Patient Confidentiality and HIPAA Flashcards

A patient's adult child calls CVS asking for their parent's prescription status, claiming to be the caregiver. What is the proper procedure?

Answer: Verify the patient has granted the caller access as a personal representative or authorized contact

The pharmacy must confirm the individual is listed as a personal representative or authorized contact before sharing PHI with a third party.

Which component is part of the HIPAA Security Rule but NOT the Privacy Rule?

Answer: Technical safeguards for electronic PHI such as encryption and access controls

The Security Rule specifically addresses electronic PHI (ePHI) and mandates technical, administrative, and physical safeguards.

A pharmacy technician accidentally sends a patient's medication information to the wrong fax number. This is an example of:

Answer: An impermissible disclosure that may constitute a reportable breach

Sending PHI to the wrong recipient is an impermissible disclosure that must be evaluated under the breach notification rules.

Which of the following best describes a 'business associate' under HIPAA?

Answer: A vendor or contractor that creates, receives, maintains, or transmits PHI on behalf of a covered entity

A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity and must sign a Business Associate Agreement.

A pharmacist wants to post a thank-you note on the store bulletin board featuring a patient's name and the condition they were helped with. Under HIPAA, this requires:

Answer: A signed written authorization from the patient

Using a patient's name alongside their health condition for marketing or public display requires a signed HIPAA authorization.

Under the HIPAA Privacy Rule, a patient has the right to request an amendment to their health record. The covered entity may deny this request if:

Answer: The record was not created by the covered entity or is accurate and complete

A covered entity may deny an amendment request if it did not create the record or if the information is accurate and complete.

Which of the following actions would violate HIPAA's minimum necessary standard?

Answer: A billing clerk views every patient's complete medical history to process a single insurance claim

Accessing an entire medical history for a billing task that only requires limited information violates the minimum necessary standard.