Regulatory Compliance & Privacy Standards Flashcards

A telehealth organization must notify affected individuals of a breach of unsecured PHI within:

Answer: Without unreasonable delay and no later than 60 days of discovery

HIPAA requires individual breach notifications without unreasonable delay and no later than 60 calendar days after discovery.

Which of the following patient populations requires additional consent considerations beyond standard HIPAA for telehealth services?

Answer: Minors seeking reproductive health or substance use treatment services

Many states grant minors independent consent rights for sensitive services like reproductive health or substance use treatment, requiring separate consent analysis.

A telehealth coordinator is implementing a secure messaging system. To comply with HIPAA, the system must include which of the following controls?

Answer: Encryption of messages containing PHI at rest and in transit

HIPAA's Security Rule requires encryption or equivalent protection for ePHI both when stored and when transmitted.

Under CMS rules, which provider type was first authorized to serve as a telehealth distant site without geographic restrictions under the 2019 Medicare rule expansion?

Answer: Federally Qualified Health Centers (FQHCs) and Rural Health Clinics (RHCs)

CMS expanded Medicare telehealth to allow FQHCs and RHCs to serve as distant sites, addressing rural access gaps.

A telehealth coordinator implements role-based access controls (RBAC) to restrict which staff can view mental health records. This control most directly addresses which HIPAA Security Rule standard?

Answer: Access control

The access control standard requires covered entities to implement technical policies restricting access to ePHI to authorized users only.

A telehealth provider group discovers that a hacker accessed its patient scheduling system. The breach affects 700 patients. Under HIPAA, the organization must notify HHS:

Answer: Within 60 days of discovery

Breaches affecting fewer than 500 individuals must be reported to HHS within 60 days after the end of the calendar year, but breaches of 500+ trigger immediate 60-day HHS notification.

Which standard governs electronic prescribing for non-controlled substances in a telehealth encounter under federal Medicare Part D rules?

Answer: NCPDP SCRIPT standard

CMS requires use of the NCPDP SCRIPT standard for electronic prescribing under Medicare Part D for eligible prescribers.