HIPAA Mental Health and Substance Abuse Privacy Rules 5

Question 1

A behavioral health organization experiences a breach affecting 800 patients' mental health records. Under HIPAA, notifications must be provided to affected individuals within:

Accepted Answer

60 days of discovery

Answer

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach.

Question 2

A patient in a substance abuse program requests an accounting of disclosures of their 42 CFR Part 2 records. What must the program provide?

Accepted Answer

A list of all disclosures made without consent during the past 6 years

Answer

Under Part 2 and HIPAA, patients are entitled to an accounting of all disclosures made without consent, generally covering the past 6 years.

Question 3

Under HIPAA, a covered mental health provider may share PHI with a patient's family member WITHOUT authorization when:

Accepted Answer

The patient is present and agrees, or the provider determines it is in the best interest of an incapacitated patient

Answer

HIPAA permits sharing PHI with family members when the patient is present and agrees, or when the patient is incapacitated and the provider determines sharing is in the patient's best interest.

Question 4

Which entity type is subject to 42 CFR Part 2 but would NOT automatically be a HIPAA covered entity?

Accepted Answer

A federally assisted non-medical substance abuse counseling program that does not transmit health information electronically

Answer

A federally assisted SUD counseling program that doesn't bill electronically or transmit health information electronically is subject to Part 2 but may not meet HIPAA's definition of a covered entity.

Question 5

A researcher wants access to identifiable mental health records from a covered entity without patient authorization. Under HIPAA, this may be allowed if:

Accepted Answer

An IRB or Privacy Board waives the authorization requirement and specific conditions are met

Answer

HIPAA permits covered entities to disclose identifiable PHI for research without authorization only when an IRB or Privacy Board has waived the authorization requirement and specific regulatory conditions are satisfied.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Mental Health and Substance Abuse Privacy Rules 5