Patient Rights and Access to Health Records Flashcards

Under HIPAA, how long does a covered entity generally have to respond to a patient's request for access to their PHI?

Answer: 30 days, with a possible 30-day extension

HIPAA requires covered entities to act on an access request within 30 days, with one 30-day extension if written notice is provided.

Which of the following is NOT a valid reason for a covered entity to deny a patient access to their PHI?

Answer: The PHI was created by another provider

The fact that PHI was created by another provider is not a valid HIPAA basis for denying patient access; the covered entity must still provide access to PHI it holds.

A patient requests an amendment to their medical record. Under HIPAA, how long does the covered entity have to act on this request?

Answer: 60 days, with a possible 30-day extension

HIPAA allows covered entities 60 days to respond to amendment requests, with one 30-day extension if written notice of the delay is given.

Which right allows patients to receive a list of disclosures of their PHI made by a covered entity in the past six years?

Answer: Right of accounting of disclosures

The HIPAA right of accounting of disclosures allows individuals to request a log of certain PHI disclosures made without their authorization.

A patient asks a covered entity to restrict the disclosure of their PHI to their health plan for a service they paid for out of pocket. Under HIPAA, the covered entity must:

Answer: Honor the restriction

HIPAA requires covered entities to agree to restrictions on disclosures to health plans when the patient paid out of pocket in full for the service.

Under HIPAA, a covered entity may charge a fee for providing a copy of PHI to a patient. Which cost element is NOT allowable?

Answer: Staff time to locate and pull the record

HIPAA's fee limitation allows only labor for copying, supplies, postage, and preparation of a summary — searching and retrieving costs are not chargeable.