AAMA CMA Practice Question

The correct action is to obtain a specific, written authorization from the patient before releasing the information. A patient's HIV status is considered highly sensitive protected health information (PHI) and is often subject to stricter state and federal protection laws than other medical information. A general consent for release of records may not be sufficient; a specific authorization that explicitly mentions the release of HIV-related information is required for disclosure to a third party like an insurance company. Releasing the records without this specific consent would be a violation of the patient's privacy rights. Redacting the information may not fulfill the insurance company's request, and the primary step is always to seek patient consent.