CHPC Permitted Uses and Disclosures of PHI and Authorizations

Question 1

Under the HIPAA Privacy Rule, for which purpose may a covered entity use or disclose PHI WITHOUT a patient authorization?

Accepted Answer

Treatment, payment and health care operations

Answer

45 CFR 164.506 permits uses and disclosures for treatment, payment and health care operations (TPO) without authorization. Sale of PHI, most paid marketing and most uses of psychotherapy notes require a written authorization.

Question 2

To which disclosure does the HIPAA minimum necessary standard NOT apply?

Accepted Answer

Disclosures to a health care provider for treatment

Answer

The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment. It also does not apply to disclosures to the individual, disclosures under a valid authorization, disclosures to HHS, and disclosures required by law. It does apply to payment and operations.

Question 3

Which element is REQUIRED in a valid HIPAA authorization?

Accepted Answer

An expiration date or expiration event

Answer

Under 45 CFR 164.508(c), core elements include a specific description of the information, who may disclose and receive it, the purpose, an expiration date or event, and the individual's signature and date. Required statements cover the right to revoke and the possibility of redisclosure. Notarization and SSNs are not required.

Question 4

A hospital wants to send patients a mailer promoting a new drug, and the drug manufacturer is paying for the mailing. What does HIPAA require?

Accepted Answer

A prior written authorization from each patient that states the hospital is receiving financial remuneration

Answer

Marketing communications paid for by a third party whose product is being described require prior authorization. Under the HITECH Omnibus Rule, the authorization must state that financial remuneration is involved. Exceptions include face-to-face communications and promotional gifts of nominal value.

Question 5

How are psychotherapy notes treated differently from the rest of the medical record under HIPAA?

Accepted Answer

Most uses and disclosures, including many that would otherwise fall under TPO, require a specific authorization

Answer

Psychotherapy notes kept separately from the medical record have special protection. Most uses and disclosures require authorization, with limited exceptions such as the originator's own treatment use, the provider's supervised training programs, and defending a legal action brought by the individual. Patients also do not have a general right of access to them.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC Permitted Uses and Disclosures of PHI and Authorizations