HIPAA Privacy Requirements Flashcards

What is the purpose of a HIPAA 'authorization' form as distinct from a 'consent' form?

Answer: Authorization permits uses/disclosures beyond TPO; consent was an optional general permission for TPO

HIPAA authorization is a specific document permitting uses or disclosures beyond treatment, payment, and operations, while the optional 'consent' form addressed general TPO uses.

Which of the following is a required element of a valid HIPAA authorization?

Answer: A description of the PHI to be used or disclosed

A valid HIPAA authorization must include a description of the information to be used or disclosed with enough specificity so the patient understands what they are authorizing.

Under HIPAA, what is an 'incidental disclosure'?

Answer: A secondary disclosure that occurs as a by-product of a permitted use, not considered a violation if reasonable safeguards are in place

Incidental disclosures are secondary disclosures that occur as a by-product of otherwise permitted disclosures and are not HIPAA violations if reasonable safeguards are followed.

Which HIPAA provision addresses the rights of parents to access their minor child's PHI?

Answer: The Privacy Rule defers to state law and professional standards on parental access to minor PHI

HIPAA defers to state law and professional standards to determine parental access to minor PHI, creating variability across jurisdictions.

What are the civil monetary penalty tiers under HIPAA, reflecting the level of culpability?

Answer: Did not know, reasonable cause, willful neglect corrected, willful neglect not corrected — escalating from $100 to $50,000 per violation

HIPAA's tiered civil monetary penalty structure ranges from $100/violation (did not know) to $50,000/violation (willful neglect not corrected), with annual caps per violation category.

Under HIPAA, psychotherapy notes receive stronger protection than other PHI because they:

Answer: Require specific authorization separate from other PHI disclosures and cannot be used for TPO

Psychotherapy notes require a specific authorization for disclosure and cannot be used for most TPO purposes, receiving heightened protection under HIPAA.