CVS Patient Confidentiality and HIPAA 4

Question 1

A patient's adult child calls CVS asking for their parent's prescription status, claiming to be the caregiver. What is the proper procedure?

Accepted Answer

Verify the patient has granted the caller access as a personal representative or authorized contact

Answer

The pharmacy must confirm the individual is listed as a personal representative or authorized contact before sharing PHI with a third party.

Question 2

Which component is part of the HIPAA Security Rule but NOT the Privacy Rule?

Accepted Answer

Technical safeguards for electronic PHI such as encryption and access controls

Answer

The Security Rule specifically addresses electronic PHI (ePHI) and mandates technical, administrative, and physical safeguards.

Question 3

A pharmacy technician accidentally sends a patient's medication information to the wrong fax number. This is an example of:

Accepted Answer

An impermissible disclosure that may constitute a reportable breach

Answer

Sending PHI to the wrong recipient is an impermissible disclosure that must be evaluated under the breach notification rules.

Question 4

Which of the following best describes a 'business associate' under HIPAA?

Accepted Answer

A vendor or contractor that creates, receives, maintains, or transmits PHI on behalf of a covered entity

Answer

A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity and must sign a Business Associate Agreement.

Question 5

A pharmacist wants to post a thank-you note on the store bulletin board featuring a patient's name and the condition they were helped with. Under HIPAA, this requires:

Accepted Answer

A signed written authorization from the patient

Answer

Using a patient's name alongside their health condition for marketing or public display requires a signed HIPAA authorization.

CVS - Assessment Practice Test

CVS - Assessment Practice Test

CVS Patient Confidentiality and HIPAA 4