HAC Healthcare Analytics Policy & Compliance 3 — Questions and Answers
Question 1: The ONC's Information Blocking Rule prohibits healthcare actors from interfering with the access, exchange, or use of electronic health information (EHI). Which entity is NOT considered a regulated 'actor' under this rule?
- Individual patients requesting their own records (Correct answer)
- Certified Health IT Developers
- Health Information Networks (HINs)
- Healthcare providers with certified EHR technology
Correct answer: Individual patients requesting their own records
Individual patients are the intended beneficiaries of the Information Blocking Rule, not regulated actors subject to its prohibitions.
Question 2: Under the Medicare Conditions of Participation, hospitals must retain medical records for at least:
- 5 years from the date of discharge or 3 years after a minor reaches age 18 (Correct answer)
- 7 years from the date of service
- 10 years from the date of service
- Permanently for all inpatient records
Correct answer: 5 years from the date of discharge or 3 years after a minor reaches age 18
CMS Conditions of Participation require hospitals to retain patient records for at least 5 years, or 3 years after a minor patient reaches age 18, whichever is longer.
Question 3: A healthcare analytics vendor is classified as a HIPAA Business Associate when it:
- Creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a service (Correct answer)
- Provides software tools that only process de-identified data
- Operates solely as a subcontractor to another business associate with no covered entity relationship
- Stores only aggregated population health data without individual identifiers
Correct answer: Creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a service
A business associate is any entity that performs functions or activities involving PHI on behalf of a covered entity, triggering the need for a Business Associate Agreement (BAA).
Question 4: The Federal Anti-Kickback Statute (AKS) in healthcare prohibits:
- Offering remuneration to induce referrals for services covered by federal healthcare programs (Correct answer)
- Billing Medicare for services not rendered
- Sharing patient data across health systems without consent
- Accepting gifts from pharmaceutical companies below $25 in value
Correct answer: Offering remuneration to induce referrals for services covered by federal healthcare programs
The AKS prohibits knowingly offering, paying, soliciting, or receiving anything of value to induce or reward referrals of items or services covered by federal healthcare programs.
Question 5: When a healthcare organization performs a HIPAA Security Risk Assessment, the analysis must cover:
- All electronic PHI (ePHI) that the organization creates, receives, maintains, or transmits (Correct answer)
- Only ePHI stored on servers within the organization's physical premises
- PHI in both paper and electronic format across all locations
- Only systems that directly connect to external networks or the internet
Correct answer: All electronic PHI (ePHI) that the organization creates, receives, maintains, or transmits
The HIPAA Security Risk Assessment must evaluate all ePHI regardless of where it is stored or transmitted, including cloud, mobile, and third-party systems.
Question 6: The Stark Law (Physician Self-Referral Law) primarily prohibits:
- Physicians from referring Medicare/Medicaid patients to entities in which the physician has a financial relationship, absent an exception (Correct answer)
- Hospitals from paying productivity bonuses to employed physicians
- Physicians from owning stock in publicly traded pharmaceutical companies
- Analytics companies from sharing performance data with referring physicians
Correct answer: Physicians from referring Medicare/Medicaid patients to entities in which the physician has a financial relationship, absent an exception
Stark Law is a strict liability statute that prohibits physician self-referrals to designated health service entities where the physician has a direct or indirect financial relationship, unless a specific exception applies.
Question 7: Under the False Claims Act, the 'qui tam' provision allows:
- Private individuals (whistleblowers) to file lawsuits on behalf of the government and share in recovered funds (Correct answer)
- The government to seek triple damages for fraudulent Medicare claims
- The OIG to exclude providers from federal programs without court proceedings
- CMS to retroactively audit claims up to 10 years old
Correct answer: Private individuals (whistleblowers) to file lawsuits on behalf of the government and share in recovered funds
The qui tam provision enables private whistleblowers (relators) to file False Claims Act suits on behalf of the government and receive 15–30% of any recovered funds.
HAC Healthcare Analytics Policy & Compliance 3
The ONC's Information Blocking Rule prohibits healthcare actors from interfering with the access, exchange, or use of electronic health information (EHI).
Which entity is NOT considered a regulated 'actor' under this rule?