Legal and Regulatory Compliance Flashcards
6 cards from real CHAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Legal and Regulatory Compliance flashcards as text
Under HIPAA, which of the following is considered Protected Health Information (PHI)?
Answer: A patient's name combined with their diagnosis and date of service
PHI is individually identifiable health information that relates to a person's health condition, treatment, or payment for care.
What is the minimum necessary standard under HIPAA, and how does it apply to patient access?
Answer: It requires limiting PHI access and disclosure to the minimum amount needed to accomplish the intended purpose
The minimum necessary standard requires that workforce members access only the PHI needed for their specific job functions.
A patient requests a copy of their complete medical record. Under HIPAA, what is the organization's obligation?
Answer: Provide the records within 30 days (with a possible 30-day extension) in the format requested by the patient if readily producible
HIPAA gives patients the right to access their health information, and organizations must fulfill requests within 30 days, with reasonable cost-based fees.
What is the purpose of the Medicare Secondary Payer (MSP) questionnaire administered during registration?
Answer: To identify whether another insurer should be the primary payer before Medicare
The MSP questionnaire identifies situations where Medicare should be the secondary payer, such as when the patient has employer group health coverage.
Which regulation requires healthcare facilities to inform patients of their right to create advance directives?
Answer: The Patient Self-Determination Act (PSDA)
The Patient Self-Determination Act requires healthcare facilities to inform patients about their right to make advance directives and to document whether they have them.
What constitutes a HIPAA breach, and what is the organization's notification obligation?
Answer: An impermissible use or disclosure of PHI that compromises the security or privacy of the information, requiring notification to affected individuals within 60 days
A HIPAA breach is an impermissible acquisition, access, use, or disclosure of PHI, requiring notification to affected individuals, HHS, and potentially the media.