CHPS HIPAA Privacy Rule Compliance 3

Question 1

Under HIPAA, which of the following is a permitted disclosure of PHI to family members WITHOUT patient authorization?

Accepted Answer

Sharing information directly relevant to a family member's involvement in care when the patient has not objected

Answer

Sharing a full medical history with an adult patient's spouse

Answer

Providing test results to a parent of an adult patient

Answer

Disclosing mental health notes to a sibling upon request

Question 2

A covered entity wishes to use patient PHI for a research study. Under HIPAA, which of the following is NOT a valid pathway to use PHI for research?

Accepted Answer

Purchasing de-identified data from a vendor and re-linking it to patient records

Answer

Obtaining a valid patient authorization

Answer

Obtaining a waiver of authorization from an IRB or Privacy Board

Answer

Using a Limited Data Set with a Data Use Agreement

Question 3

Under HIPAA's right to request restrictions, when is a covered entity REQUIRED to agree to a patient's restriction request?

Accepted Answer

When the patient requests restriction on disclosure to a health plan for services the patient paid out-of-pocket in full

Answer

When the restriction involves disclosures to a family member

Answer

When the treating physician supports the restriction

Answer

Covered entities are never required to agree to restriction requests

Question 4

What is the HIPAA standard for de-identification using the Expert Determination method?

Accepted Answer

A qualified statistical expert determines the risk of identifying an individual is very small

Answer

Removing all 18 types of identifiers listed in the Safe Harbor method

Answer

Encrypting all data fields using AES-256 encryption

Answer

Applying a pseudonym to replace direct identifiers

Question 5

Under HIPAA, what is the retention period for a covered entity's privacy policies and procedures documentation?

Accepted Answer

6 years from creation or last effective date

Answer

3 years from creation or last effective date

Answer

7 years from creation or last effective date

Answer

10 years from creation or last effective date

Question 6

A covered entity receives a valid subpoena for a patient's records. Under HIPAA, what must the covered entity do before disclosing the PHI?

Accepted Answer

Receive satisfactory assurances the requestor notified the patient or obtained a qualified protective order

Answer

Disclose immediately since legal process overrides HIPAA

Answer

Obtain written patient authorization before disclosing

Answer

Notify the Department of Health and Human Services before disclosure