CMAA HIPAA and Patient Confidentiality 5 — Questions and Answers
Question 1: A patient calls the office asking for their test results to be left on their home answering machine. The medical administrative assistant should:
- Decline, as leaving any message violates HIPAA
- Leave a brief message with full results since the patient requested it
- Honor the request by leaving only the minimum necessary information and a callback number (Correct answer)
- Transfer the call to the physician only
Correct answer: Honor the request by leaving only the minimum necessary information and a callback number
HIPAA allows covered entities to communicate with patients by their preferred method, including voicemail, but only the minimum necessary information should be left.
Question 2: Under HIPAA, a 'business associate' is best described as:
- Any employee who handles patient billing
- A person or entity that performs functions involving PHI on behalf of a covered entity (Correct answer)
- A patient's authorized representative
- A government agency that regulates healthcare
Correct answer: A person or entity that performs functions involving PHI on behalf of a covered entity
A business associate is a person or organization that performs certain functions or activities that involve the use or disclosure of PHI on behalf of, or in service to, a covered entity.
Question 3: Which of the following represents an appropriate 'minimum necessary' practice when sharing PHI?
- Sending a patient's entire medical history when only lab results were requested
- Providing only the specific information needed to fulfill a request for treatment purposes (Correct answer)
- Sharing all records with any staff member who requests them
- Disclosing full PHI whenever a written request is received
Correct answer: Providing only the specific information needed to fulfill a request for treatment purposes
The minimum necessary standard requires that covered entities limit the PHI disclosed to only what is needed to accomplish the intended purpose.
Question 4: If a HIPAA breach is discovered, the covered entity must notify affected individuals within:
- 30 days of discovery
- 60 days of discovery (Correct answer)
- 90 days of discovery
- 6 months of discovery
Correct answer: 60 days of discovery
HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI.
Question 5: A patient's 16-year-old child calls to ask about a parent's medical records. Under HIPAA, the administrative assistant should:
- Release the records because family members are always permitted access
- Verify whether the minor child is listed as an authorized representative before releasing any information (Correct answer)
- Deny the request automatically because minors cannot access adult records
- Release only non-sensitive records to the child
Correct answer: Verify whether the minor child is listed as an authorized representative before releasing any information
HIPAA requires verification that an individual is an authorized personal representative before disclosing a patient's PHI to a third party, including family members.
Question 6: Which of the following is an example of a physical safeguard required under the HIPAA Security Rule?
- Encrypting data transmitted over the internet
- Installing antivirus software on workstations
- Using locked cabinets or restricted-access areas for workstations containing ePHI (Correct answer)
- Implementing audit controls to track ePHI access
Correct answer: Using locked cabinets or restricted-access areas for workstations containing ePHI
Physical safeguards include facility access controls, workstation security, and device and media controls — such as locked areas — to protect ePHI from unauthorized physical access.
Question 7: An employee shares a patient's diagnosis with a coworker out of curiosity. This is a violation of which HIPAA principle?
- The Security Rule's technical safeguard requirements
- The minimum necessary standard and Privacy Rule prohibitions on unauthorized disclosure (Correct answer)
- The Breach Notification Rule's reporting requirements
- The Business Associate Agreement provisions
Correct answer: The minimum necessary standard and Privacy Rule prohibitions on unauthorized disclosure
Sharing a patient's diagnosis without a legitimate treatment, payment, or operations purpose violates the Privacy Rule's minimum necessary standard and prohibition on unauthorized PHI disclosures.
CMAA HIPAA and Patient Confidentiality 5
A patient calls the office asking for their test results to be left on their home answering machine.
The medical administrative assistant should: