CMC Regulatory Compliance & Legal Framework 3 — Questions and Answers
Question 1: A nurse discovers that a colleague accessed a cardiac patient's records without a clinical need. The appropriate first action is to:
- Confront the colleague directly
- Report the incident through the hospital's privacy compliance officer or established reporting channel (Correct answer)
- Notify the patient immediately
- Delete the audit log entry
Correct answer: Report the incident through the hospital's privacy compliance officer or established reporting channel
Unauthorized access to PHI must be reported to the privacy compliance officer per HIPAA breach response procedures.
Question 2: Under CMS Conditions of Participation, a hospital's cardiac surgery program must maintain quality improvement activities including:
- Monthly staff socials
- Peer review of outcomes data and mortality review (Correct answer)
- Annual CEO reports only
- Quarterly billing audits
Correct answer: Peer review of outcomes data and mortality review
CMS CoPs require ongoing quality assessment and performance improvement activities including peer review of clinical outcomes.
Question 3: A pharmaceutical representative offers a cardiologist tickets to a sporting event in exchange for prescribing their anticoagulant. This violates:
- EMTALA
- The Anti-Kickback Statute (Correct answer)
- The Stark Law only
- HIPAA
Correct answer: The Anti-Kickback Statute
The Anti-Kickback Statute prohibits offering or accepting remuneration to induce referrals or prescriptions for federally reimbursable services.
Question 4: Which consent doctrine requires that a cardiologist disclose information that a reasonable patient would want to know before agreeing to cardiac catheterization?
- The professional standard
- The patient-centered (reasonable patient) standard (Correct answer)
- The implied consent standard
- The emergency consent standard
Correct answer: The patient-centered (reasonable patient) standard
The patient-centered standard focuses on what a reasonable patient would need to know to make an informed decision, not just what physicians typically disclose.
Question 5: A hospital receives a subpoena for a cardiac patient's medical records in a malpractice case. Under HIPAA, the hospital may disclose the records:
- Only with the patient's written authorization
- Pursuant to the subpoena if proper legal procedures are followed, such as a qualified protective order (Correct answer)
- Only after 30 days' notice to the patient
- Never without explicit patient consent
Correct answer: Pursuant to the subpoena if proper legal procedures are followed, such as a qualified protective order
HIPAA permits disclosure in response to legal proceedings if the request meets specific procedural requirements including a qualified protective order.
Question 6: Sentinel event reporting to The Joint Commission is:
- Mandatory within 24 hours of any adverse event
- Voluntary but encouraged, with a root cause analysis required if reported (Correct answer)
- Required by federal law for all cardiac deaths
- Only required for events involving surgical procedures
Correct answer: Voluntary but encouraged, with a root cause analysis required if reported
TJC sentinel event reporting is voluntary, but accredited organizations must complete a root cause analysis if they choose to report.
Question 7: A cardiac patient wishes to be resuscitated but their family insists on a DNR order. The legally and ethically correct action is to:
- Follow the family's wishes as next of kin
- Honor the patient's wishes if they have decision-making capacity (Correct answer)
- Obtain a court order before proceeding
- Follow the attending physician's clinical judgment
Correct answer: Honor the patient's wishes if they have decision-making capacity
A competent patient's autonomous decision to be resuscitated supersedes family preferences; patient autonomy is the legal and ethical standard.
CMC Regulatory Compliance & Legal Framework 3
A nurse discovers that a colleague accessed a cardiac patient's records without a clinical need.
The appropriate first action is to: