CHPC Permitted Uses and Disclosures of PHI and Authorizations — Questions and Answers
Question 1: Under the HIPAA Privacy Rule, for which purpose may a covered entity use or disclose PHI WITHOUT a patient authorization?
- Selling a patient list to a pharmaceutical company
- Treatment, payment and health care operations (Correct answer)
- Sending marketing for a third party's product in exchange for payment
- Disclosing psychotherapy notes to an employer
Correct answer: Treatment, payment and health care operations
45 CFR 164.506 permits uses and disclosures for treatment, payment and health care operations (TPO) without authorization. Sale of PHI, most paid marketing and most uses of psychotherapy notes require a written authorization.
Question 2: To which disclosure does the HIPAA minimum necessary standard NOT apply?
- Disclosures to a health plan for payment
- Disclosures to a business associate for billing services
- Disclosures to a health care provider for treatment (Correct answer)
- Internal uses for quality-improvement operations
Correct answer: Disclosures to a health care provider for treatment
The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment. It also does not apply to disclosures to the individual, disclosures under a valid authorization, disclosures to HHS, and disclosures required by law. It does apply to payment and operations.
Question 3: Which element is REQUIRED in a valid HIPAA authorization?
- The patient's Social Security number
- An expiration date or expiration event (Correct answer)
- A notary's seal
- The covered entity's tax ID number
Correct answer: An expiration date or expiration event
Under 45 CFR 164.508(c), core elements include a specific description of the information, who may disclose and receive it, the purpose, an expiration date or event, and the individual's signature and date. Required statements cover the right to revoke and the possibility of redisclosure. Notarization and SSNs are not required.
Question 4: A hospital wants to send patients a mailer promoting a new drug, and the drug manufacturer is paying for the mailing. What does HIPAA require?
- Nothing, because all communications about health products count as treatment
- Only an opt-out notice in the mailer
- A prior written authorization from each patient that states the hospital is receiving financial remuneration (Correct answer)
- Approval from the hospital's IRB
Correct answer: A prior written authorization from each patient that states the hospital is receiving financial remuneration
Marketing communications paid for by a third party whose product is being described require prior authorization. Under the HITECH Omnibus Rule, the authorization must state that financial remuneration is involved. Exceptions include face-to-face communications and promotional gifts of nominal value.
Question 5: How are psychotherapy notes treated differently from the rest of the medical record under HIPAA?
- They cannot be created by covered entities
- Most uses and disclosures, including many that would otherwise fall under TPO, require a specific authorization (Correct answer)
- They are automatically considered de-identified
- They must be released to anyone who requests them
Correct answer: Most uses and disclosures, including many that would otherwise fall under TPO, require a specific authorization
Psychotherapy notes kept separately from the medical record have special protection. Most uses and disclosures require authorization, with limited exceptions such as the originator's own treatment use, the provider's supervised training programs, and defending a legal action brought by the individual. Patients also do not have a general right of access to them.
Question 6: A patient is alert and has their adult daughter with them in the exam room. Before discussing the patient's diagnosis in front of the daughter, what should the provider do under HIPAA?
- Get a signed written authorization
- Give the patient a chance to agree or object, or reasonably infer from the circumstances that the patient does not object (Correct answer)
- Ask the daughter to leave in every case
- Contact the privacy officer for approval
Correct answer: Give the patient a chance to agree or object, or reasonably infer from the circumstances that the patient does not object
45 CFR 164.510(b) permits disclosure of relevant PHI to family members involved in care when the patient, if present and capable, has a chance to agree or object, or when the provider can reasonably infer no objection. A written authorization is not required.
