HIPAA and Scope of Practice Flashcards
7 cards from real AAMA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 HIPAA and Scope of Practice flashcards as text
A medical assistant witnesses a colleague improperly accessing a celebrity patient's records out of curiosity. The medical assistant should:
Answer: Report the incident to the Privacy Officer or supervisor
Unauthorized access to PHI is a HIPAA violation that must be reported to the Privacy Officer regardless of who commits it.
Which of the following is a permissible disclosure of PHI without patient authorization under HIPAA?
Answer: Reporting a gunshot wound to law enforcement as required by state law
HIPAA permits disclosure to law enforcement without authorization when required by state law, such as mandatory reporting of gunshot wounds.
The concept of 'incidental disclosure' under HIPAA refers to:
Answer: An unavoidable minor disclosure that occurs despite reasonable safeguards
Incidental disclosure is an unintentional, minor exposure of PHI that occurs despite reasonable precautions, and is permitted under HIPAA.
A medical assistant may perform phlebotomy independently ONLY if:
Answer: State law and employer policy permit it within their scope
Whether a medical assistant may perform phlebotomy independently depends on state law and employer-defined scope of practice policies.
Under HIPAA, a covered entity must provide a patient with a Notice of Privacy Practices (NPP):
Answer: At the first service encounter and upon any material revision
HIPAA requires the NPP to be provided at the first service encounter and whenever it is materially revised.
Which of the following would constitute practicing medicine beyond a medical assistant's scope?
Answer: Independently diagnosing a patient's rash without physician direction
Diagnosis is exclusively within the physician's scope of practice; medical assistants are prohibited from independently diagnosing patients.
A breach of unsecured PHI affecting 500 or more individuals in a state requires notification to:
Answer: Affected patients, HHS, and prominent local media outlets
Large breaches require notifying affected individuals, HHS, and prominent media in the affected state within 60 days of discovery.