Tammy mass emailing all clients' rosters without consent raises privacy concerns under which regulation?

• A. Consent is implied when emailing families
• B. CC reveals names of people receiving services without consent, violating HIPAA
• C. This practice is permitted by BACB guidelines
• D. Privacy is not mandatory in mental health services

Answer: (B)

The situation tests how protected health information is handled under privacy regulations. Sharing a roster by mass emailing clients exposes identifiable health information (names and service details) to people who aren’t authorized to see it. HIPAA’s Privacy Rule governs when PHI can be disclosed and requires proper authorization for disclosures outside the covered entity’s routine operations. Using CC to reveal who receives services makes the disclosure even broader and less secure, which is exactly the kind of violation HIPAA aims to prevent. While ethics guidance from the BACB emphasizes confidentiality, it does not override HIPAA requirements, and privacy is mandatory in mental health services. Therefore, this scenario raises concerns under HIPAA.