NR 583NP Week 7 Privacy and Access Memo Example

Memorandum

To: Privacy Officer and IT Applications Manager

From: RN care coordinator, Linden Avenue site

Date: 9 November 2026

Re: Front desk access to completed PHQ-9 answers, including item 9, must be removed by 30 November

Situation

Since the tablet PHQ-9 went live at Westgate, front desk staff can open each patient's completed questionnaire, including the answer to item 9 about thoughts of self-harm, from the check-in screen. I found this on 4 November when a front desk staff member mentioned a patient's answer to me. The cause is the build: the tablet's security role for front desk users was copied from the MA role. No policy change was made; the system simply permits more than policy allows.

The Governing Rule

The HIPAA Privacy Rule (U.S. Department of Health and Human Services [HHS], 2024a) sets a minimum necessary standard at 45 CFR 164.502(b): when staff use a patient's record, the practice must keep that use to what the task requires. Under 45 CFR 164.514(d)(2), the practice must identify the classes of workforce who need access, the categories of information each needs and any conditions on that access. The treatment exception in 164.502(b)(2)(i) applies to disclosures to or requests by a provider for treatment; as I read it, it does not remove the requirement to set role-based access for internal uses by staff who are not treating the patient. The privacy officer should confirm this reading.

Applied here: front desk staff do not treat patients. Their task with the questionnaire is to hand out the tablet and confirm it was completed. They need its status, not its answers.

The practice's own access policy, in section 3.2 as revised in the spring of last year, already limits front desk users to demographics, scheduling, insurance and visit status. The tablet build has drifted from that policy, and the policy is correct.

Access Mapped Against Tasks

Front desk: hand out and collect tablet; confirm completion. Needs: "complete," "incomplete" or "declined." Does not need: scores or answers.

MA: room the patient; respond to the item 9 flag. Needs: total score, item 9 answer and the flag. Does not need: score history beyond the past year.

NP: diagnose and treat. Needs: all answers and full history.

BHC: assess and treat. Needs: all answers and full history.

Care coordinator: follow up positive screens. Needs: total score, date and contact history; item 9 answer, to prioritize calls.

Billing and quality staff: report the measure. Needs: whether screened, total score category and whether a plan was documented, through the quality report rather than the chart.

Override and the Audit Behind It

Front desk staff should have no override for questionnaire answers; no front desk task requires them. If a front desk user is acting as an MA at Hilltop after 17:00, they log in under the MA role, which the evening schedule already provides.

For all roles, access to PHQ-9 answers is already logged by the record system. Under the Security Rule (U.S. Department of Health and Human Services, 2024b), the practice must keep audit controls on systems holding electronic patient information (45 CFR 164.312(b)) and must look at what those logs show on a regular schedule (45 CFR 164.308(a)(1)(ii)(D)). I ask that the privacy officer review front desk access to PHQ-9 results at Westgate between 4 January and the date of the fix, to find out how many records were opened and whether any patient should be told.

Why It Matters for This Questionnaire

Item 9, the last question on the form, covers passive death wishes and urges to injure oneself during the prior fortnight. A positive answer is among the most sensitive facts the practice records, and research on the PHQ-9 suggests it identifies patients at raised risk of a later suicide attempt (Simon et al., 2013). Patients answer it on a tablet because they were told their clinician would see it. A front desk colleague, who may be a neighbor, seeing that answer is the kind of exposure the minimum necessary standard is meant to prevent, and it could make patients less willing to answer honestly at the next visit.

Who Was Affected

The tablet went live at Westgate on 4 January. Since then about 7,800 adult questionnaires have been completed there, about 300 with a positive item 9. I do not know how many were opened by front desk staff; the access review requested below will tell us.

What This Is Not

Notes written by the BHC in the shared record are not psychotherapy notes under 45 CFR 164.501, which applies only to notes kept separate from the medical record. They do not need special authorization to be read by the treating team. This memo asks for no change to BHC note access.

What I Am Asking For

I ask that the IT applications manager change the front desk tablet role to show completion status only, at all four sites, by 30 November 2026; that the privacy officer complete the access review of the past ten months by 15 December; and that, before any further role is copied during the remaining rollout, the IT applications manager compare it against section 3.2 of the access policy.

References

Simon, G. E., Rutter, C. M., Peterson, D., Oliver, M., Whiteside, U., Operskalski, B., & Ludman, E. J. (2013). Does response on the PHQ-9 Depression Questionnaire predict subsequent suicide attempt or suicide death? Psychiatric Services, 64(12), 1195-1202. https://doi.org/10.1176/appi.ps.201200587

U.S. Department of Health and Human Services. (2024a). Standards for privacy of individually identifiable health information, 45 C.F.R. Part 164, Subpart E. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E

U.S. Department of Health and Human Services. (2024b). Security standards for the protection of electronic protected health information, 45 C.F.R. Part 164, Subpart C. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C