HIPAA - Health Insurance Portability and Accountability Act Patient Rights Under HIPAA Questions and Answers — Questions and Answers
Question 1: A patient submits a written request to a covered entity to correct what they believe is a factual error in their medical record. Under the HIPAA Privacy Rule, what is the maximum time frame the entity has to respond to the patient's request for an amendment?
- 30 days from the date of the request.
- 60 days, with the option for one 30-day extension if the patient is notified in writing. (Correct answer)
- 90 days, as long as the amendment is complex.
- Immediately, but no later than 15 business days.
Correct answer: 60 days, with the option for one 30-day extension if the patient is notified in writing.
The HIPAA Privacy Rule at 45 C.F.R. § 164.526 requires a covered entity to act on a request for amendment no later than 60 days after receipt. The entity can extend this timeframe by an additional 30 days if it provides the individual with a written notice explaining the reason for the delay and the date by which it will complete its action.
Question 2: A patient requests an accounting of disclosures of their Protected Health Information (PHI) from a hospital. Which of the following disclosures must be EXCLUDED from this accounting report?
- A disclosure made to a public health authority for disease control purposes.
- A disclosure made to the patient's health plan for payment purposes. (Correct answer)
- A disclosure made to law enforcement in response to a court order.
- A disclosure made to a health oversight agency for an audit.
Correct answer: A disclosure made to the patient's health plan for payment purposes.
The HIPAA Privacy Rule specifically exempts disclosures made for Treatment, Payment, and healthcare Operations (TPO) from the accounting of disclosures requirement. Disclosures for public health activities, in response to court orders, or for health oversight are not part of TPO and must be included in an accounting if requested.
Question 3: A patient pays for a cosmetic procedure entirely out-of-pocket and asks the clinic not to share any information about this service with their health insurance plan. Under HIPAA, how must the clinic respond?
- The clinic can agree to the restriction but is not required to do so.
- The clinic must inform the health plan but can ask them to keep it confidential.
- The clinic must agree to the request to restrict disclosure to the health plan. (Correct answer)
- The clinic can deny the request because it conflicts with their billing practices.
Correct answer: The clinic must agree to the request to restrict disclosure to the health plan.
The HIPAA Privacy Rule requires a covered entity to agree to a request to restrict disclosure of PHI to a health plan if the disclosure is for payment or health care operations and the PHI pertains solely to a service for which the individual has paid the covered entity in full out-of-pocket. In this scenario, the provider's compliance is mandatory, not optional.
Question 4: Which of the following best describes a patient's right to request confidential communications from a healthcare provider under HIPAA?
- The provider must agree to any requested communication method, including unencrypted email, if the patient insists.
- The patient must provide a detailed reason, such as a threat of danger, for the provider to accommodate the request.
- The provider must accommodate reasonable requests to communicate via alternative means or at alternative locations. (Correct answer)
- The provider can charge an administrative fee for setting up an alternative method of communication.
Correct answer: The provider must accommodate reasonable requests to communicate via alternative means or at alternative locations.
Under 45 CFR § 164.522(b), a healthcare provider must permit individuals to request and must accommodate *reasonable* requests to receive communications of PHI by alternative means (e.g., cell phone vs. home phone) or at alternative locations (e.g., P.O. Box vs. home address). The provider cannot require the patient to explain the reason for the request.
Question 5: A health care provider with a direct treatment relationship is giving a new patient their Notice of Privacy Practices (NPP) for the first time. According to HIPAA, when must this occur?
- Within 30 days after the first service is provided.
- Only when the patient makes a written request for the notice.
- No later than the date of the first service delivery. (Correct answer)
- At least once every three years.
Correct answer: No later than the date of the first service delivery.
The HIPAA Privacy Rule requires that a covered health care provider with a direct treatment relationship with an individual must provide the Notice of Privacy Practices (NPP) no later than the date of the first service delivery. The requirement for health plans to notify members every three years is a different standard.
Question 6: A patient requests an electronic copy of their medical records, which the provider maintains electronically. The patient specifies that the records should be in a PDF format. How must the provider respond under the HIPAA Right of Access?
- The provider must supply the records in the requested PDF format if it is readily producible. (Correct answer)
- The provider can insist on providing paper copies to ensure security.
- The provider is only obligated to give a summary of the electronic health record, not the full file.
- The provider must convert the files to PDF format, even if it requires purchasing new software.
Correct answer: The provider must supply the records in the requested PDF format if it is readily producible.
Under the HIPAA Right of Access, if an individual requests an electronic copy of PHI that a covered entity maintains electronically, the entity must provide access in the electronic form and format requested, if it is 'readily producible' in that format. If it is not readily producible in that format, the entity must offer other readable electronic formats.
HIPAA - Health Insurance Portability and Accountability Act Patient Rights Under HIPAA Questions and Answers
A patient submits a written request to a covered entity to correct what they believe is a factual error in their medical record.
Under the HIPAA Privacy Rule, what is the maximum time frame the entity has to respond to the patient's request for an amendment?