Healthcare Privacy Laws and Regulations Flashcards
6 cards from real CHPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Healthcare Privacy Laws and Regulations flashcards as text
A research institution wants to use a dataset containing PHI for a study. To comply with HIPAA, they must de-identify the data. Which of the following methods relies on a qualified statistician to apply scientific principles to determine that the risk of re-identification is 'very small'?
Answer: The Expert Determination Method
The HIPAA Privacy Rule provides two methods for de-identification. The Expert Determination Method involves a qualified expert applying statistical or scientific principles to determine that the risk is 'very small' that the information could be used to identify an individual. The Safe Harbor method involves removing 18 specific identifiers.
A patient discovers an error in their medical record and submits a written request to their provider to correct it. Under the HIPAA Privacy Rule, what is the covered entity's primary obligation regarding the patient's right to amend their PHI?
Answer: To review the request and, if granted, append the correction to the record.
The HIPAA Privacy Rule gives individuals the right to request amendment of their PHI in a designated record set. The covered entity is not required to delete the original information but must, if it accepts the amendment, append the corrected information and notify relevant parties. The entity can deny the request for specific reasons, such as if it determines the record is accurate and complete.
A hospital's business associate, a billing company, experiences a data breach involving unsecured PHI. According to the HITECH Act's Breach Notification Rule, what is the business associate's direct responsibility?
Answer: Notify the covered entity of the breach without unreasonable delay and no later than 60 days following discovery.
Under the HITECH Act, a business associate must notify the covered entity of a breach of unsecured PHI 'without unreasonable delay and in no case later than 60 calendar days' after discovery. The covered entity is ultimately responsible for notifying the affected individuals, HHS, and, if applicable, the media.
A state has a law requiring that patients provide specific consent for the release of mental health records, a standard more stringent than HIPAA's general authorization requirements. A provider in this state receives a request that is compliant with HIPAA but not with the stricter state law. Which of the following is the correct course of action?
Answer: Follow the more stringent state law.
The HIPAA Privacy Rule acts as a federal floor for privacy protection. It does not preempt state laws that are 'more stringent,' meaning those that provide greater privacy protections to individuals. In this case, the provider must comply with the state law that offers greater protection to the patient's information.
A covered entity wishes to send promotional materials to its former patients about a new, non-health-related service, such as a financial planning workshop hosted by a third party. Under the HIPAA Privacy Rule, which of the following is required before using PHI for this purpose?
Answer: A valid, written authorization from each individual.
Using or disclosing PHI for marketing purposes generally requires a specific, written authorization from the individual. This authorization must be in plain language and clearly state how the information will be used. Communications about third-party products or services that involve remuneration are considered marketing and are not covered under treatment, payment, or healthcare operations exceptions.
Which of the following is a mandatory component that must be included in a HIPAA Business Associate Agreement (BAA)?
Answer: A provision requiring the business associate to make its internal practices available to the Secretary of HHS for compliance determination.
A compliant Business Associate Agreement must include several key elements, one of which is establishing that the business associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services (HHS) to determine compliance with HIPAA. While insurance and fee schedules are good business practices, they are not explicitly required elements of a BAA by HIPAA.