Free PMHNP board review · 10 practice questions

Confidentiality & Tarasoff Practice Questions

Work through privacy rules, record requests, and safety disclosures.

Review the topic guide →

Independent educational practice, not official ANCC exam items. Not affiliated with or endorsed by ANCC. Not legal advice. Apply current law, your scope of practice, and your organization’s procedures. Sources reviewed October 8, 2026.

Choose an answer, then review the why

Pick your best answer, then open Show answer and explanation to review the reasoning for every option.

Self-paced · No login · Answers aren’t saved or scored. Open and close explanations as often as you like.

Question 1 of 10

A PMHNP receives an attorney-issued subpoena for an adult patient’s ordinary medical record in a civil lawsuit. There is no court order, patient authorization, or evidence of notice or a protective order. What is the best next step?

  1. A. Immediately send the entire chart
  2. B. Route the request for privacy/legal review and verify the required disclosure conditions
  3. C. Ignore the subpoena because attorneys cannot request records
  4. D. Send the chart after removing the patient’s name
Show answer and explanation for question 1

Correct answer: B. Route the request for privacy/legal review and verify the required disclosure conditions

A subpoena does not automatically establish a lawful disclosure. Verify the legal process, applicable privilege and privacy protections, and required assurances before responding. Meet response deadlines through the appropriate review process.

Why the other answers are less appropriate

  • A. Immediately send the entire chart: An attorney’s subpoena alone does not authorize unrestricted release.
  • C. Ignore the subpoena because attorneys cannot request records: Ignoring legal process can create additional problems; review and respond appropriately.
  • D. Send the chart after removing the patient’s name: Removing a name does not necessarily de-identify a record or resolve the legal request.

Question 2 of 10

A valid court order requests only medication-administration records for specified dates. Privacy review confirms disclosure is lawful and no additional protection blocks it. What should the PMHNP release under that order?

  1. A. The complete psychiatric history
  2. B. All records mentioning medication
  3. C. Only the information described in the order
  4. D. Nothing unless the patient also signs an authorization
Show answer and explanation for question 2

Correct answer: C. Only the information described in the order

HIPAA permits disclosure under a court order within its specified scope. The order is not permission to send unrelated records.

Why the other answers are less appropriate

  • A. The complete psychiatric history: The request does not encompass the complete history.
  • B. All records mentioning medication: Records outside the specified dates or categories exceed the order.
  • D. Nothing unless the patient also signs an authorization: HIPAA does not invariably require a separate authorization for a valid court-ordered disclosure.

Question 3 of 10

In October 2026, a federally assisted Part 2 program wants to share ordinary SUD treatment records for future treatment, payment, and health care operations. Which consent approach can the current federal rule permit?

  1. A. A compliant single consent covering future treatment, payment, and health care operations
  2. B. A new signed consent for every individual billing claim
  3. C. No consent because Part 2 no longer applies
  4. D. One consent that also automatically authorizes use against the patient in court
Show answer and explanation for question 3

Correct answer: A. A compliant single consent covering future treatment, payment, and health care operations

The updated Part 2 rule permits a single TPO consent. Compliance was required by February 16, 2026. Separate protections still apply to SUD counseling notes and proceedings against the patient.

Why the other answers are less appropriate

  • B. A new signed consent for every individual billing claim: The rule allows an appropriately scoped single TPO consent.
  • C. No consent because Part 2 no longer applies: Part 2 protections remain in effect.
  • D. One consent that also automatically authorizes use against the patient in court: TPO consent does not automatically authorize proceedings against the patient.

Question 4 of 10

A HIPAA-covered hospital receives Part 2 records under a valid TPO consent. A prosecutor later requests them for a case against the patient. What is the best response?

  1. A. Disclose them because any HIPAA recipient may use them for any purpose
  2. B. Treat the TPO consent as consent to prosecution
  3. C. Send a summary instead of the records to avoid Part 2
  4. D. Pause disclosure and verify the specific consent or qualifying Part 2 court process required for this use
Show answer and explanation for question 4

Correct answer: D. Pause disclosure and verify the specific consent or qualifying Part 2 court process required for this use

Receipt under TPO consent does not remove the special restriction on use in proceedings against the patient. Appropriate legal review must confirm Part 2 requirements, including the legal mandate needed to compel disclosure.

Why the other answers are less appropriate

  • A. Disclose them because any HIPAA recipient may use them for any purpose: HIPAA-recipient status does not erase Part 2’s proceedings protection.
  • B. Treat the TPO consent as consent to prosecution: TPO authorization does not cover this consequential purpose.
  • C. Send a summary instead of the records to avoid Part 2: A patient-identifying summary does not bypass the restriction.

Question 5 of 10

Another clinician requests a therapist’s separately maintained notes analyzing the content of counseling sessions. There is no emergency or other applicable exception. Which statement best applies under HIPAA?

  1. A. All psychiatric progress notes receive the same special status
  2. B. A patient authorization is generally needed to disclose these psychotherapy notes to another treating clinician
  3. C. Treatment always permits disclosure of the separate notes without authorization
  4. D. The notes lose protection if they are electronic
Show answer and explanation for question 5

Correct answer: B. A patient authorization is generally needed to disclose these psychotherapy notes to another treating clinician

HIPAA’s psychotherapy-note category is narrow and generally requires authorization for disclosure to another treating clinician. Ordinary medication and treatment-plan information is outside that special definition.

Why the other answers are less appropriate

  • A. All psychiatric progress notes receive the same special status: Special status depends on content and separate maintenance, not a psychiatric label.
  • C. Treatment always permits disclosure of the separate notes without authorization: The usual treatment pathway does not generally remove this authorization requirement.
  • D. The notes lose protection if they are electronic: Electronic format does not remove protection.

Question 6 of 10

An adult patient with capacity invites a spouse into a medication visit and agrees that the PMHNP may discuss dosing and side effects. No stricter law applies. What does HIPAA permit?

  1. A. Discussion of information directly relevant to the spouse’s involvement in care
  2. B. Release of all past therapy notes to the spouse
  3. C. Disclosure only after a judge signs an order
  4. D. No discussion unless the spouse is a legal guardian
Show answer and explanation for question 6

Correct answer: A. Discussion of information directly relevant to the spouse’s involvement in care

HIPAA permits relevant communication with a person involved in care when a capable patient agrees or does not object. Match the discussion to the person’s role.

Why the other answers are less appropriate

  • B. Release of all past therapy notes to the spouse: Agreement to discuss medication is not blanket access to all sensitive records.
  • C. Disclosure only after a judge signs an order: A court order is unnecessary for this permitted communication.
  • D. No discussion unless the spouse is a legal guardian: Involvement in care does not require guardianship.

Question 7 of 10

A capable adult patient objects to sharing information with a parent. The parent calls to report recent behavioral changes. There is no currently identified disclosure exception. What should the PMHNP do?

  1. A. Refuse to hear anything unless the patient signs a release
  2. B. Confirm the diagnosis because the caller is a parent
  3. C. Listen to the concerns without disclosing the patient’s confidential information
  4. D. Promise the parent unrestricted access to future notes
Show answer and explanation for question 7

Correct answer: C. Listen to the concerns without disclosing the patient’s confidential information

HIPAA does not prevent receiving collateral information. Listening can inform assessment while the clinician respects limits on disclosure.

Why the other answers are less appropriate

  • A. Refuse to hear anything unless the patient signs a release: Receiving information is different from disclosing it.
  • B. Confirm the diagnosis because the caller is a parent: Family status alone does not override the capable adult’s objection.
  • D. Promise the parent unrestricted access to future notes: There is no basis for unrestricted future access.

Question 8 of 10

A patient describes a credible plan to seriously injure a named coworker later today. The PMHNP believes emergency responders can prevent the harm. Under HIPAA, which disclosure is permissible when consistent with applicable law and ethics?

  1. A. Posting the full record publicly so others can help
  2. B. Sharing only after the patient agrees
  3. C. Sharing nothing until the threat has been carried out
  4. D. Sharing information necessary to lessen the serious and imminent threat with people reasonably able to help
Show answer and explanation for question 8

Correct answer: D. Sharing information necessary to lessen the serious and imminent threat with people reasonably able to help

HIPAA permits a good-faith protective disclosure for a serious and imminent threat to people reasonably able to reduce it. Immediate safety measures and applicable state duties also need attention.

Why the other answers are less appropriate

  • A. Posting the full record publicly so others can help: Public release of the complete chart is not a proportionate protective disclosure.
  • B. Sharing only after the patient agrees: This exception does not depend on patient permission.
  • C. Sharing nothing until the threat has been carried out: Waiting for injury defeats the preventive purpose of the exception.

Question 9 of 10

During orientation, a new PMHNP says, “HIPAA creates the same mandatory Tarasoff warning procedure in every state.” Which correction is best?

  1. A. HIPAA permits certain safety disclosures; applicable state law determines any duty to warn or protect
  2. B. Every threat requires a public warning under federal law
  3. C. Tarasoff eliminates confidentiality whenever a patient is angry
  4. D. HIPAA prohibits protective disclosures in states without a mandatory warning statute
Show answer and explanation for question 9

Correct answer: A. HIPAA permits certain safety disclosures; applicable state law determines any duty to warn or protect

Separate permission to disclose from a legal duty to act. State duties vary; use the applicable jurisdiction’s law and seek timely consultation without delaying urgent safety action.

Why the other answers are less appropriate

  • B. Every threat requires a public warning under federal law: There is no single nationwide public-warning requirement.
  • C. Tarasoff eliminates confidentiality whenever a patient is angry: Anger alone does not erase confidentiality.
  • D. HIPAA prohibits protective disclosures in states without a mandatory warning statute: HIPAA’s permitted safety disclosure is not limited to states with mandatory warning statutes.

Question 10 of 10

An insurer requests information to process a claim for routine psychiatric care. The record is ordinary PHI, not psychotherapy notes or Part 2 records, and no stricter rule applies. What is the best HIPAA approach?

  1. A. Refuse because payment always requires a separate authorization
  2. B. Send all available records for convenience
  3. C. Disclose information reasonably limited to what is needed for payment
  4. D. Apply no privacy safeguards because the recipient is an insurer
Show answer and explanation for question 10

Correct answer: C. Disclose information reasonably limited to what is needed for payment

HIPAA generally permits payment disclosures without authorization, with the minimum-necessary standard applying. Determine what supports the payment purpose.

Why the other answers are less appropriate

  • A. Refuse because payment always requires a separate authorization: A separate authorization is not generally required for ordinary payment disclosures.
  • B. Send all available records for convenience: Convenience does not justify an unnecessarily broad release.
  • D. Apply no privacy safeguards because the recipient is an insurer: Payment disclosures remain subject to privacy safeguards.

Turn missed questions into focused review

Identify the clue that supports the best answer, then explain why the closest alternative is less appropriate. Return to the linked article to revisit a missed concept. This short practice set does not predict certification performance.

Frequently asked questions

Do these questions teach one nationwide Tarasoff rule?

No. Federal privacy permission and state duties are separate. Questions identify the federal framework or direct you to the applicable state law.

Are the Part 2 questions based on the updated rule?

Yes. They use the consent framework with a February 16, 2026 compliance date, including the continuing protection for proceedings against the patient.