Trivia Flashcards

Which of the following is under HIPAA and involves giving a primary care provider a copy of an emergency department visit report?

Answer: Disclosure of protected health information

Providing a copy of an emergency room visit report to a primary care provider is an example of a "disclosure of protected health information" under HIPAA. HIPAA, the Health Insurance Portability and Accountability Act, establishes rules and regulations to protect the privacy and security of individuals' protected health information (PHI). PHI refers to any individually identifiable health information held or transmitted by a covered entity or its business associates.

A covered company has been asked in writing to postpone notifying the public of a data breach because it would complicate an investigation. How long may the covered entity delay sending the notice?

Answer: By the amount time specified in the request.

Under the HIPAA Breach Notification Rule, if law enforcement provides a written statement that notification would impede an investigation, the covered entity must delay only for the specific time period stated in that request. The other options describe access-control or record-set concepts unrelated to a notification delay.

The organization must take action if a health insurance provider contacts a member to advertise a car insurance plan provided by the same provider.

Answer: Authorization for disclosure for marketing purposes

Under the Health Insurance Portability and Accountability Act (HIPAA) Breach Notification Rule, covered entities are generally required to provide timely notification to individuals whose protected health information (PHI) has been breached. The notification should be made without unreasonable delay and no later than 60 days from the discovery of the breach.

Data is sent between computers in encrypted form. Which of the following best represents the date following the use of the encryption algorithm?

Answer: Device controls

The term that describes the data after the encryption algorithm has been applied is "encrypted data." Encryption is a process of encoding data to make it unreadable or unintelligible to unauthorized individuals. It involves using an encryption algorithm and a key to transform the original data into encrypted form, also known as ciphertext.

How much time is allotted for a covered company to reply to an accounting of disclosure request?

Answer: 30 days with one 30 day extension

A covered entity under the Health Insurance Portability and Accountability Act (HIPAA) has a maximum of 30 days to respond to an accounting of disclosure request from an individual. However, if the covered entity is unable to meet the deadline within the initial 30-day period, they can request a one-time 30-day extension to provide a response.

When a patient obtains a treatment, pays out of pocket, and wishes that information not be forwarded to his or her personal account, a healthcare institution must abide by a limitation.

Answer: Health insurance company

A healthcare organization must comply with a restriction when a patient receives a service, pays out of pocket, and requests that information is not sent to his/her health insurance company. Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the disclosure of protected health information (PHI) for marketing purposes generally requires the individual's authorization. PHI includes any individually identifiable health information held or transmitted by a covered entity or its business associates.

A new business partner was employed by a covered organization. The business associate asked the covered entity to sign the contract provided by the vendor during the assessment of the business associates agreement. Is this a proper procedure?

Answer: Yes, the covered entity must review the documentation in the business associate agreement and agree to it

Yes — the covered entity is responsible for reviewing the terms of a Business Associate Agreement and agreeing to them before signing, so reviewing the vendor-provided contract is proper procedure. The other options reference Security Rule administrative controls, not the BAA review process.