What are the basic privacy requirements MA podiatrists must follow regarding patient records?

• A. Protect patient health information under HIPAA and MA privacy laws; limit access to authorized personnel and disclose only as permitted by law
• B. Share patient information with family without consent
• C. Store patient records off-site with no access controls
• D. Only keep records for 6 months

Answer: (A)

Privacy and confidentiality of patient records require guarding health information under HIPAA and Massachusetts privacy laws, limiting who can access records, and restricting disclosures to what the law allows. In practice, podiatrists must implement safeguards so that only staff with a legitimate need—such as for treatment, payment, or office operations—can view or handle records. Disclosures should occur only with patient authorization or as permitted or required by law, which covers typical situations like coordinated care, billing, public health reporting, or other mandated disclosures. Patients also have rights to access their records and request amendments, and records must be stored securely and kept for the legally required retention period. The other options miss these protections: sharing information with family without consent breaks confidentiality, off-site storage with no access controls creates a serious security risk, and keeping records for only six months likely violates retention requirements.