CHPS HIPAA Privacy Rule Compliance 3

Question 1

Under HIPAA, which of the following is a permitted disclosure of PHI to family members WITHOUT patient authorization?

Accepted Answer

Sharing information directly relevant to a family member's involvement in care when the patient has not objected

Answer

Under 45 CFR §164.510(b), a covered entity may share PHI with family members involved in care if the patient has not objected and the information is directly relevant to that involvement.

Question 2

A covered entity wishes to use patient PHI for a research study. Under HIPAA, which of the following is NOT a valid pathway to use PHI for research?

Accepted Answer

Purchasing de-identified data from a vendor and re-linking it to patient records

Answer

Re-linking de-identified data to patient records defeats the purpose of de-identification and is not a permissible research pathway under HIPAA.

Question 3

Under HIPAA's right to request restrictions, when is a covered entity REQUIRED to agree to a patient's restriction request?

Accepted Answer

When the patient requests restriction on disclosure to a health plan for services the patient paid out-of-pocket in full

Answer

Under the HITECH-amended HIPAA rules, covered entities must honor restrictions when the patient has paid out-of-pocket in full and requests the restriction to a health plan.

Question 4

What is the HIPAA standard for de-identification using the Expert Determination method?

Accepted Answer

A qualified statistical expert determines the risk of identifying an individual is very small

Answer

Expert Determination requires a qualified statistical or scientific expert to certify that the risk of re-identification is very small using generally accepted principles.

Question 5

Under HIPAA, what is the retention period for a covered entity's privacy policies and procedures documentation?

Accepted Answer

6 years from creation or last effective date

Answer

The HIPAA Privacy Rule at 45 CFR §164.530(j) requires policies, procedures, and related documentation to be retained for 6 years from creation or last effective date, whichever is later.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS HIPAA Privacy Rule Compliance 3