HIPAA - Health Insurance Portability and Accountability Act The HIPAA Privacy Rule Questions and Answers — Questions and Answers
Question 1: A hospital billing department needs to send a list of patient accounts to a third-party collection agency. According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following actions is most appropriate?
- Send the entire medical record for each patient to provide complete context.
- Disclose only the demographic and financial information necessary for collection purposes. (Correct answer)
- Provide the patient's name and total amount due, but no contact information.
- Refuse to disclose any information without a court order for each individual patient.
Correct answer: Disclose only the demographic and financial information necessary for collection purposes.
The 'minimum necessary' standard requires covered entities to make reasonable efforts to limit the use or disclosure of Protected Health Information (PHI) to the minimum necessary to accomplish the intended purpose. For debt collection, this includes demographic information to identify and locate the individual and financial information about the debt, but not their entire clinical history.
Question 2: Under the HIPAA Privacy Rule, which of the following is NOT considered Protected Health Information (PHI)?
- A patient's medical record number.
- A de-identified health summary used for a statistical study. (Correct answer)
- An email from a patient to their doctor's office.
- A photograph of a patient's face stored in their electronic health record.
Correct answer: A de-identified health summary used for a statistical study.
Protected Health Information (PHI) is individually identifiable health information. Information that has been de-identified, meaning all 18 specific identifiers (like name, address, dates, etc.) have been removed, is no longer considered PHI and is not subject to the Privacy Rule.
Question 3: A patient exercises their right to access their PHI and requests a copy of their medical records from a covered entity. The covered entity has a policy of charging a flat fee of $100 for all record requests to cover costs. This policy is:
- Permissible, as covered entities can charge for the labor involved in copying records.
- Not permissible, as covered entities can only charge a reasonable, cost-based fee and must inform the patient of the approximate fee in advance. (Correct answer)
- Permissible, as long as the fee is applied uniformly to all patients.
- Not permissible, as covered entities are required to provide the first copy of records for free.
Correct answer: Not permissible, as covered entities can only charge a reasonable, cost-based fee and must inform the patient of the approximate fee in advance.
The HIPAA Privacy Rule allows covered entities to charge a reasonable, cost-based fee for copies of PHI. This fee can only include the cost of labor for copying, supplies (e.g., paper, CD), and postage. A flat fee is generally not permissible unless the entity can show it is a reasonable estimate of average costs. Patients have a right to be informed of the approximate fee beforehand.
Question 4: In which of the following scenarios is a covered entity permitted to disclose PHI without the patient's authorization?
- To a pharmaceutical company for marketing purposes.
- To the patient's employer to verify sick leave.
- To a public health authority for disease surveillance purposes as required by law. (Correct answer)
- To a journalist writing a story about the hospital's new technology.
Correct answer: To a public health authority for disease surveillance purposes as required by law.
The HIPAA Privacy Rule permits disclosures without individual authorization for specific public interest and benefit activities. This includes disclosures to a public health authority (like the CDC or a state health department) that is legally authorized to collect or receive such information for purposes like preventing or controlling disease.
Question 5: A patient's friend calls a hospital and asks for an update on the patient's condition. The patient is conscious and able to make their own decisions. According to the HIPAA Privacy Rule, what should the hospital staff do?
- Provide a general, one-word condition update (e.g., 'stable').
- Refuse to provide any information, citing HIPAA.
- Inform the patient of the friend's inquiry and ask the patient if they consent to the disclosure. (Correct answer)
- Give the friend the patient's room number and direct visiting hours.
Correct answer: Inform the patient of the friend's inquiry and ask the patient if they consent to the disclosure.
If the patient has the capacity to make their own decisions, the covered entity must provide them with the opportunity to agree or object to the disclosure of their information to family, friends, or others involved in their care. The staff should ask the patient for permission before sharing any information.
Question 6: Which of the following rights does the HIPAA Privacy Rule grant to individuals regarding their Protected Health Information (PHI)?
- The right to have factually incorrect information removed from their medical record entirely.
- The right to receive a free, comprehensive audit trail of every internal access to their electronic record.
- The right to demand that their health plan not be informed of treatment for which they paid out-of-pocket in full. (Correct answer)
- The right to sue a business associate directly for a privacy violation.
Correct answer: The right to demand that their health plan not be informed of treatment for which they paid out-of-pocket in full.
The HIPAA Privacy Rule gives individuals the right to request restrictions on certain uses and disclosures of their PHI. A key right is to restrict disclosures to a health plan if the individual has paid for the service or item out-of-pocket in full. The provider must agree to this request.
HIPAA - Health Insurance Portability and Accountability Act The HIPAA Privacy Rule Questions and Answers
A hospital billing department needs to send a list of patient accounts to a third-party collection agency.
According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following actions is most appropriate?