HIPAA Patient Rights Under HIPAA 4 — Questions and Answers
Question 1: Under HIPAA, which of the following is NOT a valid ground for a covered entity to deny a patient's amendment request?
- The PHI was not created by the covered entity
- The PHI is accurate and complete as determined by the entity
- The patient did not submit the request during business hours (Correct answer)
- The PHI is not part of the designated record set
Correct answer: The patient did not submit the request during business hours
Business hours of submission is never a valid basis for denying an amendment request under HIPAA.
Question 2: A patient wants to know who has accessed their electronic health record in the past year. Which HIPAA right most directly addresses this?
- Right to access
- Right to amend
- Right to an accounting of disclosures (Correct answer)
- Right to confidential communications
Correct answer: Right to an accounting of disclosures
The right to an accounting of disclosures allows patients to learn which entities have received their PHI.
Question 3: A covered entity may charge a fee for providing PHI to a patient. Under HIPAA, this fee must be:
- A flat $25 administrative fee
- Cost-based and limited to labor, supplies, and postage (Correct answer)
- Whatever the state medical records statute permits
- Waived entirely if the patient requests digital copies
Correct answer: Cost-based and limited to labor, supplies, and postage
HIPAA permits only a reasonable, cost-based fee covering labor for copying, supplies, and postage.
Question 4: Which statement correctly describes the relationship between HIPAA patient rights and state law?
- HIPAA preempts all state laws regarding patient access to records
- State laws that provide greater privacy protections than HIPAA generally prevail (Correct answer)
- State laws that are less protective than HIPAA are allowed because of federalism
- HIPAA and state law are completely independent with no interaction
Correct answer: State laws that provide greater privacy protections than HIPAA generally prevail
HIPAA sets a federal floor; state laws that are more protective of patient privacy are not preempted.
Question 5: If a covered entity denies access to PHI in a designated record set, it must provide the denial in writing and include:
- The patient's insurance information
- The basis for denial, the patient's right to review, and complaint procedures (Correct answer)
- A list of all staff who viewed the record
- Proof the PHI was created by another entity
Correct answer: The basis for denial, the patient's right to review, and complaint procedures
A written denial must explain the basis, inform the patient of their right to request a review, and describe how to file a complaint.
Question 6: Under HIPAA, a patient's right to receive a Notice of Privacy Practices (NPP) applies when?
- Only at the time the patient first receives services
- At first service delivery and whenever the notice is materially revised (Correct answer)
- Annually regardless of whether changes have been made
- Only when the patient requests one in writing
Correct answer: At first service delivery and whenever the notice is materially revised
Covered entities must provide the NPP at first service and notify patients of material revisions.
Question 7: A deceased patient's executor requests access to the patient's PHI. Under HIPAA, the executor is considered:
- An unauthorized third party with no rights to PHI
- A personal representative with the same access rights as the patient had (Correct answer)
- A business associate of the covered entity
- An individual who must obtain a court order to access records
Correct answer: A personal representative with the same access rights as the patient had
HIPAA allows personal representatives of deceased individuals, such as executors, the same PHI access rights the patient had.
HIPAA Patient Rights Under HIPAA 4
Under HIPAA, which of the following is NOT a valid ground for a covered entity to deny a patient's amendment request?