient-signed authorization because HIPAA requires written consent for treatment disclosures
  4. Provide the information verbally but include the patient's social security number to ensure accurate matching

Explanation: This question tests HIPAA's allowance for treatment-related disclosures between providers, with requirements for verification and minimum necessary. The key factor is the nurse's request for a full profile without clear treatment tie or authorization, necessitating caution. Option B is the best choice as it verifies identity and purpose, limiting to necessary info for treatment, ensuring compliance. Option A over-discloses without checks; option C is incorrect as written consent is not always required for treatment; option D includes irrelevant sensitive data. Always callback to verify callers. A framework includes identity confirmation, purpose assessment, and documentation to facilitate ethical inter-provider collaboration.

Question 18

A 58-year-old male with HIV fills antiretroviral therapy at your pharmacy. A pharmacy technician tells you they recognized the patient from church and wants to warn others "for their safety." This presents an ethical dilemma related to confidentiality and professional conduct, governed by HIPAA and workplace privacy policies. What is the most appropriate action for the pharmacist to take?

  1. Allow the technician to share the information privately because it is motivated by concern for others
  2. Instruct the technician that disclosure is prohibited, reinforce confidentiality policies, and follow internal reporting/disciplinary procedures as appropriate (correct answer)
  3. Advise the technician to share only the diagnosis but not the patient's name to avoid a HIPAA violation
  4. Ask the patient to disclose their status to the church to reduce the technician's burden

Explanation: This question addresses professional conduct and HIPAA's prohibition on unauthorized disclosures, even when motivated by personal concerns. The key situational factor is the technician's intent to warn church members about the patient's HIV status, which constitutes an impermissible breach. Option B is the best choice as it reinforces confidentiality policies and addresses the issue internally, preventing violations and upholding ethical standards. Option A condones breaches for 'good' motives; option C still violates by partial disclosure; option D shifts burden inappropriately. Pharmacists should educate staff on privacy. A transferable framework includes immediate policy enforcement, training on HIPAA, and ethical reflection to maintain a confidential environment.

Question 19

A 19-year-old male college student fills stimulants for attention-deficit/hyperactivity disorder. Campus security calls requesting confirmation of the prescription because the student was found with pills in an unmarked container; they have no warrant or court order. You must decide whether to disclose protected health information under HIPAA and state law. What is the most appropriate action for the pharmacist to take?

  1. Confirm the prescription details to campus security because controlled substances require verification by any authority figure
  2. Decline to disclose without patient authorization or appropriate legal process, and suggest they contact the patient or obtain proper documentation (correct answer)
  3. Disclose only the prescriber name and quantity because that is not protected health information
  4. Provide the full dispensing record if campus security states it is for an investigation

Explanation: The principle examined is HIPAA's requirement for authorization or legal process before disclosing PHI to non-law enforcement entities like campus security. The key factor is the security team's request for prescription confirmation without a warrant, regarding stimulants found unmarked. Option B is the best action as it declines disclosure without proper authority, protecting privacy while suggesting alternatives. Option A grants undue access; option C wrongly assumes details are not PHI; option D requires formal process for investigations. Consult legal counsel if needed. A framework includes verifying authority level, refusing informal requests, and guiding to legal channels for ethical confidentiality handling.

Question 20

A 41-year-old female with bipolar disorder is prescribed lithium. Her spouse calls stating the patient is "acting strange" and asks whether she has been refilling her medication. The patient previously told the pharmacy she does not want her spouse involved in her care. Under HIPAA and ethical principles, what is the best way to handle this confidentiality issue?

  1. Disclose refill history to the spouse because mental health conditions are an exception to HIPAA
  2. Decline to disclose and encourage the spouse to have the patient contact the pharmacy or seek urgent medical evaluation if safety is a concern, sharing no protected health information without authorization (correct answer)
  3. Confirm whether the patient is refilling but not which medication, because refill status is not protected health information
  4. Disclose the full profile because spouses are automatically personal representatives regardless of patient preference

Explanation: The concept tested is HIPAA's protection of mental health information and the principle of respecting patient preferences against spousal involvement. The key factor is the patient's prior instruction not to involve her spouse, combined with the spouse's concern about behavior and adherence. Option B is the best action as it declines disclosure without authorization while suggesting safe alternatives, preserving confidentiality. Option A is incorrect as mental health is not an exception; option C wrongly assumes refill status is not PHI; option D misapplies personal representative rules. In practice, assess for urgent safety needs. Ethically, prioritize patient directives, offer resources, and document to guide confidentiality in relational contexts.