CTP Legal, Ethical & Regulatory Compliance 3 — Questions and Answers
Question 1: Which ethical principle is MOST directly implicated when a telehealth provider fails to disclose limitations of remote diagnosis?
- Justice
- Non-maleficence
- Informed consent / Autonomy (Correct answer)
- Fidelity
Correct answer: Informed consent / Autonomy
Failing to disclose limitations of remote diagnosis violates informed consent, which is rooted in the ethical principle of patient autonomy.
Question 2: When a minor patient seeks confidential reproductive health services via telehealth, which framework primarily governs disclosure to parents?
- FERPA
- State minor consent laws (Correct answer)
- HIPAA alone
- The provider's institutional policy
Correct answer: State minor consent laws
State minor consent laws determine whether minors may consent to certain services confidentially and whether parents can access those records.
Question 3: A telehealth organization uses a patient's de-identified data for a research study without IRB approval. Which framework is most likely violated?
- HIPAA only
- The Common Rule (45 CFR Part 46) and research ethics standards (Correct answer)
- CAN-SPAM Act
- State telehealth parity laws
Correct answer: The Common Rule (45 CFR Part 46) and research ethics standards
The Common Rule requires IRB oversight for human subjects research, even when data appears de-identified, depending on how identifiability is assessed.
Question 4: Under HIPAA, which of the following constitutes a permissible disclosure of PHI without patient authorization?
- Sharing records with the patient's employer
- Disclosure for treatment, payment, or healthcare operations (TPO) (Correct answer)
- Marketing a related health product
- Selling patient data to a data analytics company
Correct answer: Disclosure for treatment, payment, or healthcare operations (TPO)
HIPAA permits disclosure of PHI without patient authorization for treatment, payment, and healthcare operations (TPO) purposes.
Question 5: Which of the following is a key feature of the Interstate Medical Licensure Compact (IMLC)?
- It eliminates the need for state medical licenses entirely
- It streamlines the process for physicians to obtain licenses in multiple member states (Correct answer)
- It allows physicians to practice in any state after passing a single federal exam
- It applies to all healthcare professions including nurses and therapists
Correct answer: It streamlines the process for physicians to obtain licenses in multiple member states
The IMLC is an agreement among member states that expedites the licensing process for physicians seeking licenses in multiple states, but does not replace individual state licenses.
Question 6: A telehealth provider suspects a patient is experiencing domestic violence. What is the provider's ethical obligation?
- Maintain complete confidentiality and take no further action
- Assess safety, provide resources, and follow mandatory reporting laws applicable in the patient's jurisdiction (Correct answer)
- Immediately contact law enforcement without discussing with the patient
- Refer to an in-person provider only and close the telehealth case
Correct answer: Assess safety, provide resources, and follow mandatory reporting laws applicable in the patient's jurisdiction
Providers must assess patient safety, offer resources, and comply with jurisdiction-specific mandatory reporting laws while maintaining the therapeutic relationship.
Question 7: Which standard governs the security of electronic protected health information (ePHI) in transit during a telehealth session?
- HIPAA Privacy Rule
- HIPAA Security Rule — Transmission Security standard (Correct answer)
- 21st Century Cures Act
- HITECH Act Breach Notification Rule
Correct answer: HIPAA Security Rule — Transmission Security standard
The HIPAA Security Rule's Transmission Security standard requires safeguards (such as encryption) to protect ePHI during electronic transmission.
CTP Legal, Ethical & Regulatory Compliance 3
Which ethical principle is MOST directly implicated when a telehealth provider fails to disclose limitations of remote diagnosis?