Practice Test Geeks(AHIMA) American Health Information Management Association Practice Test
← All AHIMA Flashcard Decks

AHIMA Release of Information Flashcards

6 cards from real AHIMA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 AHIMA Release of Information flashcards as text

  1. What federal law primarily governs the release of protected health information (PHI) by covered entities in the US?

    Answer: The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule

    The HIPAA Privacy Rule (45 CFR Parts 160 and 164) is the primary federal regulation governing disclosure of PHI by covered entities and business associates.

  2. What elements are required in a valid HIPAA authorization for release of PHI?

    Answer: Description of information, purpose, recipient, expiration, patient signature with date, and right to revoke

    A valid HIPAA authorization must include core elements such as a description of the PHI, the purpose of disclosure, the recipient, an expiration date/event, patient signature, and notice of the right to revoke.

  3. Under HIPAA, what is the 'minimum necessary' standard for release of information?

    Answer: Limiting PHI disclosures to the least amount necessary to accomplish the intended purpose

    The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI disclosure to what is needed for the specific purpose of the request.

  4. What is the timeframe a covered entity has to provide a patient access to their own PHI under the HIPAA Access Rule?

    Answer: 30 calendar days, with one 30-day extension if needed

    HIPAA requires covered entities to provide patient access to PHI within 30 calendar days of the request, with the option of a single 30-day extension with written notice.

  5. Which type of PHI disclosure does NOT require a patient's authorization under HIPAA?

    Answer: Release for treatment, payment, or healthcare operations (TPO)

    HIPAA permits covered entities to disclose PHI without patient authorization for treatment, payment, and healthcare operations purposes.

  6. What is a 'breach' under HIPAA's Breach Notification Rule?

    Answer: An impermissible use or disclosure of unsecured PHI that compromises its security or privacy

    A HIPAA breach is an impermissible acquisition, access, use, or disclosure of unsecured PHI that is presumed to compromise the privacy or security of the information unless the covered entity demonstrates low probability of compromise.