CPCA CPCA Medical Records and HIPAA Privacy 2 — Questions and Answers
Question 1: What document must a patient sign to authorize the release of their PHI to a third party not involved in treatment, payment, or operations?
- Notice of Privacy Practices
- HIPAA Authorization Form (Correct answer)
- ABN Form
- Assignment of Benefits
Correct answer: HIPAA Authorization Form
A signed HIPAA Authorization Form is required before disclosing PHI for purposes outside of treatment, payment, and healthcare operations.
Question 2: Under HIPAA, a 'business associate' is best described as:
- Any employee of a covered entity
- A vendor or contractor who handles PHI on behalf of a covered entity (Correct answer)
- A patient's insurance company
- A state health department
Correct answer: A vendor or contractor who handles PHI on behalf of a covered entity
A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity, such as a billing service.
Question 3: What must a dermatology practice provide to new patients at their first visit regarding their privacy rights?
- HIPAA Security Rule summary
- Notice of Privacy Practices (NPP) (Correct answer)
- Business Associate Agreement
- Release of Information Form
Correct answer: Notice of Privacy Practices (NPP)
Covered entities must provide patients with a Notice of Privacy Practices describing how their PHI may be used and their rights.
Question 4: A dermatology medical biller posts patient names and diagnosis codes on a shared office whiteboard visible to other patients. This is a violation of:
- OSHA regulations
- HIPAA Privacy Rule (Correct answer)
- The Fair Debt Collection Practices Act
- CMS Conditions of Participation
Correct answer: HIPAA Privacy Rule
Displaying patient PHI in areas visible to unauthorized individuals violates the HIPAA Privacy Rule's requirement to safeguard PHI.
Question 5: Which of the following is an example of a HIPAA Security Rule safeguard?
- Giving each staff member the same login credentials for efficiency
- Requiring unique user IDs and passwords for electronic health record access (Correct answer)
- Faxing PHI without a cover sheet to save time
- Leaving patient charts at the front desk
Correct answer: Requiring unique user IDs and passwords for electronic health record access
The HIPAA Security Rule requires technical safeguards such as unique user IDs to control access to electronic PHI (ePHI).
Question 6: What is the maximum civil monetary penalty per violation category under HIPAA for willful neglect not corrected?
- $10,000
- $50,000
- $100,000
- $1,900,000 per calendar year per violation category (Correct answer)
Correct answer: $1,900,000 per calendar year per violation category
For willful neglect not corrected, HIPAA penalties can reach $1,919,173 per calendar year per violation category (adjusted for inflation).
CPCA CPCA Medical Records and HIPAA Privacy 2
What document must a patient sign to authorize the release of their PHI to a third party not involved in treatment, payment, or operations?