Protected Health Information (PHI) Flashcards

Electronic Protected Health Information (ePHI) differs from PHI in that it:

Answer: Is specifically governed by the HIPAA Security Rule in addition to the Privacy Rule

ePHI is PHI that is created, stored, transmitted, or received electronically, and it is subject to both the HIPAA Privacy Rule and the additional technical safeguards required by the Security Rule.

A covered entity may disclose PHI without patient authorization to report a communicable disease to a public health authority. This falls under which HIPAA exception?

Answer: Public health activities exception

HIPAA's public health activities exception permits covered entities to disclose PHI to public health authorities authorized by law to collect data for preventing or controlling disease.

Under HIPAA, which of the following workforce members should have access to a patient's complete medical record?

Answer: Only those whose job functions require that level of access

HIPAA's minimum necessary standard requires that access to PHI be limited to workforce members whose specific job duties require that information.

A patient requests access to their own PHI. Under HIPAA, the covered entity must generally provide access within:

Answer: 30 calendar days, with one possible 30-day extension

HIPAA requires covered entities to provide patients access to their PHI within 30 calendar days, with one permissible 30-day extension if the entity notifies the patient of the delay.

Which of the following scenarios would constitute an impermissible disclosure of PHI under HIPAA?

Answer: A nurse telling a patient's employer about their diagnosis without authorization

Disclosing a patient's diagnosis to their employer without authorization violates HIPAA because employment is not a permitted purpose for PHI disclosure under the Privacy Rule.

Psychotherapy notes receive special protection under HIPAA because:

Answer: They require a separate, specific authorization for disclosure beyond standard PHI

Psychotherapy notes are treated as a special category of PHI under HIPAA and require a specific authorization for most disclosures, separate from an authorization that covers other PHI.

A business associate agreement (BAA) under HIPAA is required when a covered entity shares PHI with a vendor who:

Answer: Creates, receives, maintains, or transmits PHI on behalf of the covered entity

A BAA is legally required whenever a covered entity engages a business associate that will create, receive, maintain, or transmit PHI while performing services on the covered entity's behalf.