CVS Patient Confidentiality and HIPAA 4 — Questions and Answers
Question 1: A patient's adult child calls CVS asking for their parent's prescription status, claiming to be the caregiver. What is the proper procedure?
- Provide full prescription details since the caller identified as a caregiver
- Verify the patient has granted the caller access as a personal representative or authorized contact (Correct answer)
- Refuse all third-party inquiries regardless of claimed relationship
- Share only the medication name but not the dosage or refill date
Correct answer: Verify the patient has granted the caller access as a personal representative or authorized contact
The pharmacy must confirm the individual is listed as a personal representative or authorized contact before sharing PHI with a third party.
Question 2: Which component is part of the HIPAA Security Rule but NOT the Privacy Rule?
- Patient right to access their own records
- Notice of Privacy Practices
- Technical safeguards for electronic PHI such as encryption and access controls (Correct answer)
- Minimum necessary standard for disclosures
Correct answer: Technical safeguards for electronic PHI such as encryption and access controls
The Security Rule specifically addresses electronic PHI (ePHI) and mandates technical, administrative, and physical safeguards.
Question 3: A pharmacy technician accidentally sends a patient's medication information to the wrong fax number. This is an example of:
- An intentional HIPAA violation subject to criminal penalties
- An incidental disclosure that is always permitted under HIPAA
- An impermissible disclosure that may constitute a reportable breach (Correct answer)
- A routine operational error that requires no documentation
Correct answer: An impermissible disclosure that may constitute a reportable breach
Sending PHI to the wrong recipient is an impermissible disclosure that must be evaluated under the breach notification rules.
Question 4: Which of the following best describes a 'business associate' under HIPAA?
- Any employee who works at a covered entity
- A vendor or contractor that creates, receives, maintains, or transmits PHI on behalf of a covered entity (Correct answer)
- A patient who shares their records with another healthcare provider
- A government auditor reviewing pharmacy compliance
Correct answer: A vendor or contractor that creates, receives, maintains, or transmits PHI on behalf of a covered entity
A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity and must sign a Business Associate Agreement.
Question 5: A pharmacist wants to post a thank-you note on the store bulletin board featuring a patient's name and the condition they were helped with. Under HIPAA, this requires:
- No special action because bulletin boards are inside the pharmacy
- A signed written authorization from the patient (Correct answer)
- Only verbal consent from the patient recorded in the system
- Approval from the store manager alone
Correct answer: A signed written authorization from the patient
Using a patient's name alongside their health condition for marketing or public display requires a signed HIPAA authorization.
Question 6: Under the HIPAA Privacy Rule, a patient has the right to request an amendment to their health record. The covered entity may deny this request if:
- The record was created more than one year ago
- The record was not created by the covered entity or is accurate and complete (Correct answer)
- The patient does not provide a written reason for the amendment
- The information involves a sensitive diagnosis
Correct answer: The record was not created by the covered entity or is accurate and complete
A covered entity may deny an amendment request if it did not create the record or if the information is accurate and complete.
Question 7: Which of the following actions would violate HIPAA's minimum necessary standard?
- A technician accesses only the prescription that a patient is picking up
- A pharmacist reviews a patient's full medication history to check for drug interactions during counseling
- A billing clerk views every patient's complete medical history to process a single insurance claim (Correct answer)
- A pharmacist accesses a patient's allergy information before dispensing a new medication
Correct answer: A billing clerk views every patient's complete medical history to process a single insurance claim
Accessing an entire medical history for a billing task that only requires limited information violates the minimum necessary standard.
CVS Patient Confidentiality and HIPAA 4
A patient's adult child calls CVS asking for their parent's prescription status, claiming to be the caregiver.
What is the proper procedure?