HIPAA Privacy Rule Compliance Flashcards

Under HIPAA's Right of Access, what is the maximum fee a covered entity may charge for electronic copies of PHI maintained electronically?

Answer: A fee not exceeding $6.50 per request under the safe harbor

The OCR established a $6.50 safe harbor fee for providing individuals with electronic copies of their PHI when maintained electronically.

Which of the following is considered a permissible purpose for using or disclosing PHI without patient authorization under the HIPAA Privacy Rule?

Answer: Public health activities such as disease reporting

Public health activities, including reporting diseases to public health authorities, are a permissible use of PHI under 45 CFR §164.512(b).

A Notice of Privacy Practices (NPP) must include which of the following elements?

Answer: A description of the types of uses and disclosures a covered entity may make

The NPP must describe the types of uses and disclosures the covered entity is permitted or required to make, as required by 45 CFR §164.520.

Under HIPAA, when may a covered entity use PHI for fundraising purposes?

Answer: When demographic information and dates of service are used and the patient is given an opportunity to opt out

Covered entities may use limited PHI (demographics and dates of service) for fundraising if the NPP discloses this and patients are given a clear opportunity to opt out.

Which of the following best describes the HIPAA concept of 'treatment, payment, and health care operations' (TPO)?

Answer: Permitted purposes for PHI use and disclosure that generally do not require patient authorization

TPO represents the core permitted purposes under the Privacy Rule where covered entities can use and disclose PHI without patient authorization.

Under the HIPAA Privacy Rule, a covered entity must designate which role to be responsible for developing and implementing its privacy policies?

Answer: Privacy Officer

The HIPAA Privacy Rule at 45 CFR §164.530(a) requires covered entities to designate a Privacy Officer responsible for privacy policy development and implementation.