HIPAA Privacy Rule Compliance Flashcards

Under the HIPAA Privacy Rule, what is the maximum period a covered entity may retain a patient's authorization for use or disclosure of PHI?

Answer: Until the patient revokes it in writing

An authorization remains valid until the patient revokes it in writing or the expiration date stated in the authorization is reached.

Which of the following is NOT considered protected health information (PHI) under HIPAA?

Answer: De-identified health data that meets the Safe Harbor standard

Data properly de-identified using the Safe Harbor method (removing all 18 identifiers) is no longer considered PHI under HIPAA.

Under the HIPAA Minimum Necessary standard, which of the following disclosures is EXEMPT from the requirement?

Answer: Disclosures for treatment purposes to treating providers

The Minimum Necessary standard does not apply to disclosures to or requests by a healthcare provider for treatment purposes.

A patient requests an amendment to their medical record under HIPAA. How long does the covered entity have to act on the request?

Answer: 60 days

Under 45 CFR §164.526, a covered entity must act on an amendment request within 60 days of receipt.

Which HIPAA provision requires covered entities to provide patients with an accounting of certain disclosures of their PHI?

Answer: Right to an Accounting of Disclosures

The Right to an Accounting of Disclosures (45 CFR §164.528) requires covered entities to provide a list of disclosures made for purposes other than treatment, payment, and operations.

Under HIPAA, which of the following entities is classified as a 'hybrid entity'?

Answer: An organization that performs both covered and non-covered functions and designates its healthcare components

A hybrid entity is a single legal entity that performs both covered and non-covered functions and officially designates its healthcare components subject to HIPAA.