HIPAA Privacy Requirements Flashcards

Which de-identification method under HIPAA requires a statistician to certify that risk of identification is very small?

Answer: Expert determination method

The expert determination method requires a qualified statistician to certify that the risk of identifying individuals is very small using generally accepted principles.

What is a 'limited data set' under HIPAA?

Answer: PHI with most direct identifiers removed, used for research, public health, or healthcare operations under a data use agreement

A limited data set has direct identifiers like names and SSNs removed but may still include dates and geographic data at the zip code level or above, shared via data use agreement.

Under HIPAA, what is required when a covered entity engages a business associate to perform functions involving PHI?

Answer: A Business Associate Agreement (BAA) must be in place

Covered entities must have a Business Associate Agreement with each business associate, establishing PHI use and protection obligations.

Which HIPAA right allows a patient to request that a covered entity not disclose their PHI to their health plan for services paid out-of-pocket?

Answer: Right to request restrictions on disclosures to health plans

HIPAA requires covered entities to honor a patient's request to restrict disclosure to a health plan when the patient pays out-of-pocket in full for a service.

What is the HIPAA Privacy Rule's general rule on the use of PHI for marketing?

Answer: PHI cannot be used for marketing without written patient authorization

The HIPAA Privacy Rule requires covered entities to obtain prior written authorization before using PHI for most marketing communications.

Under the HIPAA Privacy Rule, which government entity receives patient complaints about HIPAA violations?

Answer: HHS Office for Civil Rights (OCR)

The HHS Office for Civil Rights (OCR) is the primary enforcement agency for HIPAA Privacy and Security Rule complaints and violations.