CVS - Assessment Patient Confidentiality and HIPAA Questions and Answers

Question 1

A patient's adult child calls the pharmacy asking if their mother's blood pressure medication has been refilled, explaining they are on their way to pick it up. Which of the following is the most appropriate response to comply with HIPAA?

Accepted Answer

"Due to privacy laws, I can only provide information to the patient unless she has given us specific permission. Are you listed as an authorized person on her account?"

Answer

HIPAA's Privacy Rule prevents the disclosure of Protected Health Information (PHI) to unauthorized individuals. Confirming the status of a specific medication for an identified patient is a disclosure of PHI. The correct procedure is to first verify if the person making the request has been given prior authorization by the patient to receive such information before sharing any details.

Question 2

Which of the following is the best way to dispose of paper documents containing Protected Health Information (PHI), such as old prescription labels or patient profiles?

Accepted Answer

Placing them in a designated, secure shred bin for confidential destruction.

Answer

HIPAA requires that PHI be disposed of in a manner that renders it unreadable, indecipherable, and unable to be reconstructed. Placing documents in a secure shred bin is the standard and most effective method used in pharmacies to ensure compliance and protect patient privacy. Other methods like tearing or blacking out names do not sufficiently guarantee that the information cannot be pieced back together.

Question 3

The HIPAA "Minimum Necessary" standard is a key principle of patient privacy. Which of the following scenarios best demonstrates the correct application of this standard?

Accepted Answer

When an insurance company calls to verify a patient's date of birth for a claim, the pharmacy technician provides only the date of birth.

Answer

The Minimum Necessary standard requires that employees only access, use, or disclose the minimum amount of PHI needed to accomplish a specific task. In this case, the insurance company only needs the date of birth, so providing only that specific piece of information correctly applies the standard. The other options involve accessing or sharing more information than is required for the immediate task.

Question 4

A person comes to the pharmacy counter and sees a prescription bag for their neighbor, Jane Doe, on the will-call shelf. They ask you, "Oh, is that for Jane? I can just take that to her." How should you respond?

Accepted Answer

"For her privacy and safety, I cannot confirm who that prescription belongs to or release it without verifying pickup authorization and patient identifiers, like her date of birth."

Answer

Even if the prescription is visible, confirming it belongs to Jane Doe and releasing it to an unverified third party is a HIPAA violation. The correct action is to protect the patient's privacy by not acknowledging the PHI and stating the policy for authorized pickup, which requires verification of the person's authority and the patient's identity.

Question 5

While counseling a patient at the counter, a pharmacist speaks loudly, and another customer waiting several feet away overhears the patient's name and the medication being discussed. Under HIPAA, what is this situation most likely considered?

Accepted Answer

An incidental disclosure, which is permissible if reasonable safeguards were in place.

Answer

An incidental disclosure is a secondary disclosure of PHI that cannot be reasonably prevented and occurs as a by-product of a permitted use or disclosure (like patient counseling). As long as the pharmacy has taken reasonable safeguards, such as asking waiting customers to stand back or speaking in a lowered voice, this is not considered a violation. It is an expected part of pharmacy operations.

CVS - Assessment Practice Test

CVS - Assessment Practice Test

CVS - Assessment Patient Confidentiality and HIPAA Questions and Answers