HIPAA Patient Rights Under HIPAA 3 — Questions and Answers
Question 1: A minor patient's parent requests access to the child's medical records. Under HIPAA, the parent's right to access is generally:
- Unconditional in all situations
- Subject to state law and certain exceptions (Correct answer)
- Prohibited because the minor is the patient
- Allowed only if the minor consents in writing
Correct answer: Subject to state law and certain exceptions
Parents are generally the personal representatives of minors, but state law and specific HIPAA exceptions can limit this access.
Question 2: Which entity is designated under HIPAA to receive complaints about privacy rights violations?
- The Federal Trade Commission (FTC)
- The Office for Civil Rights (OCR) within HHS (Correct answer)
- The State Attorney General exclusively
- The Centers for Medicare & Medicaid Services (CMS)
Correct answer: The Office for Civil Rights (OCR) within HHS
The HHS Office for Civil Rights (OCR) enforces the HIPAA Privacy Rule and receives patient complaints.
Question 3: A patient requests their records be sent directly to another provider. Under the HIPAA right of access, the original provider must:
- Send the records only if the other provider is in-network
- Send the records in the format requested if readily producible (Correct answer)
- Print and mail paper copies regardless of the request format
- Charge the patient a fee before transmitting to the other provider
Correct answer: Send the records in the format requested if readily producible
HIPAA requires covered entities to provide PHI in the format the patient requests if it is readily producible in that form.
Question 4: Under HIPAA, what is the maximum look-back period for which a patient can request an accounting of disclosures?
- 1 year
- 3 years
- 6 years (Correct answer)
- 10 years
Correct answer: 6 years
Patients may request an accounting covering up to 6 years prior to the date of the request.
Question 5: A patient's legal guardian submits a request to access the patient's PHI. Under HIPAA, the guardian is treated as:
- An unauthorized third party who must obtain a subpoena
- A personal representative with the same rights as the patient (Correct answer)
- A business associate of the covered entity
- A covered entity in their own right
Correct answer: A personal representative with the same rights as the patient
HIPAA recognizes personal representatives, including legal guardians, as having the same access rights as the patient.
Question 6: Which of the following actions is a covered entity PROHIBITED from doing in response to a patient exercising their HIPAA privacy rights?
- Charging a reasonable cost-based fee for copies
- Retaliating by denying treatment or services (Correct answer)
- Requesting the patient submit the request in writing
- Asking the patient to clarify the scope of the request
Correct answer: Retaliating by denying treatment or services
HIPAA expressly prohibits covered entities from retaliating against patients who exercise their privacy rights.
Question 7: A patient asks a covered entity to amend a record and the entity agrees. What must the entity do next?
- Delete the original entry and replace it with the amended one
- Inform the patient and identify persons or entities that need the amendment (Correct answer)
- File the amendment with the HHS Secretary within 30 days
- Require the patient to sign a new HIPAA authorization form
Correct answer: Inform the patient and identify persons or entities that need the amendment
When agreeing to an amendment, the entity must notify the patient and share the amendment with relevant parties who received the original PHI.
HIPAA Patient Rights Under HIPAA 3
A minor patient's parent requests access to the child's medical records.
Under HIPAA, the parent's right to access is generally: