Regulatory Compliance & Standards Flashcards

Under 42 CFR Part 2, which category of telehealth records receives heightened confidentiality protections beyond standard HIPAA requirements?

Answer: Substance use disorder records

42 CFR Part 2 provides special federal protections for substance use disorder (SUD) patient records, requiring specific written consent before disclosure even to other treating providers.

Which federal law established the Ryan Haight Online Pharmacy Consumer Protection Act provisions that restrict prescribing controlled substances via telehealth?

Answer: Controlled Substances Act

The Ryan Haight Act amended the Controlled Substances Act to require an in-person evaluation before prescribing Schedule II-V controlled substances via the internet or telehealth.

A telehealth coordinator is auditing a platform that stores PHI. Which technical safeguard under HIPAA Security Rule is specifically required for PHI transmitted over open networks?

Answer: Encryption and decryption

The HIPAA Security Rule requires encryption as an addressable implementation specification for PHI transmitted over open electronic networks to protect against unauthorized interception.

Which CMS condition applies when a Medicare patient receives telehealth services and the originating site is a patient's home?

Answer: No geographic restriction applies under current flexibilities

Under COVID-19 emergency flexibilities that were extended, Medicare patients can receive telehealth from their homes without geographic restrictions, removing the traditional rural-only limitation.

A CTC is reviewing a business associate agreement (BAA). Which entity is NOT required to sign a BAA under HIPAA?

Answer: Janitorial company with incidental PHI access

Workforce members and employees of a covered entity, including janitorial staff with only incidental contact, are not business associates and do not require a BAA.

Under HIPAA, what is the maximum penalty per violation category for willful neglect that is not corrected?

Answer: $1,900,000

Violations due to willful neglect not corrected within the required period carry a maximum penalty of $1,919,173 per violation category per year (adjusted for inflation from the original $1.5M cap).

Which standard governs the exchange of clinical documents in telehealth encounters for interoperability purposes?

Answer: HL7 CDA / FHIR

HL7 Clinical Document Architecture (CDA) and the newer FHIR (Fast Healthcare Interoperability Resources) standard govern the structured exchange of clinical documents between systems for interoperability.