HIPAA and Patient Privacy Flashcards
6 cards from real CPMS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 HIPAA and Patient Privacy flashcards as text
A medical scribe is working remotely from home. Which of the following actions represents a potential HIPAA Security Rule violation?
Answer: Using a personal laptop that is not encrypted to access the EHR.
The HIPAA Security Rule requires specific technical safeguards for electronic protected health information (ePHI). Using an unencrypted personal device to access patient data is a significant security risk and a violation, as encryption renders data unreadable to unauthorized users.
While documenting a patient encounter, a scribe overhears a nurse in the hallway discussing another patient's recent diagnosis with a colleague. According to HIPAA, this is an example of:
Answer: A reportable breach of confidentiality.
Discussing specific patient information in public areas like hallways where the conversation can be overheard by unauthorized individuals is a violation of the patient's privacy and constitutes a reportable breach. Incidental disclosures are permissible only when reasonable safeguards are in place, which is not the case in a public hallway conversation.
Which of the following is considered Protected Health Information (PHI) under HIPAA?
Answer: A patient's appointment reminder email sent to their personal account.
PHI includes any individually identifiable health information. An email address linked to the fact that an individual has a medical appointment is considered PHI because it connects a personal identifier with health-related information.
A patient notices an incorrect date of birth in their electronic health record and requests a correction. According to the HIPAA Privacy Rule, what right is the patient exercising?
Answer: Right to Amend PHI
The HIPAA Privacy Rule gives patients the right to request an amendment or correction to their PHI if they believe it is inaccurate or incomplete. Healthcare providers are required to have a process in place to respond to such requests.
A medical scribe is asked by their physician to access the medical record of a celebrity who is not their patient, out of curiosity. What HIPAA principle would this action directly violate?
Answer: The Minimum Necessary Rule
The Minimum Necessary Rule is a key provision of the HIPAA Privacy Rule that requires covered entities to limit the use and disclosure of PHI to the minimum amount necessary to accomplish the intended purpose. Accessing a record without a legitimate job-related reason (i.e., for treatment, payment, or healthcare operations) is a clear violation of this principle.
A medical scribe's role is to document the physician-patient encounter. Under HIPAA, the scribe is considered a:
Answer: Business Associate
A Business Associate is a person or entity that performs certain functions or activities on behalf of a covered entity that involve the use or disclosure of PHI. Since scribes handle PHI as part of their job for the healthcare provider (the covered entity), they are considered Business Associates and must comply with HIPAA regulations.