Legal, Ethical & Regulatory Compliance Flashcards
7 cards from real CTP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Legal, Ethical & Regulatory Compliance flashcards as text
A telehealth company markets its platform as 'HIPAA compliant' but has not signed BAAs with its vendors. This situation represents:
Answer: A potential HIPAA violation and deceptive marketing claim
Claiming HIPAA compliance without required BAAs is both a HIPAA violation and potentially deceptive marketing under FTC standards.
Which of the following is an example of a HIPAA minimum necessary standard violation in telehealth?
Answer: A billing coordinator accessing full psychiatric notes to process a payment
The minimum necessary standard requires that access to PHI be limited to what is needed for the specific job function; a billing coordinator does not need full psychiatric records.
Under CMS telehealth coverage rules (post-2020 waivers), which originating site requirement was temporarily relaxed during the COVID-19 public health emergency?
Answer: Patients could receive Medicare telehealth services from their homes, not just approved facilities
During the COVID-19 PHE, CMS waived the originating site restriction, allowing Medicare beneficiaries to receive telehealth services from their homes.
A telehealth provider discovers a data breach affecting 600 patients' ePHI. What is the HIPAA breach notification timeline for notifying HHS?
Answer: Within 60 days of discovery
HIPAA requires covered entities to notify HHS of breaches affecting 500 or more individuals within 60 days of discovery.
Which professional ethics concept requires a telehealth provider to act in the patient's best interest even when it conflicts with the provider's own financial interests?
Answer: Fiduciary duty
Fiduciary duty obligates providers to prioritize patient welfare over personal financial gain, a critical standard in avoiding conflicts of interest in telehealth.
A telehealth provider uses AI-generated diagnostic suggestions. Who bears primary legal and ethical responsibility for the final clinical decision?
Answer: The licensed clinician who acts on the AI output
The licensed clinician retains full professional and legal responsibility for clinical decisions, even when AI tools inform those decisions.
Which of the following actions would BEST demonstrate compliance with the ethical principle of justice in a telehealth practice?
Answer: Ensuring equitable access to telehealth services regardless of patients' socioeconomic status or geographic location
The principle of justice requires fair distribution of healthcare resources and access, including designing telehealth services that reduce rather than reinforce health disparities.