CHPC Patient Rights and Access to Health Records 1 — Questions and Answers
Question 1: Under HIPAA, how long does a covered entity generally have to respond to a patient's request for access to their PHI?
- 30 days, with a possible 30-day extension (Correct answer)
- 60 days, with no extension
- 15 days, with a 15-day extension
- 45 days, with no extension
Correct answer: 30 days, with a possible 30-day extension
HIPAA requires covered entities to act on an access request within 30 days, with one 30-day extension if written notice is provided.
Question 2: Which of the following is NOT a valid reason for a covered entity to deny a patient access to their PHI?
- The information was compiled for litigation
- A licensed provider believes access could cause harm
- The PHI was created by another provider (Correct answer)
- A privacy board approved denial
Correct answer: The PHI was created by another provider
The fact that PHI was created by another provider is not a valid HIPAA basis for denying patient access; the covered entity must still provide access to PHI it holds.
Question 3: A patient requests an amendment to their medical record. Under HIPAA, how long does the covered entity have to act on this request?
- 60 days, with a possible 30-day extension (Correct answer)
- 30 days, with no extension
- 90 days, with a 30-day extension
- 14 days, with no extension
Correct answer: 60 days, with a possible 30-day extension
HIPAA allows covered entities 60 days to respond to amendment requests, with one 30-day extension if written notice of the delay is given.
Question 4: Which right allows patients to receive a list of disclosures of their PHI made by a covered entity in the past six years?
- Right of accounting of disclosures (Correct answer)
- Right of access
- Right to restrict
- Right to amend
Correct answer: Right of accounting of disclosures
The HIPAA right of accounting of disclosures allows individuals to request a log of certain PHI disclosures made without their authorization.
Question 5: A patient asks a covered entity to restrict the disclosure of their PHI to their health plan for a service they paid for out of pocket. Under HIPAA, the covered entity must:
- Honor the restriction (Correct answer)
- Evaluate the request and decide
- Deny the request as health plans are required recipients
- Request physician approval first
Correct answer: Honor the restriction
HIPAA requires covered entities to agree to restrictions on disclosures to health plans when the patient paid out of pocket in full for the service.
Question 6: Under HIPAA, a covered entity may charge a fee for providing a copy of PHI to a patient. Which cost element is NOT allowable?
- Staff time to locate and pull the record (Correct answer)
- Labor for copying
- Postage
- Cost of the physical media (e.g., a USB drive)
Correct answer: Staff time to locate and pull the record
HIPAA's fee limitation allows only labor for copying, supplies, postage, and preparation of a summary — searching and retrieving costs are not chargeable.
CHPC Patient Rights and Access to Health Records 1
Under HIPAA, how long does a covered entity generally have to respond to a patient's request for access to their PHI?