Under HIPAA, if a client requests their records through an unsecured method like email, what must the clinician do?

• A. Inform the client of risks and alternatives and attempt to limit risk while complying with HIPAA.
• B. Refuse the request.
• C. Automatically share the records via unsecured email.
• D. Delete all prior communications.

Answer: (A)

When a client asks to receive their records through an unsecured channel, you must inform them of the risks of transmitting PHI via that method and discuss safer alternatives (such as a secure patient portal, encrypted email, or password-protected files) and then take reasonable steps to limit risk while still complying with HIPAA. This approach protects patient rights to access while applying appropriate safeguards, rather than refusing the request or sending information without protection. Document the discussion and the chosen method.