CVS Patient Confidentiality and HIPAA 5 — Questions and Answers
Question 1: A minor patient picks up birth control at CVS. Her parents later call asking for her prescription records. Under HIPAA, the pharmacy should:
- Always share the records since parents are legal guardians of minors
- Follow applicable state law, which may grant the minor the right to control this PHI (Correct answer)
- Disclose only to the parent who holds primary custody
- Require a court order before responding to either the parents or the minor
Correct answer: Follow applicable state law, which may grant the minor the right to control this PHI
HIPAA defers to state law on minors' rights; many states allow minors to consent to certain services and control related PHI.
Question 2: What is the maximum civil monetary penalty per violation category under HIPAA for willful neglect that is not corrected?
- $1,000 per violation
- $10,000 per violation
- $50,000 per violation
- $1.9 million per violation category per year (Correct answer)
Correct answer: $1.9 million per violation category per year
Willful neglect violations that are not corrected carry the highest penalty tier, up to $1.9 million per violation category annually.
Question 3: A patient opts out of the pharmacy's prescription refill reminder program. Under HIPAA, this is an example of exercising the right to:
- Request an amendment to their health record
- Restrict certain uses and disclosures of their PHI (Correct answer)
- Obtain an accounting of disclosures
- Access their designated record set
Correct answer: Restrict certain uses and disclosures of their PHI
Patients have the right to request restrictions on how their PHI is used or disclosed for treatment, payment, or operations purposes.
Question 4: Which of the following scenarios represents appropriate use of PHI for Treatment, Payment, or Operations (TPO) without requiring patient authorization?
- Sharing a patient's medication list with a pharmaceutical marketing firm
- Sending a patient's prescription information to their insurance company for claim adjudication (Correct answer)
- Disclosing a patient's diagnosis to their employer for absence verification
- Providing prescription records to a researcher conducting a commercial drug trial
Correct answer: Sending a patient's prescription information to their insurance company for claim adjudication
Sending PHI to an insurance company for payment (claim adjudication) is a standard TPO use that does not require separate authorization.
Question 5: A pharmacy notices repeated unauthorized access to patient records by one employee. Under HIPAA, what is the appropriate response?
- Issue a verbal warning and monitor for 90 days before taking further action
- Investigate immediately, document findings, apply sanctions, and determine if a breach occurred (Correct answer)
- Terminate the employee first, then notify patients automatically
- Do nothing unless a patient complains formally
Correct answer: Investigate immediately, document findings, apply sanctions, and determine if a breach occurred
HIPAA requires covered entities to apply sanctions for policy violations, investigate potential breaches, and document their response.
Question 6: Which of the following is an example of a physical safeguard required by the HIPAA Security Rule?
- Using strong passwords for the pharmacy's dispensing software
- Installing a firewall on the pharmacy network
- Restricting physical access to server rooms where ePHI is stored (Correct answer)
- Encrypting patient emails sent between providers
Correct answer: Restricting physical access to server rooms where ePHI is stored
Physical safeguards include measures like facility access controls, workstation placement, and secured server rooms to protect ePHI.
Question 7: Under HIPAA, a patient who has paid out-of-pocket in full for a service may request that the pharmacy:
- Receive a full refund if they later get insurance coverage
- Not disclose that service to their health plan (Correct answer)
- Receive a paper copy of all pharmacy records free of charge
- Opt out of all future electronic communications permanently
Correct answer: Not disclose that service to their health plan
HIPAA grants patients who self-pay in full the right to restrict disclosure of that specific service to their health plan.
CVS Patient Confidentiality and HIPAA 5
A minor patient picks up birth control at CVS.
Her parents later call asking for her prescription records.
Under HIPAA, the pharmacy should: