CHPC Patient Rights and Access to Health Records 2 — Questions and Answers
Question 1: Which HIPAA right permits an individual to request that a covered entity communicate with them at a specific location or by a specific method?
- Right to confidential communications (Correct answer)
- Right to access
- Right to amend
- Right to accounting
Correct answer: Right to confidential communications
The right to confidential communications allows individuals to ask covered entities to contact them through alternative means or at alternative locations.
Question 2: If a covered entity denies a patient's amendment request, what must the entity provide?
- Written denial with the basis and information about filing a statement of disagreement (Correct answer)
- Only a verbal explanation to the patient
- An immediate second review by a supervisor
- Nothing, as denials need no documentation
Correct answer: Written denial with the basis and information about filing a statement of disagreement
When denying an amendment, the covered entity must provide a written denial that includes the basis for denial and the patient's right to submit a statement of disagreement.
Question 3: Under the HITECH Act, which entity extended individual rights regarding PHI to business associates?
- Business associates are now directly liable for honoring certain patient rights (Correct answer)
- Only covered entities retain direct patient rights obligations
- State attorneys general enforce BA patient rights only
- Business associates have no patient rights obligations
Correct answer: Business associates are now directly liable for honoring certain patient rights
HITECH made business associates directly liable under HIPAA, including obligations related to individual rights such as access and accounting of disclosures.
Question 4: A patient submits a written request to restrict how their PHI is used for treatment purposes. The covered entity may:
- Deny the restriction for treatment uses
- Grant the restriction only for payment uses
- Grant or deny the restriction at its discretion (except the mandatory out-of-pocket rule) (Correct answer)
- Never deny a restriction request
Correct answer: Grant or deny the restriction at its discretion (except the mandatory out-of-pocket rule)
For most restriction requests, covered entities have discretion to agree or disagree, with the exception of the mandatory restriction when a patient pays fully out of pocket.
Question 5: Which of the following is included in the disclosures that must appear in an accounting of disclosures?
- Disclosures for public health activities without authorization (Correct answer)
- Disclosures made for treatment with patient authorization
- Disclosures to the patient themselves
- Disclosures for the facility directory
Correct answer: Disclosures for public health activities without authorization
Accounting of disclosures covers disclosures made without patient authorization for purposes such as public health, law enforcement, and oversight activities.
Question 6: When must a covered entity inform a patient that it cannot provide access to their PHI in electronic form?
- Before the patient submits the request
- At the time the entity denies or cannot fulfill the electronic format request (Correct answer)
- Within 90 days of the request
- Only if the patient asks about electronic availability
Correct answer: At the time the entity denies or cannot fulfill the electronic format request
Covered entities must inform individuals when electronic PHI is not available in the requested format so the patient may choose an alternative.
CHPC Patient Rights and Access to Health Records 2
Which HIPAA right permits an individual to request that a covered entity communicate with them at a specific location or by a specific method?