HIPAA Mental Health and Substance Abuse Privacy Rules 5 — Questions and Answers
Question 1: A behavioral health organization experiences a breach affecting 800 patients' mental health records. Under HIPAA, notifications must be provided to affected individuals within:
- 30 days of discovery
- 60 days of discovery (Correct answer)
- 90 days of discovery
- 6 months of discovery
Correct answer: 60 days of discovery
HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach.
Question 2: A patient in a substance abuse program requests an accounting of disclosures of their 42 CFR Part 2 records. What must the program provide?
- Only disclosures made in the last 30 days
- A list of all disclosures made without consent during the past 6 years (Correct answer)
- Only disclosures to law enforcement
- Only disclosures to other healthcare providers
Correct answer: A list of all disclosures made without consent during the past 6 years
Under Part 2 and HIPAA, patients are entitled to an accounting of all disclosures made without consent, generally covering the past 6 years.
Question 3: Under HIPAA, a covered mental health provider may share PHI with a patient's family member WITHOUT authorization when:
- The family member requests the records in writing
- The patient is present and agrees, or the provider determines it is in the best interest of an incapacitated patient (Correct answer)
- The family member is paying for the treatment
- The treating provider judges the family member needs the information
Correct answer: The patient is present and agrees, or the provider determines it is in the best interest of an incapacitated patient
HIPAA permits sharing PHI with family members when the patient is present and agrees, or when the patient is incapacitated and the provider determines sharing is in the patient's best interest.
Question 4: Which entity type is subject to 42 CFR Part 2 but would NOT automatically be a HIPAA covered entity?
- A hospital that also operates a substance abuse unit
- A federally assisted non-medical substance abuse counseling program that does not transmit health information electronically (Correct answer)
- A health plan that covers SUD treatment
- A large addiction medicine medical group
Correct answer: A federally assisted non-medical substance abuse counseling program that does not transmit health information electronically
A federally assisted SUD counseling program that doesn't bill electronically or transmit health information electronically is subject to Part 2 but may not meet HIPAA's definition of a covered entity.
Question 5: A researcher wants access to identifiable mental health records from a covered entity without patient authorization. Under HIPAA, this may be allowed if:
- The researcher is employed at a university
- An IRB or Privacy Board waives the authorization requirement and specific conditions are met (Correct answer)
- The research is federally funded
- The researcher agrees to destroy the records after use
Correct answer: An IRB or Privacy Board waives the authorization requirement and specific conditions are met
HIPAA permits covered entities to disclose identifiable PHI for research without authorization only when an IRB or Privacy Board has waived the authorization requirement and specific regulatory conditions are satisfied.
Question 6: A covered entity's business associate stores electronic mental health records. The business associate suffers a ransomware attack. Under HIPAA, who has the primary obligation to notify affected patients?
- The business associate, directly to patients
- The covered entity, after being notified by the business associate (Correct answer)
- HHS Office for Civil Rights, who then notifies patients
- The state attorney general's office
Correct answer: The covered entity, after being notified by the business associate
The business associate must notify the covered entity of the breach, and then the covered entity bears the primary obligation to notify affected patients under HIPAA's Breach Notification Rule.
Question 7: Under the Mental Health Parity and Addiction Equity Act (MHPAEA), health plans must ensure that mental health and SUD benefits are provided at parity with medical benefits. This primarily affects HIPAA by:
- Replacing HIPAA privacy rules for mental health claims
- Reinforcing that mental health claims data must be protected with the same rigor as other medical PHI (Correct answer)
- Exempting mental health records from minimum necessary standards
- Requiring separate authorizations for all mental health insurance claims
Correct answer: Reinforcing that mental health claims data must be protected with the same rigor as other medical PHI
MHPAEA ensures equal coverage for mental health/SUD benefits, and HIPAA's privacy protections apply equally — reinforcing that mental health claims data receives the same PHI protections as other medical information.
HIPAA Mental Health and Substance Abuse Privacy Rules 5
A behavioral health organization experiences a breach affecting 800 patients' mental health records.
Under HIPAA, notifications must be provided to affected individuals within: