MN690 Unit 7 consent and privacy plan example

Consent and Privacy Plan for a Rural Virtual Clinic: Both Ends of the Connection

[Student Name]

Purdue University Global

MN690: Telehealth Application

Unit 7 Assignment

[Instructor Name]

[Date]

The clinic, staff and scenario are composites written as a model document. Federal rules and guidance cited are real; state requirements must be checked separately.

The Scenario

During a video visit, a composite 38-year-old woman answers "yes" and "no" to screening questions in a flat voice. Midway through, a door opens behind the camera and a man's voice asks who she is talking to. She says, "It's just the doctor's office," and keeps her answers short. The nurse practitioner cannot see who else is in the room. The plan below is written so that a visit like this one protects the patient rather than exposing her.

Part 1: Consent

Script, read at the start of the first telehealth visit and summarized at later ones: "This visit is happening by video. I can see and hear you, but I can't examine you the way I would in the clinic, so if I need to, I'll ask you to come in. You can choose an in-person visit instead at any time. We use a secure system, and this visit is not recorded. Is it all right to go ahead?"

Documentation line for the note: "Verbal consent to telehealth obtained after explanation of modality, limits of remote examination, option of in-person care, privacy protections and that the visit is not recorded." State requirements for written or specific consent differ and are checked for each state where patients are located rather than summarized here.

Part 2: The Patient's End

Privacy check at the start of every visit: "Are you somewhere you can talk privately right now?" and "Is anyone else in the room with you?" If the answer suggests others are present, the clinician asks whether the patient wants them there.

Sensitive questions only in privacy. The clinic does not ask screening questions about intimate partner violence, substance use or safety at home when another adult may be listening, because a question overheard by an abuser can put the patient at greater risk than not asking. Screening for intimate partner violence is recommended for women of reproductive age, but it depends on privacy to be safe (US Preventive Services Task Force, 2018).

Closed questions when others may be present: "Would you like to schedule a separate time to talk?" can be answered yes or no without revealing anything.

Safe phrase: at the start of any visit where privacy is uncertain, the clinician can say, "If you need to end the call for any reason, you can just say you have to go check on something," and the clinician then ends the visit and follows up through a channel the patient has previously identified as safe, such as a call to a work number.

Adolescents: part of every adolescent visit is held with the parent out of the room, following the clinic's confidentiality policy. Interpreters: professional interpreters join through the platform; family members are not used as interpreters for sensitive topics.

Part 3: The Clinician's End

Staff who work from home conduct visits in a room with a closed door, wear headphones, use a screen that locks automatically when they step away and keep smart speakers and voice assistants out of the room. They do not conduct visits from public spaces or shared vehicles. Paper notes are not used; documentation goes directly into the record.

Part 4: The Platform

During the COVID-19 public health emergency, the HHS Office for Civil Rights announced that it would not penalize good-faith use of non-public-facing communication apps for telehealth. That enforcement discretion ended when the emergency expired on May 11, 2023, with a transition period for compliance that ended August 9, 2023 (U.S. Department of Health and Human Services, Office for Civil Rights, 2023). The clinic therefore uses only a telehealth platform whose vendor has signed a business associate agreement, as the HIPAA rules require for vendors that handle protected health information on a covered entity's behalf (45 C.F.R. § 164.504, 2024).

Recording, Screenshots and Photographs

Visits are not recorded. Patients are told this in the consent script and are asked not to record the visit themselves if others in the home could later access the recording. Clinicians do not take screenshots of the video; when an image is clinically needed, such as a rash, the patient sends a photograph through the portal, where it is stored in the record with the date and a description.

If Privacy Is Breached

If a clinician realizes during a visit that someone unexpected is listening, she stops discussing sensitive information, uses the safe phrase if one was agreed and documents only that the visit was ended early for privacy reasons, without speculation. If protected health information is disclosed through the platform or a device, the clinician reports it the same day to the clinic's privacy officer, who assesses whether it is a reportable breach under HIPAA.

Review

The plan is reviewed each year and after any privacy incident. Staff complete a short annual training that includes practicing the safe phrase and the privacy check.

References

45 C.F.R. § 164.504 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504

U.S. Department of Health and Human Services, Office for Civil Rights. (2023). HHS Office for Civil Rights announces the expiration of COVID-19 public health emergency HIPAA notifications of enforcement discretion. https://www.hhs.gov/about/news/2023/04/11/hhs-office-for-civil-rights-announces-expiration-covid-19-public-health-emergency-hipaa-notifications-enforcement-discretion.html

US Preventive Services Task Force. (2018). Screening for intimate partner violence, elder abuse, and abuse of vulnerable adults: US Preventive Services Task Force final recommendation statement. JAMA, 320(16), 1678-1687. https://doi.org/10.1001/jama.2018.14741