The Omnibus Rule Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 The Omnibus Rule flashcards as text
The Omnibus Rule expanded individuals' rights regarding access to their PHI. Which of the following is a new right introduced or clarified by the Omnibus Rule?
Answer: The right to receive an electronic copy of their PHI held in an EHR
The Omnibus Rule established that individuals have the right to receive an electronic copy of their PHI when it is maintained in an electronic health record.
Under the Omnibus Rule, for how long does a covered entity retain authority over the PHI of a deceased individual?
Answer: 50 years after death
The Omnibus Rule established that HIPAA protections for PHI of deceased individuals expire 50 years after the person's death.
Under the Omnibus Rule, when is a Notice of Privacy Practices (NPP) update required to be distributed to existing patients?
Answer: Only when the change involves new uses or disclosures of PHI not previously described
Under the Omnibus Rule, covered entities must redistribute the NPP to existing patients only when material changes involve new uses or disclosures not previously described.
The Omnibus Rule clarified rules around fundraising activities. Which of the following is accurate regarding fundraising under the revised rule?
Answer: Individuals must be given the opportunity to opt out of receiving fundraising communications
The Omnibus Rule requires covered entities to include an opt-out mechanism in all fundraising communications and to honor opt-out requests.
Which of the following scenarios would be considered a 'sale of PHI' requiring individual authorization under the Omnibus Rule?
Answer: Transferring PHI during a covered entity merger where remuneration is paid
A transfer of PHI during a merger or acquisition where remuneration is paid constitutes a sale of PHI requiring authorization unless an exception applies.
Under the Omnibus Rule, what constitutes 'adequate notice' for a covered entity's website regarding its NPP?
Answer: A link to the NPP must appear on the home page or landing page of the covered entity's website
Covered entities with websites must post a prominent link to their NPP on the home page or the first significant landing page of their website.
Under the Omnibus Rule, what is the required timeframe for a covered entity to respond to an individual's request for access to their PHI?
Answer: Within 30 calendar days, with a possible 30-day extension
Covered entities must respond to PHI access requests within 30 calendar days, with one 30-day extension allowed if the covered entity notifies the individual of the delay.