AHIMA Compliance and Legal 2 — Questions and Answers
Question 1: Under HIPAA, which of the following is considered a permissible disclosure without patient authorization?
- Marketing a health plan's products
- Disclosing PHI to public health authorities for disease surveillance (Correct answer)
- Sharing PHI with an employer about an employee's diagnosis
- Selling PHI to a pharmaceutical company
Correct answer: Disclosing PHI to public health authorities for disease surveillance
HIPAA permits disclosure of PHI to public health authorities for activities such as disease surveillance, investigation, and intervention without patient authorization.
Question 2: A covered entity experiences a breach affecting 600 individuals. Under HIPAA Breach Notification Rule, notification to the Secretary of HHS must occur within:
- 30 days of discovery
- 45 days of discovery
- 60 days of discovery (Correct answer)
- 60 days of year-end
Correct answer: 60 days of discovery
For breaches affecting fewer than 500 individuals, covered entities must notify HHS within 60 days of the end of the calendar year in which the breach was discovered, but breaches over 500 require notification within 60 days of discovery.
Question 3: Which legal doctrine holds that a patient's medical record created during treatment is the property of the healthcare facility?
- Res ipsa loquitur
- Respondeat superior
- Custodial ownership doctrine (Correct answer)
- Stare decisis
Correct answer: Custodial ownership doctrine
The custodial ownership doctrine establishes that while the physical medical record belongs to the healthcare facility, the patient retains the right to access the information contained within it.
Question 4: The HITECH Act strengthened HIPAA enforcement by introducing which of the following changes?
- Eliminating the minimum necessary standard
- Applying HIPAA obligations directly to business associates (Correct answer)
- Allowing patients to sell their own PHI
- Removing civil money penalties for small providers
Correct answer: Applying HIPAA obligations directly to business associates
HITECH extended direct HIPAA liability to business associates, requiring them to comply with applicable HIPAA Security Rule safeguards independently of their covered entity contracts.
Question 5: A hospital's compliance officer discovers that a coder has been upcoding DRGs for six months. Under the False Claims Act, which penalty could the hospital face per false claim?
- $500–$1,000
- $1,000–$5,000
- $13,946–$27,894 (adjusted annually) (Correct answer)
- $50,000–$100,000
Correct answer: $13,946–$27,894 (adjusted annually)
The False Claims Act imposes civil penalties per false claim; as of recent adjustments these range approximately $13,946 to $27,894 per claim plus treble damages.
Question 6: Which federal law specifically prohibits offering or accepting remuneration to induce referrals for services covered by Medicare or Medicaid?
- Stark Law
- Anti-Kickback Statute (Correct answer)
- False Claims Act
- EMTALA
Correct answer: Anti-Kickback Statute
The Anti-Kickback Statute (42 USC 1320a-7b) prohibits knowingly offering, paying, soliciting, or receiving anything of value to induce or reward referrals of federal healthcare program business.
Question 7: When state law provides greater privacy protections for a patient's mental health records than HIPAA, a covered entity must:
- Follow HIPAA because federal law preempts state law
- Follow the state law because it is more protective (Correct answer)
- Follow whichever law the patient chooses
- Report the conflict to the OCR for resolution
Correct answer: Follow the state law because it is more protective
HIPAA sets a federal floor for privacy; when state law is more stringent (more protective of patient rights), the covered entity must comply with the stricter state standard.
AHIMA Compliance and Legal 2
Under HIPAA, which of the following is considered a permissible disclosure without patient authorization?