CHT Patient Rights, Privacy & HIPAA Compliance 2 — Questions and Answers
Question 1: Which of the following is NOT one of the patient rights protected under HIPAA?
- Right to access and obtain a copy of their medical records
- Right to request amendments to their health information
- Right to receive free unlimited copies of all records immediately (Correct answer)
- Right to receive an accounting of disclosures of their PHI
Correct answer: Right to receive free unlimited copies of all records immediately
HIPAA gives patients the right to access and request copies of their records, but facilities may charge a reasonable fee and are not required to provide unlimited free copies immediately.
Question 2: A HIPAA breach must be reported to the affected individual within how many days of discovery?
- 7 days
- 30 days
- 60 days (Correct answer)
- 90 days
Correct answer: 60 days
HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI.
Question 3: A patient's spouse approaches you in the hallway asking for an update on the patient's condition during transport. You should:
- Provide the full medical update since they are the patient's spouse
- Share only general information that has already been made public
- Decline to share clinical information and direct them to the nursing staff (Correct answer)
- Ask the spouse to sign a release form on the spot before sharing
Correct answer: Decline to share clinical information and direct them to the nursing staff
Transporters should not disclose clinical information to family members without patient authorization; the nursing team is the appropriate resource for family communication.
Question 4: What is the Notice of Privacy Practices (NPP)?
- A form patients sign agreeing not to sue the hospital
- A document informing patients of how their health information may be used and their rights under HIPAA (Correct answer)
- A hospital policy on internal staff communications
- A consent form required before any medical procedure
Correct answer: A document informing patients of how their health information may be used and their rights under HIPAA
The Notice of Privacy Practices is a HIPAA-required document that explains how a covered entity uses and discloses PHI and informs patients of their privacy rights.
Question 5: Posting a photo of a patient on social media without their explicit consent is:
- Acceptable if the patient's face is not visible
- Acceptable if the post does not mention the hospital name
- A HIPAA violation that could result in disciplinary action and legal penalties (Correct answer)
- Only a violation if the patient objects afterward
Correct answer: A HIPAA violation that could result in disciplinary action and legal penalties
Sharing any patient image or information on social media without written authorization is a HIPAA violation regardless of whether the face is visible or the hospital is named.
Question 6: When transporting a patient who is an incarcerated individual, the transporter should:
- Share the patient's criminal history with other staff for safety awareness
- Treat the patient with the same dignity, respect, and privacy protections as any other patient (Correct answer)
- Document the patient's incarceration status prominently in transport notes
- Refuse transport until additional security officers are present
Correct answer: Treat the patient with the same dignity, respect, and privacy protections as any other patient
All patients, regardless of legal status, retain the right to dignity, respect, and privacy protections under HIPAA and professional ethical standards.
Question 7: Which of the following disclosures of PHI is generally permitted under HIPAA without patient authorization?
- Sharing patient records with a marketing firm
- Disclosing PHI to treatment providers involved in the patient's care (Correct answer)
- Providing patient information to the media upon request
- Selling patient data to a pharmaceutical company
Correct answer: Disclosing PHI to treatment providers involved in the patient's care
HIPAA permits disclosure of PHI for treatment, payment, and healthcare operations (TPO) purposes, including sharing with providers directly involved in the patient's care.
CHT Patient Rights, Privacy & HIPAA Compliance 2
Which of the following is NOT one of the patient rights protected under HIPAA?