HIPAA Research, Public Health, and Law Enforcement Exceptions

Question 1

Under the HIPAA Privacy Rule, a covered entity may use or disclose PHI for research without individual authorization when:

Accepted Answer

An Institutional Review Board (IRB) or Privacy Board has approved a waiver of authorization

Answer

The research will be published in a peer-reviewed journal within 12 months

Answer

The researcher is employed full-time by the covered entity

Answer

The research is funded entirely by a federal agency such as the NIH

Question 2

A 'limited data set' under HIPAA differs from fully de-identified data in that a limited data set:

Accepted Answer

May still include certain dates and geographic subdivisions but requires a signed Data Use Agreement

Answer

Contains no PHI and may be shared freely without any restrictions

Answer

Can only be used for direct treatment purposes and not research

Answer

Must receive prior approval from the Office for Civil Rights before any sharing

Question 3

Which of the following is a permitted disclosure of PHI to a public health authority under the HIPAA Privacy Rule without patient authorization?

Accepted Answer

Reporting a communicable disease to the state department of health as required by law

Answer

Sharing PHI with a public relations firm hired by the state health department

Answer

Releasing aggregate patient data to a competing hospital for benchmarking

Answer

Disclosing marketing analytics about patients' prescription habits to a state health plan

Question 4

Law enforcement may obtain PHI from a covered entity without patient authorization in which of the following circumstances?

Accepted Answer

Pursuant to a court order, warrant, subpoena, or grand jury subpoena

Answer

For any federal crime investigation, regardless of whether legal process has been initiated

Answer

Whenever a law enforcement officer verbally asserts an urgent public safety need

Answer

Only when the patient is a named suspect in a violent felony

Question 5

Under HIPAA, a covered entity may disclose PHI about a deceased individual to a medical examiner or coroner to:

Accepted Answer

Identify a deceased individual or determine the cause of death

Answer

Support a civil lawsuit filed by the deceased's surviving family members

Answer

Help the covered entity reduce liability exposure related to the death

Answer

Comply with insurance claims processing requirements from the deceased's health plan

Question 6

When an IRB considers whether to waive HIPAA authorization for a research study, which of the following is NOT a required criterion for granting that waiver?

Accepted Answer

The researcher must be a full-time employee of the covered entity holding the records

Answer

The research involves no more than minimal risk to the privacy of individuals

Answer

The research could not practicably be conducted without access to the PHI

Answer

The research could not practicably be conducted without the waiver of authorization