Absent patient authorization or a specific HIPAA-permitted exception, decline to share information — including whether the patient is seen at the clinic — and offer to take the mother's contact information so you can discuss the request with the patient.
Correct. Without a signed release of information or a specific HIPAA exception, the PMHNP cannot disclose any PHI — including confirming or denying that the individual is a patient at the clinic. The appropriate response is to decline disclosure, take the caller's contact information, and then discuss the mother's request with the patient at the next opportunity, allowing the patient to decide whether to authorize information sharing.