HIPAA Research, Public Health, and Law Enforcement Exceptions

Question 1

Under the HIPAA Privacy Rule, a covered entity may use or disclose PHI for research without individual authorization when:

Accepted Answer

An Institutional Review Board (IRB) or Privacy Board has approved a waiver of authorization

Answer

HIPAA permits use or disclosure of PHI for research without individual authorization if an IRB or Privacy Board has approved a waiver, finding that the research meets specific criteria (e.g., minimal privacy risk, impracticable to conduct otherwise). Employment status and funding source are not the determining factors.

Question 2

A 'limited data set' under HIPAA differs from fully de-identified data in that a limited data set:

Accepted Answer

May still include certain dates and geographic subdivisions but requires a signed Data Use Agreement

Answer

A limited data set retains certain data elements that would otherwise constitute PHI — such as dates (admission, discharge, birth) and geographic subdivisions larger than a street address — making it useful for research and public health. However, it requires a Data Use Agreement (DUA) with the recipient, unlike fully de-identified data which has no restrictions.

Question 3

Which of the following is a permitted disclosure of PHI to a public health authority under the HIPAA Privacy Rule without patient authorization?

Accepted Answer

Reporting a communicable disease to the state department of health as required by law

Answer

HIPAA explicitly permits covered entities to disclose PHI to public health authorities authorized by law to receive such reports for purposes of preventing or controlling disease, injury, or disability — including mandatory disease reporting to state health departments. The other options describe commercial or competitive uses that are not public health purposes.

Question 4

Law enforcement may obtain PHI from a covered entity without patient authorization in which of the following circumstances?

Accepted Answer

Pursuant to a court order, warrant, subpoena, or grand jury subpoena

Answer

HIPAA permits disclosure to law enforcement in response to a court order, court-ordered warrant, subpoena, or grand jury subpoena — formal legal process that provides judicial or grand jury oversight. Mere verbal assertion by an officer, without formal process, does not satisfy HIPAA's requirements in most circumstances.

Question 5

Under HIPAA, a covered entity may disclose PHI about a deceased individual to a medical examiner or coroner to:

Accepted Answer

Identify a deceased individual or determine the cause of death

Answer

The HIPAA Privacy Rule explicitly permits disclosure of PHI to medical examiners and coroners for purposes of identifying a deceased person or determining the cause of death. This exception recognizes the public interest in proper death investigation. It does not extend to litigation support or liability management.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Research, Public Health, and Law Enforcement Exceptions