CHP Patient Assessment & Clinical Evaluation 3 — Questions and Answers
Question 1: A patient undergoing a substance abuse assessment at a federally assisted program has records protected by which regulation in addition to HIPAA?
- 21 CFR Part 11
- 42 CFR Part 2 (Correct answer)
- 45 CFR Part 164
- 29 CFR Part 1910
Correct answer: 42 CFR Part 2
42 CFR Part 2 provides additional protections for substance use disorder (SUD) patient records at federally assisted programs, often stricter than HIPAA.
Question 2: A covered entity's clinical assessment system undergoes a security upgrade. Under HIPAA, the audit logs of who accessed patient evaluation records must be retained for at least:
- 3 years
- 6 years (Correct answer)
- 10 years
- Indefinitely
Correct answer: 6 years
HIPAA requires covered entities to retain documentation of policies, procedures, and security measures for six years from creation or last effective date.
Question 3: An employer asks a covered entity for the results of a job applicant's pre-employment clinical evaluation. The covered entity may disclose this information:
- Without restriction since employers pay for the evaluation
- Only with a valid written authorization from the applicant (Correct answer)
- Upon verbal request by the employer's HR department
- As part of normal healthcare operations with the employer
Correct answer: Only with a valid written authorization from the applicant
Disclosing clinical assessment results to an employer requires a valid HIPAA-compliant written authorization from the individual.
Question 4: A patient's clinical evaluation was conducted at Hospital A. When the patient transfers care to Hospital B, Hospital A's disclosure of the evaluation records is:
- A breach requiring patient notification
- Permitted as a treatment disclosure without authorization (Correct answer)
- Permitted only if Hospital B is in the same health system
- Prohibited without a court order
Correct answer: Permitted as a treatment disclosure without authorization
Disclosing PHI to another provider for treatment continuity is a permitted Treatment disclosure under HIPAA's TPO framework.
Question 5: Under HIPAA, a patient who believes their clinical assessment record contains an error has the right to:
- Demand immediate deletion of the incorrect entry
- Request an amendment to the record (Correct answer)
- Prevent all future disclosures until corrected
- Sue the covered entity for the error
Correct answer: Request an amendment to the record
The Privacy Rule grants individuals the right to request amendments to their PHI in a designated record set, though the covered entity may deny the request in certain circumstances.
Question 6: A covered entity sends a patient's clinical assessment summary to a billing company for claim submission. The billing company is best described as:
- A covered entity under HIPAA
- A business associate requiring a BAA (Correct answer)
- A workforce member of the covered entity
- A public health authority
Correct answer: A business associate requiring a BAA
A billing company that handles PHI on behalf of a covered entity is a business associate and must have a signed Business Associate Agreement (BAA) in place.
Question 7: A clinician documents a patient's mental status examination findings in the EHR. Under HIPAA, this information is classified as:
- De-identified health information
- Protected Health Information (PHI) (Correct answer)
- Limited data set
- Public health data
Correct answer: Protected Health Information (PHI)
Mental status exam findings are individually identifiable health information maintained by a covered entity, meeting the definition of PHI under HIPAA.
CHP Patient Assessment & Clinical Evaluation 3
A patient undergoing a substance abuse assessment at a federally assisted program has records protected by which regulation in addition to HIPAA?