Medical Information Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Medical Information flashcards as text
A patient wants to amend an error in their medical record. Under HIPAA, a covered entity may deny the amendment request if:
Answer: The record was not created by the covered entity receiving the request
A covered entity may deny an amendment request if it did not create the record in question, among other valid grounds for denial listed in the Privacy Rule.
Which scenario represents an incidental disclosure that is permissible under HIPAA?
Answer: A patient overhears a nurse calling a name from a waiting room list
Incidental disclosures that occur as a byproduct of permissible communication—such as calling out a patient's name—are allowed if reasonable safeguards are in place.
Under HIPAA's Privacy Rule, a covered entity must provide patients with a Notice of Privacy Practices (NPP). What must this notice include?
Answer: A description of how PHI may be used and disclosed, and patient rights
The NPP must describe how the covered entity uses and discloses PHI, patient rights regarding their information, and the entity's legal duties to protect PHI.
A covered entity discloses PHI to a public health authority to report a communicable disease. This disclosure is:
Answer: Permitted under HIPAA's public health activities exception
HIPAA permits disclosure to public health authorities for activities such as disease reporting without patient authorization under the public health activities exception.
What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?
Answer: To ensure business associates contractually agree to protect PHI they handle
A BAA is a contract requiring business associates to appropriately safeguard PHI they create, receive, maintain, or transmit on behalf of a covered entity.
Under HIPAA, which of the following represents a 'use' of PHI rather than a 'disclosure'?
Answer: A billing department internally accesses patient records to submit claims
A 'use' occurs when PHI is accessed or shared within the same covered entity, while a 'disclosure' involves sharing PHI with external parties.
A healthcare provider may share a patient's PHI with a family member without patient authorization when:
Answer: The patient is present and does not object, or the provider determines it is in the patient's best interest
HIPAA permits sharing PHI with family members when the patient is present, given the opportunity to agree or object, and does not object, or when the provider deems it in the patient's best interest.