CEHRS Release of Information (ROI)

Question 1

Under HIPAA, what is the maximum number of days a covered entity has to respond to a patient's request to access their own medical records before an extension may be invoked?

Accepted Answer

30 days

Answer

HIPAA's Privacy Rule (45 CFR §164.524) requires a covered entity to act on a patient's access request within 30 days. One 30-day extension is permitted if the entity notifies the patient in writing of the reason for the delay.

Question 2

Which of the following is a REQUIRED element of a valid HIPAA authorization for the release of medical records?

Accepted Answer

A description of the information to be used or disclosed

Answer

A valid HIPAA authorization must include a description of the information to be used or disclosed, the name of the person/entity authorized to make the disclosure, the purpose of the disclosure, an expiration date or event, the patient's signature, and the date signed. The physician's signature and insurance number are not required elements.

Question 3

Under 42 CFR Part 2, which category of records receives STRICTER confidentiality protections than standard HIPAA rules?

Accepted Answer

Substance use disorder treatment records

Answer

42 CFR Part 2 provides heightened protections specifically for substance use disorder (SUD) treatment records. Unlike standard HIPAA records, SUD records generally cannot be re-disclosed without a separate written patient consent, even to other treating providers.

Question 4

A patient has died. Their surviving spouse requests a copy of the deceased patient's complete medical record. Who has the legal authority to authorize this release?

Accepted Answer

The personal representative or executor of the estate

Answer

Under HIPAA, a deceased patient's personal representative — typically the executor or administrator of the estate as defined by state law — has the authority to exercise the rights the patient would have had. The surviving spouse does not automatically have that authority unless they hold that legal designation.

Question 5

Which of the following scenarios permits a covered entity to release PHI WITHOUT a patient's written authorization?

Accepted Answer

A public health authority investigating a communicable disease outbreak

Answer

HIPAA's Privacy Rule includes a public health activities exception (45 CFR §164.512(b)) that allows covered entities to disclose PHI to authorized public health authorities for activities such as disease surveillance and outbreak investigation — no patient authorization required. The other scenarios all require patient authorization or a valid court order.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS Release of Information (ROI)