CHP Documentation & Record Keeping 2 — Questions and Answers
Question 1: Under the HIPAA Privacy Rule, covered entities must retain documentation of their privacy policies and procedures for how long?
- 3 years from creation or last effective date
- 6 years from creation or last effective date (Correct answer)
- 10 years from creation or last effective date
- Indefinitely
Correct answer: 6 years from creation or last effective date
The HIPAA Privacy Rule requires covered entities to retain documentation of policies, procedures, and related records for 6 years from the date of creation or the date it was last in effect, whichever is later.
Question 2: A Notice of Privacy Practices (NPP) acknowledgment form cannot be obtained from a patient. What must the covered entity do?
- Cancel the patient encounter and reschedule
- Document the good-faith effort to obtain acknowledgment and the reason it was not obtained (Correct answer)
- Obtain a court order to compel the patient to sign
- Refuse to provide treatment until acknowledgment is received
Correct answer: Document the good-faith effort to obtain acknowledgment and the reason it was not obtained
When a covered entity cannot obtain a patient's written acknowledgment of the NPP, it must document its good-faith attempt and the reason acknowledgment was not obtained.
Question 3: Which document must a covered entity make available to individuals upon request under the HIPAA Privacy Rule?
- Internal workforce training records
- The Notice of Privacy Practices (Correct answer)
- Business associate agreement templates
- Risk analysis documentation
Correct answer: The Notice of Privacy Practices
The Notice of Privacy Practices must be provided to individuals upon request and must also be posted at the covered entity's physical service delivery site.
Question 4: When a covered entity uses or discloses PHI for research with a waiver of authorization, what documentation must be retained?
- Only the researcher's credentials
- Documentation of the IRB or Privacy Board waiver approval (Correct answer)
- Patient medical records only
- A copy of the published research study
Correct answer: Documentation of the IRB or Privacy Board waiver approval
Covered entities must retain documentation showing that an IRB or Privacy Board approved a waiver or alteration of authorization for research use or disclosure of PHI.
Question 5: What is required when a covered entity agrees to restrict the use or disclosure of an individual's PHI?
- Verbal acknowledgment is sufficient
- The restriction must be documented in writing (Correct answer)
- A court filing must be submitted
- The restriction must be approved by HHS
Correct answer: The restriction must be documented in writing
Under the Privacy Rule, when a covered entity agrees to a requested restriction on PHI use or disclosure, that restriction must be documented.
Question 6: How long must a covered entity retain records of its HIPAA training program?
- 1 year after the training occurs
- 6 years from the date of the training or last effective date (Correct answer)
- 3 years from employee termination
- Permanently, with no expiration
Correct answer: 6 years from the date of the training or last effective date
Training documentation, like all required HIPAA policies and procedures records, must be retained for 6 years from the date created or last in effect.
Question 7: A covered entity sanctions an employee for a Privacy Rule violation. What documentation is required?
- No documentation is required for minor sanctions
- Documentation of the sanction applied must be retained per HIPAA requirements (Correct answer)
- Only HR personnel files need to be updated
- Documentation must be submitted to HHS within 30 days
Correct answer: Documentation of the sanction applied must be retained per HIPAA requirements
Covered entities must apply appropriate sanctions against workforce members who violate privacy policies and must document those sanctions as part of their required records.
CHP Documentation & Record Keeping 2
Under the HIPAA Privacy Rule, covered entities must retain documentation of their privacy policies and procedures for how long?