HIPAA Privacy Rule Compliance Flashcards

Under HIPAA, which of the following is a permitted disclosure of PHI to family members WITHOUT patient authorization?

Answer: Sharing information directly relevant to a family member's involvement in care when the patient has not objected

Under 45 CFR §164.510(b), a covered entity may share PHI with family members involved in care if the patient has not objected and the information is directly relevant to that involvement.

A covered entity wishes to use patient PHI for a research study. Under HIPAA, which of the following is NOT a valid pathway to use PHI for research?

Answer: Purchasing de-identified data from a vendor and re-linking it to patient records

Re-linking de-identified data to patient records defeats the purpose of de-identification and is not a permissible research pathway under HIPAA.

Under HIPAA's right to request restrictions, when is a covered entity REQUIRED to agree to a patient's restriction request?

Answer: When the patient requests restriction on disclosure to a health plan for services the patient paid out-of-pocket in full

Under the HITECH-amended HIPAA rules, covered entities must honor restrictions when the patient has paid out-of-pocket in full and requests the restriction to a health plan.

What is the HIPAA standard for de-identification using the Expert Determination method?

Answer: A qualified statistical expert determines the risk of identifying an individual is very small

Expert Determination requires a qualified statistical or scientific expert to certify that the risk of re-identification is very small using generally accepted principles.

Under HIPAA, what is the retention period for a covered entity's privacy policies and procedures documentation?

Answer: 6 years from creation or last effective date

The HIPAA Privacy Rule at 45 CFR §164.530(j) requires policies, procedures, and related documentation to be retained for 6 years from creation or last effective date, whichever is later.

A covered entity receives a valid subpoena for a patient's records. Under HIPAA, what must the covered entity do before disclosing the PHI?

Answer: Receive satisfactory assurances the requestor notified the patient or obtained a qualified protective order

A subpoena not accompanied by a court order requires the covered entity to receive satisfactory assurances that the individual was notified or a qualified protective order is in place.