HIPAA Patient Rights Under HIPAA 5 — Questions and Answers
Question 1: A patient requests electronic copies of their PHI from a covered entity that maintains an EHR. The entity must provide the records:
- In paper format only, to ensure accuracy
- In the electronic format the patient requests if readily producible (Correct answer)
- Only through the entity's patient portal
- After obtaining a new HIPAA authorization from the patient
Correct answer: In the electronic format the patient requests if readily producible
Under the HIPAA right of access, entities with EHRs must provide electronic copies in the patient's requested format if it is readily producible.
Question 2: A patient submits a restriction request asking a hospital not to share their PHI with family members. The hospital may voluntarily agree, but if it does, it is then:
- Relieved of the restriction if the family calls directly
- Bound by the restriction and must honor it (Correct answer)
- Required to obtain court approval before enforcing it
- Permitted to share in any emergency regardless of the restriction
Correct answer: Bound by the restriction and must honor it
If a covered entity voluntarily agrees to a restriction it was not required to honor, it is legally bound to comply with it.
Question 3: Which of the following scenarios BEST illustrates the right to confidential communications?
- A patient asks that their diagnosis never be shared with anyone
- A patient asks the provider to call them at their work number rather than home (Correct answer)
- A patient requests that their records be destroyed after treatment
- A patient demands to see who entered information into their chart
Correct answer: A patient asks the provider to call them at their work number rather than home
Requesting an alternative contact number is a classic example of exercising the right to confidential communications.
Question 4: Under the HIPAA Privacy Rule, how many free accountings of disclosures is a patient entitled to receive per 12-month period?
- Unlimited
- One (Correct answer)
- Two
- Three
Correct answer: One
Patients are entitled to one free accounting per 12-month period; subsequent requests in the same period may incur a fee.
Question 5: A hospital refuses to provide a patient's records because the patient owes an outstanding balance. Is this permissible under HIPAA?
- Yes, providers may condition access on payment of outstanding bills
- No, the right to access PHI cannot be conditioned on payment of outstanding balances (Correct answer)
- Yes, but only if the balance exceeds $100
- No, unless a court authorizes the withholding
Correct answer: No, the right to access PHI cannot be conditioned on payment of outstanding balances
HIPAA does not permit covered entities to withhold PHI access simply because a patient has an unpaid balance.
Question 6: A covered entity disagrees with a patient's amendment request and submits a written denial. The patient may then:
- File a criminal complaint against the provider immediately
- Submit a written statement of disagreement to be included with the PHI (Correct answer)
- Request that HHS override the covered entity's decision
- Demand the record be sealed until the dispute is resolved
Correct answer: Submit a written statement of disagreement to be included with the PHI
When an amendment is denied, patients have the right to submit a statement of disagreement that the covered entity must attach to the disputed record.
Question 7: Which of the following is included in a patient's 'designated record set' for purposes of the HIPAA right to access?
- Psychotherapy notes kept separately by a mental health provider
- Quality improvement records used solely for internal benchmarking
- Medical and billing records used to make decisions about the patient (Correct answer)
- Peer review records protected under state law
Correct answer: Medical and billing records used to make decisions about the patient
The designated record set includes medical and billing records used to make decisions about individuals, giving patients the right to access them.
HIPAA Patient Rights Under HIPAA 5
A patient requests electronic copies of their PHI from a covered entity that maintains an EHR.
The entity must provide the records: