CVS - Assessment Patient Confidentiality and HIPAA Questions and Answers — Questions and Answers
Question 1: A patient's adult child calls the pharmacy asking if their mother's blood pressure medication has been refilled, explaining they are on their way to pick it up. Which of the following is the most appropriate response to comply with HIPAA?
- "Yes, the prescription for her lisinopril is ready for pickup."
- "I can see there is a prescription ready, but I cannot tell you who it is for or what it is."
- "Due to privacy laws, I can only provide information to the patient unless she has given us specific permission. Are you listed as an authorized person on her account?" (Correct answer)
- "You will need to ask your mother to call us directly to confirm her prescription status."
Correct answer: "Due to privacy laws, I can only provide information to the patient unless she has given us specific permission. Are you listed as an authorized person on her account?"
HIPAA's Privacy Rule prevents the disclosure of Protected Health Information (PHI) to unauthorized individuals. Confirming the status of a specific medication for an identified patient is a disclosure of PHI. The correct procedure is to first verify if the person making the request has been given prior authorization by the patient to receive such information before sharing any details.
Question 2: Which of the following is the best way to dispose of paper documents containing Protected Health Information (PHI), such as old prescription labels or patient profiles?
- Tearing them into several pieces before placing them in the regular trash.
- Placing them in a designated, secure shred bin for confidential destruction. (Correct answer)
- Blacking out the patient's name with a marker before putting them in the recycling bin.
- Storing them in a box in the back room until the end of the year.
Correct answer: Placing them in a designated, secure shred bin for confidential destruction.
HIPAA requires that PHI be disposed of in a manner that renders it unreadable, indecipherable, and unable to be reconstructed. Placing documents in a secure shred bin is the standard and most effective method used in pharmacies to ensure compliance and protect patient privacy. Other methods like tearing or blacking out names do not sufficiently guarantee that the information cannot be pieced back together.
Question 3: The HIPAA "Minimum Necessary" standard is a key principle of patient privacy. Which of the following scenarios best demonstrates the correct application of this standard?
- A technician gives a new cashier full access to the pharmacy computer system so they can look up patient profiles if needed.
- When an insurance company calls to verify a patient's date of birth for a claim, the pharmacy technician provides only the date of birth. (Correct answer)
- A pharmacist tells a patient's spouse the names of all the medications the patient is currently taking.
- To save time, a technician looks up a patient's entire medication history before the patient reaches the counter.
Correct answer: When an insurance company calls to verify a patient's date of birth for a claim, the pharmacy technician provides only the date of birth.
The Minimum Necessary standard requires that employees only access, use, or disclose the minimum amount of PHI needed to accomplish a specific task. In this case, the insurance company only needs the date of birth, so providing only that specific piece of information correctly applies the standard. The other options involve accessing or sharing more information than is required for the immediate task.
Question 4: A person comes to the pharmacy counter and sees a prescription bag for their neighbor, Jane Doe, on the will-call shelf. They ask you, "Oh, is that for Jane? I can just take that to her." How should you respond?
- "Sure, as long as you're going right there, it will save her a trip."
- "Okay, but can you please sign here stating you picked it up for her?"
- "For her privacy and safety, I cannot confirm who that prescription belongs to or release it without verifying pickup authorization and patient identifiers, like her date of birth." (Correct answer)
- "I can't give it to you, but I can call Jane and let her know you're here."
Correct answer: "For her privacy and safety, I cannot confirm who that prescription belongs to or release it without verifying pickup authorization and patient identifiers, like her date of birth."
Even if the prescription is visible, confirming it belongs to Jane Doe and releasing it to an unverified third party is a HIPAA violation. The correct action is to protect the patient's privacy by not acknowledging the PHI and stating the policy for authorized pickup, which requires verification of the person's authority and the patient's identity.
Question 5: While counseling a patient at the counter, a pharmacist speaks loudly, and another customer waiting several feet away overhears the patient's name and the medication being discussed. Under HIPAA, what is this situation most likely considered?
- A direct violation that must be reported to the federal government immediately.
- An incidental disclosure, which is permissible if reasonable safeguards were in place. (Correct answer)
- A permitted disclosure for treatment purposes.
- A breach of confidentiality requiring the patient's written notification.
Correct answer: An incidental disclosure, which is permissible if reasonable safeguards were in place.
An incidental disclosure is a secondary disclosure of PHI that cannot be reasonably prevented and occurs as a by-product of a permitted use or disclosure (like patient counseling). As long as the pharmacy has taken reasonable safeguards, such as asking waiting customers to stand back or speaking in a lowered voice, this is not considered a violation. It is an expected part of pharmacy operations.
Question 6: A law enforcement officer presents their badge and asks for a patient's address and medication history, stating it is for an official investigation. According to HIPAA and standard pharmacy procedure, what is the correct action?
- Provide the information immediately to cooperate with the investigation.
- Politely refuse and state that no patient information can ever be shared with law enforcement.
- Ask the officer to wait and immediately refer them to the Pharmacist-in-Charge, as a warrant, subpoena, or other legal order is typically required. (Correct answer)
- Give the officer the patient's address but withhold the medication history to minimize the disclosure.
Correct answer: Ask the officer to wait and immediately refer them to the Pharmacist-in-Charge, as a warrant, subpoena, or other legal order is typically required.
Disclosures of PHI to law enforcement are permitted under HIPAA but only under specific legal circumstances, such as with a court order, warrant, or subpoena. A simple request is not sufficient. The proper procedure is to escalate the request to the pharmacist, who is trained to verify the legal authority of the request before releasing any information.
CVS - Assessment Patient Confidentiality and HIPAA Questions and Answers
A patient's adult child calls the pharmacy asking if their mother's blood pressure medication has been refilled, explaining they are on their way to pick it up.
Which of the following is the most appropriate response to comply with HIPAA?