CTC Regulatory Compliance & Privacy Standards 3 — Questions and Answers
Question 1: Under the Ryan Haight Online Pharmacy Consumer Protection Act, which condition historically required an in-person evaluation before a practitioner could prescribe controlled substances via telehealth?
- The patient must reside in the same state as the prescriber
- A valid patient-provider relationship must be established through at least one in-person evaluation (Correct answer)
- The prescription must be for a Schedule III or lower substance
- The patient must have a primary care physician on record
Correct answer: A valid patient-provider relationship must be established through at least one in-person evaluation
The Ryan Haight Act required at least one prior in-person medical evaluation before prescribing controlled substances via telemedicine.
Question 2: A telehealth coordinator notices that a provider's video platform is not encrypted end-to-end. Under HIPAA's Security Rule, this most directly violates which standard?
- Facility access controls
- Transmission security (Correct answer)
- Audit controls
- Person or entity authentication
Correct answer: Transmission security
HIPAA's transmission security standard requires covered entities to implement technical security measures to guard against unauthorized access to ePHI in transit.
Question 3: During a telehealth visit, a provider accidentally leaves patient records visible on a shared screen that family members can see. This is an example of:
- A required breach notification
- An incidental disclosure that is always HIPAA-compliant
- A potential HIPAA violation requiring investigation (Correct answer)
- A permissible use under treatment purposes
Correct answer: A potential HIPAA violation requiring investigation
Accidental exposure of PHI to unauthorized individuals requires investigation to determine if it constitutes a reportable breach.
Question 4: A telehealth organization operates in a state with a telehealth parity law. What does this law typically require?
- That telehealth services be reimbursed at the same rate as in-person services (Correct answer)
- That all providers be licensed in the patient's state
- That telehealth visits be limited to established patients
- That encryption meet FIPS 140-2 standards
Correct answer: That telehealth services be reimbursed at the same rate as in-person services
Telehealth parity laws require insurers to reimburse telehealth services at rates comparable to equivalent in-person services.
Question 5: Which CMS Conditions of Participation are most relevant to a hospital-based telehealth program regarding patient rights?
- 42 CFR Part 482 — Conditions of Participation for Hospitals (Correct answer)
- 45 CFR Part 164 — HIPAA Security Rule
- 42 CFR Part 2 — Substance Abuse Confidentiality
- 21 CFR Part 11 — Electronic Records
Correct answer: 42 CFR Part 482 — Conditions of Participation for Hospitals
42 CFR Part 482 establishes the Conditions of Participation hospitals must meet, including patient rights applicable to telehealth.
Question 6: A telehealth coordinator must ensure that a Business Associate Agreement is in place before sharing PHI with a transcription service. The BAA must specify that the business associate will:
- Retain PHI indefinitely for audit purposes
- Use PHI only for the purposes permitted by the agreement and safeguard it appropriately (Correct answer)
- Obtain separate patient authorization for each use of PHI
- Destroy PHI within 30 days of the service contract ending
Correct answer: Use PHI only for the purposes permitted by the agreement and safeguard it appropriately
A BAA must stipulate that the business associate will use and disclose PHI only as permitted and will implement appropriate safeguards.
Question 7: Under HITECH, what is the maximum annual civil monetary penalty per violation category for willful neglect that is not corrected?
- $10,000
- $50,000
- $100,000
- $1,900,000 (Correct answer)
Correct answer: $1,900,000
HITECH set the maximum penalty for uncorrected willful neglect at $1,919,173 (adjusted) per violation category per year.
CTC Regulatory Compliance & Privacy Standards 3
Under the Ryan Haight Online Pharmacy Consumer Protection Act, which condition historically required an in-person evaluation before a practitioner could prescribe controlled substances via telehealth?