How should a facility handle a resident's medical records under HIPAA?

• A. Disclosures may be released to any outside party without notification.
• B. Residents do not have the right to access their records.
• C. Health information must be protected and disclosures limited only to designated authorities.
• D. Residents have the right to access records, request amendments, and health information should be protected and disclosures limited.

Answer: (D)

Protecting residents' privacy and controlling access to health information is the key idea here. Under HIPAA, health information is protected as PHI, and covered entities must safeguard it and disclose it only to people or groups with a legitimate need to know—typically designated authorities involved in the resident’s care or as otherwise authorized by the resident or by law. Residents have the right to access their own records and to request amendments if they believe something is inaccurate. Facilities must respond to those requests in line with HIPAA requirements, ensuring access is provided and amendments are considered or denied with proper justification. This combination—protecting the information, limiting disclosures to appropriate parties, and affirming residents’ rights to access and amend—best fits the standard.

The other statements don’t fit because disclosures should not be released to outside parties without proper notification and authorization, residents do have the right to access their records, and while protection and limited disclosures are essential, they must be paired with the resident’s rights to access and amend their records.