HIPAA The Omnibus Rule 4 — Questions and Answers
Question 1: The Omnibus Rule expanded individuals' rights regarding access to their PHI. Which of the following is a new right introduced or clarified by the Omnibus Rule?
- The right to demand immediate destruction of their PHI
- The right to receive an electronic copy of their PHI held in an EHR (Correct answer)
- The right to prevent all disclosures of PHI to family members
- The right to access PHI of deceased relatives indefinitely
Correct answer: The right to receive an electronic copy of their PHI held in an EHR
The Omnibus Rule established that individuals have the right to receive an electronic copy of their PHI when it is maintained in an electronic health record.
Question 2: Under the Omnibus Rule, for how long does a covered entity retain authority over the PHI of a deceased individual?
- 1 year after death
- 50 years after death (Correct answer)
- 10 years after death
- Indefinitely
Correct answer: 50 years after death
The Omnibus Rule established that HIPAA protections for PHI of deceased individuals expire 50 years after the person's death.
Question 3: Under the Omnibus Rule, when is a Notice of Privacy Practices (NPP) update required to be distributed to existing patients?
- Whenever any minor change is made to the NPP
- Only when the change involves new uses or disclosures of PHI not previously described (Correct answer)
- Only at the beginning of each calendar year regardless of changes
- Every time a business associate relationship changes
Correct answer: Only when the change involves new uses or disclosures of PHI not previously described
Under the Omnibus Rule, covered entities must redistribute the NPP to existing patients only when material changes involve new uses or disclosures not previously described.
Question 4: The Omnibus Rule clarified rules around fundraising activities. Which of the following is accurate regarding fundraising under the revised rule?
- No PHI may be used for fundraising without authorization under any circumstances
- Individuals must be given the opportunity to opt out of receiving fundraising communications (Correct answer)
- Health plans may use PHI for fundraising without any restrictions
- Covered entities must obtain prior authorization before any fundraising use of PHI
Correct answer: Individuals must be given the opportunity to opt out of receiving fundraising communications
The Omnibus Rule requires covered entities to include an opt-out mechanism in all fundraising communications and to honor opt-out requests.
Question 5: Which of the following scenarios would be considered a 'sale of PHI' requiring individual authorization under the Omnibus Rule?
- Disclosing PHI to a business associate for treatment-related services under a BAA
- Providing PHI to a researcher in exchange for payment covering only administrative costs
- Transferring PHI during a covered entity merger where remuneration is paid (Correct answer)
- Sharing de-identified data with a marketing firm for compensation
Correct answer: Transferring PHI during a covered entity merger where remuneration is paid
A transfer of PHI during a merger or acquisition where remuneration is paid constitutes a sale of PHI requiring authorization unless an exception applies.
Question 6: Under the Omnibus Rule, what constitutes 'adequate notice' for a covered entity's website regarding its NPP?
- A link to the NPP must appear on the home page or landing page of the covered entity's website (Correct answer)
- The full text of the NPP must be displayed on every page of the website
- The NPP must be emailed to every website visitor
- A telephone number to request the NPP must be posted on the site
Correct answer: A link to the NPP must appear on the home page or landing page of the covered entity's website
Covered entities with websites must post a prominent link to their NPP on the home page or the first significant landing page of their website.
Question 7: Under the Omnibus Rule, what is the required timeframe for a covered entity to respond to an individual's request for access to their PHI?
- Within 15 calendar days, with a possible 15-day extension
- Within 30 calendar days, with a possible 30-day extension (Correct answer)
- Within 60 calendar days, with no extension allowed
- Within 10 business days, with a possible 20-day extension
Correct answer: Within 30 calendar days, with a possible 30-day extension
Covered entities must respond to PHI access requests within 30 calendar days, with one 30-day extension allowed if the covered entity notifies the individual of the delay.
HIPAA The Omnibus Rule 4
The Omnibus Rule expanded individuals' rights regarding access to their PHI.
Which of the following is a new right introduced or clarified by the Omnibus Rule?