CPCA Medical Records and HIPAA Privacy Flashcards
6 cards from real CPCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CPCA Medical Records and HIPAA Privacy flashcards as text
What document must a patient sign to authorize the release of their PHI to a third party not involved in treatment, payment, or operations?
Answer: HIPAA Authorization Form
A signed HIPAA Authorization Form is required before disclosing PHI for purposes outside of treatment, payment, and healthcare operations.
Under HIPAA, a 'business associate' is best described as:
Answer: A vendor or contractor who handles PHI on behalf of a covered entity
A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity, such as a billing service.
What must a dermatology practice provide to new patients at their first visit regarding their privacy rights?
Answer: Notice of Privacy Practices (NPP)
Covered entities must provide patients with a Notice of Privacy Practices describing how their PHI may be used and their rights.
A dermatology medical biller posts patient names and diagnosis codes on a shared office whiteboard visible to other patients. This is a violation of:
Answer: HIPAA Privacy Rule
Displaying patient PHI in areas visible to unauthorized individuals violates the HIPAA Privacy Rule's requirement to safeguard PHI.
Which of the following is an example of a HIPAA Security Rule safeguard?
Answer: Requiring unique user IDs and passwords for electronic health record access
The HIPAA Security Rule requires technical safeguards such as unique user IDs to control access to electronic PHI (ePHI).
What is the maximum civil monetary penalty per violation category under HIPAA for willful neglect not corrected?
Answer: $1,900,000 per calendar year per violation category
For willful neglect not corrected, HIPAA penalties can reach $1,919,173 per calendar year per violation category (adjusted for inflation).