CVS Patient Confidentiality and HIPAA 2 — Questions and Answers
Question 1: A patient calls the pharmacy and asks a technician to fax their prescription records to their new employer. What should the technician do?
- Fax the records immediately since the patient authorized it
- Decline because employers are never permitted to receive PHI
- Verify the patient's identity, obtain a signed authorization, then release only what is needed (Correct answer)
- Transfer the call to the pharmacist who will decide without any authorization form
Correct answer: Verify the patient's identity, obtain a signed authorization, then release only what is needed
A signed HIPAA authorization from the patient is required before releasing PHI to a third party such as an employer.
Question 2: Which of the following is considered a HIPAA-covered entity?
- A staffing agency that places pharmacy technicians
- A health insurance plan that pays prescription claims (Correct answer)
- A law firm that advises a pharmacy on compliance
- A janitorial company that cleans the pharmacy
Correct answer: A health insurance plan that pays prescription claims
Health plans, healthcare clearinghouses, and healthcare providers that transmit PHI electronically are covered entities under HIPAA.
Question 3: Under HIPAA, what is the minimum necessary standard?
- Only the minimum number of employees may access patient records
- PHI should be disclosed only to the extent needed to accomplish the intended purpose (Correct answer)
- A minimum of two staff members must verify each PHI disclosure
- Pharmacies must maintain records for a minimum of six years
Correct answer: PHI should be disclosed only to the extent needed to accomplish the intended purpose
The minimum necessary standard requires that only the PHI needed to fulfill a specific purpose is accessed or disclosed.
Question 4: A CVS patient presents a prescription and mentions she does not want her husband, who is also a CVS customer, to know what medication she is picking up. What is the correct action?
- Inform the husband if he asks directly, since spouses share medical rights
- Honor the patient's request and keep her prescription information private (Correct answer)
- Refuse to fill the prescription without the husband's consent
- Document the request but share information if the husband presents ID
Correct answer: Honor the patient's request and keep her prescription information private
Patients have the right to request confidential communications and restrict who receives their PHI.
Question 5: Which action best demonstrates proper disposal of PHI at a pharmacy?
- Placing printed patient labels in a recycling bin
- Tossing outdated prescription receipts in a regular trash can
- Cross-shredding documents containing patient information before discarding (Correct answer)
- Storing old records in an unlocked back room indefinitely
Correct answer: Cross-shredding documents containing patient information before discarding
PHI must be rendered unreadable before disposal; cross-shredding printed materials is an approved method.
Question 6: A pharmacy technician overhears a colleague discussing a celebrity patient's medication in the break room. What should the technician do?
- Join the conversation since all staff are bound by HIPAA anyway
- Remind the colleague that discussing PHI in non-private areas is a HIPAA violation (Correct answer)
- Report the incident anonymously to the media as a public interest matter
- Do nothing because verbal conversations are not covered by HIPAA
Correct answer: Remind the colleague that discussing PHI in non-private areas is a HIPAA violation
HIPAA prohibits incidental disclosures of PHI in public or semi-public spaces; the technician should address the violation.
Question 7: What must a pharmacy provide to new patients under HIPAA?
- A full copy of all federal privacy regulations
- A Notice of Privacy Practices explaining how PHI is used and protected (Correct answer)
- Written consent from the patient's primary care physician
- A government-issued HIPAA compliance certificate
Correct answer: A Notice of Privacy Practices explaining how PHI is used and protected
Covered entities must provide patients with a Notice of Privacy Practices (NPP) at the first point of service.
CVS Patient Confidentiality and HIPAA 2
A patient calls the pharmacy and asks a technician to fax their prescription records to their new employer.
What should the technician do?