Which statement about HIPAA privacy is NOT correct?

• A. Primary healthcare providers employed at the facility where a client receives treatment can legally access any client's health information at any time.
• B. Health related information revealed by a client to healthcare personnel must be kept confidential.
• C. The client has the right to access personal healthcare records and to obtain copies of those records.
• D. A client's information can be revealed only with the client's permission, or when the primary healthcare provider or facility is required by law to do so.

Answer: (A)

The key idea is that access to a patient’s protected health information is restricted to those who need it to provide care, and only the minimum necessary information should be seen. The statement that primary healthcare providers at the same facility can legally access any client’s health information at any time contradicts this principle. HIPAA requires that access be limited to those involved in the patient’s treatment and only to the extent needed to do their job, protecting confidentiality and reducing unnecessary exposure.

The other statements align with HIPAA: information shared with healthcare personnel is kept confidential, patients have the right to access and obtain copies of their records, and disclosures can occur with the patient’s permission or when required by law. There are also allowed disclosures without explicit patient consent in certain circumstances (such as for treatment, payment, or healthcare operations or as mandated by law), but blanket access to all patients’ records at any time is not permitted.