Patient Confidentiality and HIPAA Flashcards
7 cards from real CVS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Patient Confidentiality and HIPAA flashcards as text
A law enforcement officer requests a patient's prescription fill history without a court order. Under HIPAA, a pharmacy may:
Answer: Disclose limited information in specific circumstances such as identifying a suspect or responding to a valid legal process
HIPAA permits certain disclosures to law enforcement under defined conditions, such as court orders, subpoenas, or specific crime-related situations.
Which of the following is NOT an element of protected health information (PHI)?
Answer: A de-identified aggregate statistic about flu vaccine uptake with no individual identifiers
Information that has been properly de-identified and contains no individual identifiers is not considered PHI under HIPAA.
How long must covered entities retain HIPAA-related policies and documentation?
Answer: 6 years from creation or last effective date
HIPAA requires covered entities to retain documentation of policies and procedures for six years from creation or when it was last in effect.
A pharmacy's electronic health records system is hacked and patient data is exposed. What is the pharmacy's obligation under the HIPAA Breach Notification Rule?
Answer: Notify affected individuals, HHS, and potentially media if the breach affects 500 or more individuals in a state
The Breach Notification Rule requires notifying affected individuals, HHS, and local media (for large breaches) within specific timeframes.
Which federal agency is responsible for enforcing HIPAA Privacy and Security Rules?
Answer: The Office for Civil Rights (OCR) within HHS
The HHS Office for Civil Rights (OCR) is the primary enforcer of HIPAA Privacy and Security Rules.
A patient requests an accounting of disclosures of their PHI. Which disclosures are included in this accounting?
Answer: Disclosures made without the patient's authorization, except those for TPO
HIPAA's right to an accounting covers disclosures made without authorization, but disclosures for treatment, payment, and healthcare operations are excluded.
Under HIPAA, which of the following represents a permissible use of PHI without patient authorization?
Answer: Disclosing PHI to a public health authority for disease surveillance
HIPAA permits disclosure of PHI to public health authorities for activities such as disease surveillance without patient authorization.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy