Patient Confidentiality and HIPAA Flashcards
7 cards from real CVS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Patient Confidentiality and HIPAA flashcards as text
A minor patient picks up birth control at CVS. Her parents later call asking for her prescription records. Under HIPAA, the pharmacy should:
Answer: Follow applicable state law, which may grant the minor the right to control this PHI
HIPAA defers to state law on minors' rights; many states allow minors to consent to certain services and control related PHI.
What is the maximum civil monetary penalty per violation category under HIPAA for willful neglect that is not corrected?
Answer: $1.9 million per violation category per year
Willful neglect violations that are not corrected carry the highest penalty tier, up to $1.9 million per violation category annually.
A patient opts out of the pharmacy's prescription refill reminder program. Under HIPAA, this is an example of exercising the right to:
Answer: Restrict certain uses and disclosures of their PHI
Patients have the right to request restrictions on how their PHI is used or disclosed for treatment, payment, or operations purposes.
Which of the following scenarios represents appropriate use of PHI for Treatment, Payment, or Operations (TPO) without requiring patient authorization?
Answer: Sending a patient's prescription information to their insurance company for claim adjudication
Sending PHI to an insurance company for payment (claim adjudication) is a standard TPO use that does not require separate authorization.
A pharmacy notices repeated unauthorized access to patient records by one employee. Under HIPAA, what is the appropriate response?
Answer: Investigate immediately, document findings, apply sanctions, and determine if a breach occurred
HIPAA requires covered entities to apply sanctions for policy violations, investigate potential breaches, and document their response.
Which of the following is an example of a physical safeguard required by the HIPAA Security Rule?
Answer: Restricting physical access to server rooms where ePHI is stored
Physical safeguards include measures like facility access controls, workstation placement, and secured server rooms to protect ePHI.
Under HIPAA, a patient who has paid out-of-pocket in full for a service may request that the pharmacy:
Answer: Not disclose that service to their health plan
HIPAA grants patients who self-pay in full the right to restrict disclosure of that specific service to their health plan.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy