HIPAA Privacy Requirements Flashcards

Which of the following is NOT a permitted use or disclosure of PHI under the HIPAA Privacy Rule without patient authorization?

Answer: Marketing campaigns selling health products

Marketing activities that use PHI to encourage purchase of products require patient authorization; treatment, payment, and healthcare operations are permitted without it.

What is the HIPAA 'minimum necessary' standard?

Answer: Covered entities must make reasonable efforts to use only the minimum PHI necessary for the intended purpose

The minimum necessary standard requires covered entities to limit PHI use and disclosure to the least amount needed to accomplish the intended purpose.

Under HIPAA, patients have the right to access their PHI within how many days of requesting it?

Answer: 30 days, extendable once by 30 additional days

Covered entities must provide access to PHI within 30 days, with the ability to extend once by an additional 30 days with written explanation.

Which type of entity is directly covered by HIPAA's Privacy Rule?

Answer: Covered entities (health plans, providers, clearinghouses)

HIPAA directly covers 'covered entities': health plans, healthcare providers that transmit PHI electronically, and healthcare clearinghouses.

What does a HIPAA Notice of Privacy Practices (NPP) require?

Answer: A description of how the covered entity uses and discloses PHI and patients' rights

The NPP must inform patients how their PHI may be used and disclosed, their privacy rights, and the covered entity's legal duties regarding PHI.

Under HIPAA, a covered entity must provide an individual an accounting of disclosures of their PHI for a period of up to how many years?

Answer: 6 years prior to the date of the request

Individuals have the right to an accounting of PHI disclosures made in the 6 years prior to the request, excluding disclosures for TPO.