Healthcare & Financial Privacy Flashcards

Under HIPAA, 'Protected Health Information' (PHI) is defined as individually identifiable health information that is:

Answer: Held or transmitted by a covered entity or its business associate in any form or medium

PHI encompasses any individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate, regardless of format.

Which of the following entities are classified as 'covered entities' under the HIPAA Privacy Rule?

Answer: Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically

HIPAA covered entities are specifically health plans, healthcare clearinghouses, and healthcare providers that conduct covered transactions electronically.

The HIPAA Privacy Rule's 'minimum necessary' standard requires covered entities to:

Answer: Limit PHI uses and disclosures to the minimum necessary to accomplish the intended purpose

The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI access and disclosure to only what is needed for the specific purpose.

Under HIPAA, a 'business associate' is best described as:

Answer: A person or entity that performs functions on behalf of a covered entity that involve the use or disclosure of PHI

A business associate is a person or organization that performs services for a covered entity that involve creating, receiving, maintaining, or transmitting PHI.

The HIPAA Security Rule's requirements apply specifically to which type of protected health information?

Answer: Electronic protected health information (ePHI) only

The HIPAA Security Rule applies specifically to ePHI — PHI that is created, received, maintained, or transmitted in electronic form.

Under the HIPAA Privacy Rule, patients have the right to do all of the following EXCEPT:

Answer: Prohibit all sharing of their PHI for treatment purposes

HIPAA does not give patients an absolute right to block all PHI disclosures for treatment; covered entities may share PHI for treatment, payment, and healthcare operations without patient authorization.