HIPAA and Compliance Rules Flashcards

A medical scribe is working in a busy emergency department. After a patient encounter, the scribe jots down the patient's name and medical record number on a piece of scrap paper to remember to complete the chart later. The scribe then places the paper in their pocket and forgets about it until the end of their shift. Which core HIPAA principle has been violated?

Answer: Safeguarding Protected Health Information (PHI)

Writing down personally identifiable patient information on non-secure media like scrap paper and removing it from the clinical area is a violation of the fundamental requirement to safeguard PHI. HIPAA requires physical and administrative safeguards to be in place to protect patient information from unauthorized disclosure. The other options are incorrect because the Minimum Necessary Rule pertains to accessing only the data needed for a task, the Right of Access relates to a patient's ability to get their records, and the Breach Notification Rule applies after a breach has been confirmed.

Which of the following scenarios BEST illustrates the HIPAA 'Minimum Necessary' standard as it applies to a medical scribe?

Answer: Accessing only the current encounter notes and the lab results ordered by the physician during today's visit to complete the chart.

The 'Minimum Necessary' rule requires that access to Protected Health Information (PHI) be limited to only what is needed to accomplish a specific task. For a scribe, this means accessing the information directly relevant to the current patient encounter they are documenting, not the entire medical history unless instructed. Browsing old records out of curiosity, discussing cases in non-secure areas, and using unsecured personal devices are all violations of HIPAA principles.

A medical scribe is employed by a third-party scribe service company, not directly by the hospital. In the context of HIPAA, what is the scribe service company's relationship to the hospital?

Answer: Business Associate

A Business Associate is a person or entity that performs certain functions or activities on behalf of a Covered Entity (like a hospital) that involve the use or disclosure of Protected Health Information (PHI). Since the scribe service handles PHI on behalf of the hospital, it is considered a Business Associate and must have a signed Business Associate Agreement (BAA) in place.

A patient at a clinic discovers that their medical record contains an error documented by a scribe. According to the HIPAA Privacy Rule, what right does the patient have regarding this information?

Answer: The right to request an amendment to their medical record.

The HIPAA Privacy Rule grants patients the right to request an amendment to their protected health information in a designated record set. While they can request a correction, it does not guarantee the original entry will be deleted; instead, an addendum or correction is typically made to the record. The other options are incorrect; patients cannot directly delete or add notes to the EHR, and a documentation error does not automatically constitute grounds for a malpractice suit against the scribe.

Under the HIPAA Security Rule, which of the following is considered a critical TECHNICAL safeguard for a medical scribe using an Electronic Health Record (EHR) system?

Answer: Using a unique, strong password and enabling two-factor authentication.

The HIPAA Security Rule specifies three types of safeguards: administrative, physical, and technical. Unique user identification, such as a username and strong password, is a fundamental technical safeguard required to control access to electronic PHI (ePHI). Signing a confidentiality agreement is an administrative safeguard, while screen positioning and shredding documents are physical safeguards.

A hospital discovers that a scribe's unencrypted work laptop, containing the PHI of 600 patients, was stolen. According to the HIPAA Breach Notification Rule, which of the following actions is the hospital required to take?

Answer: Notify all affected individuals, the local media, and the Secretary of HHS within 60 days of discovery.

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay, and in no case later than 60 days following the discovery of a breach. Because this breach affects more than 500 individuals, the rule also mandates notifying prominent media outlets in the state or jurisdiction and notifying the Secretary of Health and Human Services (HHS) concurrently with the individual notifications.