CEHRS Release of Information (ROI) — Questions and Answers
Question 1: Under HIPAA, what is the maximum number of days a covered entity has to respond to a patient's request to access their own medical records before an extension may be invoked?
- 15 days
- 30 days (Correct answer)
- 60 days
- 90 days
Correct answer: 30 days
HIPAA's Privacy Rule (45 CFR §164.524) requires a covered entity to act on a patient's access request within 30 days. One 30-day extension is permitted if the entity notifies the patient in writing of the reason for the delay.
Question 2: Which of the following is a REQUIRED element of a valid HIPAA authorization for the release of medical records?
- The patient's insurance policy number
- A description of the information to be used or disclosed (Correct answer)
- The signature of the treating physician
- The date of the patient's next scheduled appointment
Correct answer: A description of the information to be used or disclosed
A valid HIPAA authorization must include a description of the information to be used or disclosed, the name of the person/entity authorized to make the disclosure, the purpose of the disclosure, an expiration date or event, the patient's signature, and the date signed. The physician's signature and insurance number are not required elements.
Question 3: Under 42 CFR Part 2, which category of records receives STRICTER confidentiality protections than standard HIPAA rules?
- Pediatric immunization records
- Substance use disorder treatment records (Correct answer)
- Workers' compensation injury reports
- Radiology imaging files
Correct answer: Substance use disorder treatment records
42 CFR Part 2 provides heightened protections specifically for substance use disorder (SUD) treatment records. Unlike standard HIPAA records, SUD records generally cannot be re-disclosed without a separate written patient consent, even to other treating providers.
Question 4: A patient has died. Their surviving spouse requests a copy of the deceased patient's complete medical record. Who has the legal authority to authorize this release?
- The patient's primary care physician
- Any immediate family member aged 18 or older
- The personal representative or executor of the estate (Correct answer)
- The hospital's risk management department
Correct answer: The personal representative or executor of the estate
Under HIPAA, a deceased patient's personal representative — typically the executor or administrator of the estate as defined by state law — has the authority to exercise the rights the patient would have had. The surviving spouse does not automatically have that authority unless they hold that legal designation.
Question 5: Which of the following scenarios permits a covered entity to release PHI WITHOUT a patient's written authorization?
- A patient's employer requesting attendance-verification records
- A marketing firm requesting patient contact information for a health survey
- A public health authority investigating a communicable disease outbreak (Correct answer)
- An attorney requesting records for a civil personal-injury lawsuit
Correct answer: A public health authority investigating a communicable disease outbreak
HIPAA's Privacy Rule includes a public health activities exception (45 CFR §164.512(b)) that allows covered entities to disclose PHI to authorized public health authorities for activities such as disease surveillance and outbreak investigation — no patient authorization required. The other scenarios all require patient authorization or a valid court order.
Question 6: What is the primary purpose of the HIPAA 'minimum necessary' standard as applied to release of information?
- To ensure patients receive the least invasive treatment available
- To limit PHI disclosures to the smallest amount reasonably needed to accomplish the intended purpose (Correct answer)
- To minimize the per-page fee charged for copying medical records
- To reduce the total number of ROI requests a facility must process annually
Correct answer: To limit PHI disclosures to the smallest amount reasonably needed to accomplish the intended purpose
The minimum necessary standard (45 CFR §164.502(b)) requires covered entities to make reasonable efforts to disclose only the PHI needed to accomplish the purpose of the disclosure. For example, releasing a full chart when only lab results were requested would violate this standard.
CEHRS Release of Information (ROI)
Under HIPAA, what is the maximum number of days a covered entity has to respond to a patient's request to access their own medical records before an extension may be invoked?